Privacy Policy RM99 – Protection of Malaysian Users' Personal Data

At rm99, we understand that privacy is more than a legal requirement — it is the trust you place in us. As Malaysia's leading digital entertainment platform, we take this responsibility very seriously. Every decision we make regarding your data is guided by the principles of transparency, security, and respect for your personal privacy.

This Privacy Policy is drafted in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and international best standards in data handling. We continually update this policy to ensure it reflects our current practices and any changes in applicable legislation.

• This policy transparently explains every aspect of how your personal data is handled from start to finish.
• rm99 will not use your data for purposes outside the scope stated in this policy without your explicit consent.
• You have the right to access, correct, or request deletion of your personal data at any time in accordance with applicable laws.
• Should any material changes be made to this policy, you will be notified in advance via email or an in-platform notice on rm99.

Rm99 only collects information that is strictly necessary to deliver a secure, seamless, and high-quality service to you. No data is collected excessively or without a clear purpose.

• Data you provide directly during registration, KYC verification, and interactions with the rm99 platform.
• Data collected automatically when you use our services, including activity logs and device information.
• Data received from trusted third parties such as licensed payment providers and identity verification platforms.
• rm99 never collects sensitive data such as health information or religious beliefs without a compelling reason and your explicit consent.

Every piece of data we collect is used for a clear and legitimate purpose. rm99 adheres to the principle of "limited purpose" — your data will not be used for anything unrelated to the services you use.

• To verify your identity during registration and the KYC process to protect your account from misuse by third parties.
• To process deposits, withdrawals, and financial transactions quickly and securely through fully encrypted payment channels.
• To detect and prevent fraudulent activity, money laundering, and any security threats that could compromise your account.
• To send important notices regarding your account, transactions, the latest promotions, and policy updates that affect your use of the platform.
• To enhance your gaming experience through usage pattern analysis that helps us streamline the interface and game selection.
• To meet legal compliance requirements, including reporting to relevant authorities when required under Malaysian law.
• To support rm99's responsible gaming programme by identifying gaming patterns that may require attention or additional support.

Rm99 does not sell or rent your personal data to anyone. Data sharing only occurs in limited circumstances and exclusively with trusted parties, as outlined below.

• Payment Providers: Required financial data is shared with FPX, DuitNow, and licensed payment processors to complete your transactions. All these channels comply with PCI-DSS standards.
• Gaming Platform: Basic account information is shared with licensed game providers that operate slots, live casino, and other games within the rm99 ecosystem.
• Relevant Authorities: rm99 is required to disclose data to Malaysian authorities when mandated by law — including financial crime investigations or court orders.
• Technical Service Providers: Companies that assist us in managing technical infrastructure (such as cloud computing and cybersecurity) are granted strictly controlled, limited access.
• Not Sold: Your data has never been and will never be sold to advertisers, data brokers, or any other commercial party. This is rm99's absolute commitment.

Rm99 invests seriously in industry-grade security infrastructure to ensure your data remains in safe hands at all times, whether you are actively playing or not.

• 256-bit SSL/TLS encryption protects all data transmitted between your device and rm99's servers in real time.
• Data stored in our databases is protected with advanced-level encryption (AES-256) and multi-layered access controls.
• Intrusion detection systems (IDS) and next-generation firewalls monitor rm99's network traffic around the clock, 24/7.
• Two-factor authentication (2FA) is available for all accounts, adding an extra layer of protection beyond your password.
• Regular security audits are conducted by independent third parties to identify and close any vulnerabilities before they can be exploited.
• A comprehensive incident response procedure ensures rm99 can act swiftly in the event of any unexpected security incident.

Rm99 uses cookies and similar tracking technologies to keep the platform running smoothly and deliver a personalized experience to every user.

• Essential Cookies: Required for core platform functions such as login session authentication and security. These cookies cannot be disabled without affecting key functionality.
• Performance Cookies: To collect anonymised data on how users interact with the platform, helping us identify issues and improve the experience.
• Functional Cookies: To save your preferences such as language, display settings, and game choices so you do not need to reconfigure them every time you log in.
• Cookie Controls: You can manage or disable non-essential cookies through your browser settings. However, this may affect certain platform functions.
• Analytics data is collected in aggregate and anonymised form — rm99 does not identify individuals from the analytics data processed.

Under Malaysia's Personal Data Protection Act 2010 and rm99's own policy, you have the following rights regarding your personal data. We are committed to helping you exercise these rights easily and without obstacles.

• Right to Access: You have the right to request a copy of all personal data rm99 holds about you. Requests will be processed within 21 business days.
• Right to Rectification: If your data is inaccurate or outdated, you have the right to request immediate correction and we will update it within 7 business days.
• Right to Erasure: Under certain circumstances, you may request deletion of your personal data, subject to legal compliance obligations binding on rm99.
• Right to Restriction: You may request rm99 to restrict the processing of your data in certain situations, such as when you are disputing the accuracy of the data.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time, and rm99 must comply immediately.
• Right to Data Portability: You have the right to receive your data in a structured, machine-readable format for transfer to another service provider if desired.

Rm99 retains your personal data only for as long as necessary to fulfill the original purpose of collection or to meet applicable legal requirements — nothing beyond that.

• Active Account Data: Retained for the duration your account is active plus 5 years after account closure, in accordance with financial compliance requirements.
• Transaction Records: Retained for 7 years in accordance with financial reporting legal requirements and Malaysia's Anti-Money Laundering Act.
• Technical Logs: System and security log data is retained for 90 days for troubleshooting and security incident investigation purposes.
• Marketing Data: Retained until you withdraw consent or close your account, whichever comes first. You may unsubscribe at any time.
• Upon expiry of the retention period, data will be permanently deleted or anonymized using methods that meet industry standards.

Rm99's services are exclusively for individuals aged 21 and above. We take the protection of minors extremely seriously and have strict controls in place to prevent underage use of the platform.

• rm99 does not knowingly collect or process personal data from individuals under the age of 21.
• rm99's KYC verification process is specifically designed to detect and reject registrations from individuals below the legally required age.
• Should rm99 discover that personal data of a minor has been inadvertently collected, that data will be deleted immediately.
• Parents or guardians who believe their child has registered an rm99 account without authorisation are urged to contact our support team immediately for further action.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how rm99 handles your personal data, our team is ready to assist.

• Live Chat: The fastest way to reach the rm99 support team, available 24 hours a day, 7 days a week including public holidays.
• Official Email: Reach us at [email protected] for detailed privacy inquiries. We guarantee a response within 48 business hours.
• Formal Complaint: If you are not satisfied with rm99's response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.
• Policy Updates: This Privacy Policy will be updated from time to time. The latest update date is always displayed at the top of this page.