Privacy Policy — How 99spin Handles Your Data

This Privacy Policy describes how 99spin ("we", "us", "our", or the "Platform") collects, uses, stores, and shares personal information relating to individuals who access or use the 99spin website at 99spin.win and any associated sub-domains (collectively, the "Platform"). It applies to all registered players, visitors, and any person who interacts with the 99spin Platform in any capacity.

By registering a 99spin account, depositing funds, or continuing to use the Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy. If you do not agree to the terms set out in this document, you must discontinue use of the 99spin Platform immediately.

This Privacy Policy should be read together with our Terms and Conditions, which govern your use of the Platform as a whole.

For the purposes of applicable data protection law, 99spin is the data controller responsible for the personal information you provide when using the Platform. As data controller, 99spin determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable legal requirements and international gaming authority data protection guidelines.

All enquiries, access requests, and data-related complaints should be directed to 99spin through the contact channels set out in Section 15 of this Policy.

99spin collects personal data in the following categories:

3.1 Registration Data. When you create a 99spin account, we collect your legal full name, date of birth, email address, Malaysian mobile phone number, and the password you select. This information is required to create and maintain your account.

3.2 Identity Verification Data. To comply with Know Your Customer (KYC) and anti-money laundering (AML) obligations, we may collect copies of government-issued identification documents (such as a Malaysian MyKad or passport), proof of address documents, and proof of payment method ownership. This data is collected only where required for verification purposes.

3.3 Financial Data. We collect information about the payment methods you use to deposit and withdraw funds on 99spin, including e-wallet account references (Touch n Go, Boost, GrabPay), DuitNow references, and FPX bank account details where applicable. We do not store full card numbers or banking credentials.

3.4 Transaction Data. We maintain records of all deposits, withdrawals, bonus credits, wagers placed, and game results associated with your 99spin account. This data is required for account management, dispute resolution, and regulatory reporting.

3.5 Technical Data. When you access the Platform, we automatically collect certain technical information including your IP address, device type and operating system, browser type and version, referring URL, pages visited, session duration, and timestamps. This data is collected through server logs and cookies.

3.6 Communications Data. If you contact 99spin via live chat, email, or any other channel, we retain records of those communications including the content of messages and any information you provide in the course of seeking support.

3.7 Responsible Gaming Data. Where you utilise responsible gaming tools such as deposit limits, self-exclusion, or cooling-off periods, 99spin records your elections and their effective dates. This data is used to enforce your chosen restrictions and to fulfil our responsible gaming obligations.

99spin uses your personal data for the following purposes:

• Creating, maintaining, and administering your 99spin player account;
• Processing deposits, withdrawals, and in-game transactions in Malaysian Ringgit;
• Verifying your identity and age (21+) in accordance with KYC requirements;
• Detecting and preventing fraud, money laundering, collusion, and other prohibited activities;
• Providing customer support and resolving account disputes;
• Administering bonuses, promotions, and loyalty programmes;
• Enforcing responsible gaming tools and restrictions you have elected;
• Complying with applicable legal, regulatory, and audit obligations;
• Sending service communications including account notifications and security alerts;
• Sending marketing communications where you have provided consent (see Section 13);
• Improving Platform performance, user experience, and game content;
• Conducting internal analytics and platform security monitoring.

99spin processes your personal data on the following legal bases:

Contractual Necessity: Processing that is required to perform our obligations under the player account agreement, including transaction processing, account management, and customer support.

Legal Obligation: Processing required to comply with KYC, AML, responsible gaming, and other obligations imposed by applicable gaming authority regulations and data protection law.

Legitimate Interests: Processing for fraud prevention, platform security, abuse detection, internal analytics, and service improvement, where such interests are not overridden by your rights and freedoms.

Consent: Processing for direct marketing communications, where you have provided explicit consent. You may withdraw consent at any time by contacting 99spin support or adjusting your account marketing preferences.

99spin uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Required for Platform functionality including session management, login state, and security. These cannot be disabled without affecting core Platform features.
• Performance Cookies: Used to collect anonymised data about how players use the Platform, including page load times and error rates. This data helps us improve Platform performance.
• Functionality Cookies: Remember your preferences such as language settings and game lobby filters to personalise your experience.
• Analytics Cookies: Used to understand aggregate player behaviour patterns on the Platform. Data collected through analytics cookies does not identify individual players.

