Privacy Policy kis99 — Personal Data Protection for Malaysian Members

1Information We Collect

When you register or use the kis99 platform, we collect several categories of information to enable us to provide you with a secure, efficient service tailored to your needs as a member. The information we collect falls into three main categories:

Information you provide directly:

• Full name as shown on official identification documents
• Active email address used for account communications
• A valid Malaysian mobile number
• Date of birth for age verification (18 years and above)
• Bank account or digital wallet details for deposit and withdrawal purposes
• A copy of your identity document (MyKad or passport) during the KYC process

Automatically collected information:

• The IP address of your device when accessing the platform
• Device type, operating system, and web browser version
• Session log data including login time, logout time, and session duration
• Gaming activity records and financial transaction history
• Approximate geolocation data derived from IP address for compliance purposes

Information from third-party sources: In some cases, we may receive additional information from the payment processor you use to verify the legitimacy of your transaction. This information is used solely for security and verification purposes, not for marketing.

2Data Collection Purpose

Kis99 collects your personal information based on the principle of data minimisation — we only collect what is strictly necessary for clear and legitimate purposes. The following are the primary purposes of our data collection:

We will not use your data for any purpose other than those stated in the table above without first obtaining your additional consent.

3Cookie Usage

The kis99 platform uses cookies and similar tracking technologies to enhance the user experience, ensure session security, and understand how members interact with our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled as they are essential to platform operation.
• Performance Cookies: Collecting information about how you use our platform — for example, which pages are visited most frequently. All information collected is anonymous and used solely for service improvement.
• Functional Cookies: Allows the platform to remember your preferences such as interface language and display settings to provide a more personalised experience.
• Analytics Cookies: Used to understand overall platform usage patterns to help us make better improvement decisions.

You can manage or disable certain cookies through your web browser settings. Please note, however, that disabling essential cookies may affect platform functionality and your user experience.

4Data Sharing with Third Parties

Kis99 does not sell, rent, or disclose members' personal data to third parties for marketing or commercial purposes. However, there are limited situations where we need to share certain information with specific parties to enable the platform to operate properly and securely:

• Payment processors: Required transaction information is shared with payment service providers such as DuitNow, FPX, Touch 'n Go eWallet, and others to process your deposits and withdrawals. These processors are bound by strict confidentiality agreements.
• Game software providers: Minimum account information required is shared with licensed game software providers to enable access to games on our platform.
• Authorities and regulatory bodies: We may be required by law to disclose certain information to the relevant authorities upon receipt of a valid request in accordance with legal procedures.
• Technical service providers: Companies that assist us in technical operations such as server hosting and security monitoring may have limited access to data solely to perform their functions.

In all cases of data sharing, we ensure that the receiving party maintains adequate security controls and may only use the data for agreed purposes. We do not permit any third party to use kis99 member data for their own benefit.

5Data Security Measures

Protecting member personal data is the highest priority at kis99. We continuously invest in the latest security infrastructure to ensure your information remains safe at all times. The following are the key security measures we have in place:

• 256-bit SSL encryption: All communications between your device and kis99 servers are encrypted using the latest TLS 1.3 protocol, ensuring no third party can intercept your data while in transit.
• Database encryption: Sensitive data such as payment information and identity documents are stored in encrypted format within our database, with encryption keys managed separately.
• Role-based access control: Access to member data within our internal systems is restricted based on job role. Customer support staff, for example, only have access to information relevant to their specific duties.
• Continuous security monitoring: Our automated monitoring system detects and alerts on any suspicious activity or unauthorised access attempts in real time, 24 hours a day.
• Regular security audits: The kis99 platform undergoes regular external security audits by independent cybersecurity firms to ensure all systems remain robust and up to date.
• Incident response plan: We have clear procedures in place to respond to any data breach, including notification to affected members within the timeframe prescribed by law.

6Your Privacy Rights as a Member

As a kis99 member and as an individual protected under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding the personal data we hold:

• Right to access: You may request a copy of the personal data we hold about you at any time. Such requests will be processed within 21 business days.
• Right to rectification: If you find that any information we hold is inaccurate or outdated, you have the right to request that we update it promptly.
• Right to withdraw consent: For data processing activities based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the validity of processing carried out prior to withdrawal.
• Right to restrict processing: In certain situations, you may request that we restrict how we use your data while a dispute is being resolved.
• Right to erasure: You may request deletion of your personal data, subject to our legal obligations to retain certain records for periods specified by regulation.

To exercise any of the above rights, please contact our support team via live chat or email. We will verify your identity before processing any data-related request to ensure the security of your account.

7Data Retention Period

Kis99 retains members' personal data for as long as necessary to fulfil the original purpose of collection and to comply with applicable legal obligations. The following are general guidelines for our data retention periods:

• Active account data: Retained for the duration your account is active and for an additional period following account closure as required by law.
• Financial transaction records: Retained for a minimum of seven (7) years in accordance with legal requirements relating to financial reporting and anti-money laundering.
• KYC documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with compliance requirements.
• Support communication logs: Retained for three (3) years for service reference and dispute resolution purposes.
• Cookie and analytics data: Retained for a period of 30 days to 24 months depending on the type of cookie.

Once the specified retention period has expired and there is no legal requirement to continue storing it, your data will be securely deleted using industry-recognised data deletion methods.

8Links to Third-Party Websites

The kis99 platform may contain references to third-party services such as game providers or payment processors that operate under their own privacy policies. When you access these services, you are leaving the controlled environment of the kis99 platform.

Key things you should know:

• Kis99 is not responsible for the privacy practices or content of third-party websites or services.
• Every third-party service provider integrated with the kis99 platform has undergone a basic security review before being approved for integration.
• We encourage you to read the privacy policy of any third-party service before providing them with your personal information.
• Any data you provide directly to third parties outside the kis99 platform is subject to their own privacy policies, not ours.

9Amendments to This Privacy Policy

Kis99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements, or platform improvements. Any amendments made will take effect immediately upon being published on this page.

For material or significant amendments that affect how we use your data, we will:

• Displaying a prominent notice on the platform's home page for at least seven (7) days
• Sending a notification to the email address registered with your account
• Updating the "Last Updated" date shown at the top of this page

Your continued use of the kis99 platform after any Privacy Policy changes take effect constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how we protect your privacy.

10Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the kis99 privacy team is ready to assist. You may contact us through the following methods:

• Live Chat: Available 24 hours a day, 7 days a week directly from the kis99 platform — the fastest way to get immediate assistance.
• Privacy Email: [email protected] — for more detailed written enquiries regarding privacy and personal data.

We aim to respond to all privacy-related enquiries within two (2) business days. For formal requests regarding data access, correction, or deletion, please provide sufficient information for us to verify your identity in order to protect your account security.

You also have the right to lodge a complaint with the relevant data protection authority in Malaysia if you believe your personal data has been handled in a manner that violates the PDPA.