You may configure your browser to refuse or delete cookies. Note that disabling strictly necessary cookies may impair your ability to log in or use core 99spin Platform features.

99spin does not sell or rent your personal data to third parties. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Service Providers: To process your MYR deposits and withdrawals via Touch n Go eWallet, Boost, GrabPay, DuitNow, and FPX-connected Malaysian banks;
• Identity Verification Services: To carry out KYC and age verification procedures;
• Game Content Providers: Game studios and live dealer platform operators may receive anonymised session data necessary for game operation and RNG certification;
• Fraud Prevention and Security Services: Third-party systems used to detect fraud, collusion, and money laundering activity;
• Regulatory Authorities: Where required by applicable gaming authority regulations or legal process, 99spin may disclose player data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction;
• Corporate Transactions: In the event of a merger, acquisition, or sale of 99spin's business, player data may be transferred to the acquiring entity subject to equivalent privacy protections.

Some of the third-party service providers engaged by 99spin may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, 99spin ensures that appropriate safeguards are in place, including contractual clauses that impose equivalent data protection obligations on the receiving party. By using the 99spin Platform, you acknowledge and consent to such international transfers where necessary for the operation of your account.

99spin retains personal data for as long as your account remains active and for such additional period as may be required by applicable gaming authority regulations and anti-money laundering obligations. As a general principle, financial transaction records are retained for a minimum of five (5) years following the closure of your account. Identity verification documents are retained for the period required by applicable KYC regulations.

Where personal data is no longer required for the purpose for which it was collected and no legal retention obligation applies, 99spin will securely delete or irreversibly anonymise that data.

Subject to applicable data protection law and any overriding regulatory obligations, you hold the following rights in respect of your personal data held by 99spin:

• Right of Access: You may request a copy of the personal data 99spin holds about you;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations;
• Right to Restriction: You may request that 99spin restrict the processing of your personal data in certain circumstances;
• Right to Data Portability: You may request a copy of certain personal data in a structured, machine-readable format;
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact 99spin via our 24/7 live chat or by email as detailed in Section 15. We will respond to all verified data subject requests within 30 days. We may need to verify your identity before processing your request.

The 99spin Platform is strictly not intended for use by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that a registered account belongs to a person under the minimum age requirement, we will immediately suspend that account, forfeit any associated balances where applicable, and delete all personal data associated with that account in accordance with our data retention obligations.

99spin implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include SSL/TLS encryption for all data in transit, encryption of sensitive data at rest, role-based access controls limiting data access to authorised personnel, regular security vulnerability assessments, and monitored intrusion detection systems. Notwithstanding these measures, no system is entirely immune from security risks. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their 99spin accounts.

With your consent, 99spin may send you promotional emails, SMS notifications, or in-Platform messages about new games, bonuses, promotions, and other 99spin services that may be of interest to you as a Malaysian player. You may withdraw consent to marketing communications at any time by:

• Clicking the unsubscribe link in any promotional email;
• Updating your communication preferences in your 99spin account settings;
• Contacting 99spin support via live chat.

Withdrawal of marketing consent does not affect the delivery of essential service communications such as account security alerts, transaction confirmations, and responsible gaming notifications.

99spin reserves the right to update or amend this Privacy Policy at any time. Material changes to this Policy will be communicated to registered players via email to the address on record, with a minimum of 14 days' notice before the effective date of any material change. The date at the top of this Privacy Policy reflects the date of the most recent revision. Your continued use of the 99spin Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Privacy Policy periodically.

For all privacy-related enquiries, data subject access requests, or complaints regarding the handling of your personal information by 99spin, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the 99spin Platform — the fastest way to reach us
• Email: [email protected] (plain text — not a clickable link)

99spin will acknowledge all data-related enquiries within 48 hours and will endeavour to resolve substantive data subject requests within 30 calendar days of receipt. Where a request is complex or numerous, we will notify you if we require an extension of time to respond.