Privacy Policy gaya99 —
Protection of Your Personal Data

To provide a safe, trusted, and responsible online gaming platform service, gaya99 collects certain categories of personal information from our members. This data collection is carried out transparently and only when you provide consent through registration or use of our platform.

Directly Provided Information

This is the information you provide to us during the account registration process, identity verification (KYC), or when contacting our support team:

• Identity Information — full name as shown on your identification document, date of birth, gender, and identity card number (MyKad).
• Contact Information — email address, mobile number, and residential address.
• Financial Information — bank account number, bank name, and bank statement document for verification and payment processing purposes.
• Verification Documents — a copy of your MyKad, a face verification selfie, and any supporting documents required for the KYC process.

Automatically Collected Information

When you use the gaya99 platform, our systems automatically record certain technical information to ensure security and service quality:

Gaya99 uses collected personal data solely for legitimate, necessary and disclosed purposes. We do not use your data for purposes unrelated to the provision of our platform services.

Primary Purpose of Data Use

• Account Management — account registration, identity verification, password recovery, and account security.
• Transaction Processing — processing deposits, withdrawals, and bonus payments quickly and securely.
• Legal Compliance — fulfilling KYC, Anti-Money Laundering (AML) requirements, and reporting to relevant authorities when required by law.
• Platform Security — detecting and preventing fraud, unauthorised access, and suspicious activity.
• Responsible Gaming — monitoring gaming patterns to identify signs of problem gambling and providing appropriate protective tools.
• Service Improvement — analysing usage data in aggregate and anonymously to improve the platform and user experience.
• Communication — sending account-related information, security notifications, and, with your consent, relevant promotional offers.

Gaya99 does not sell or trade your personal data. However, in operating a secure and legally compliant platform, there are certain situations where we need to share specific information with the following parties:

Trusted Service Providers

We work with selected third-party service providers to support platform operations, including:

• Payment Gateway — to securely process deposits and withdrawals. They receive only the minimum information required to complete a transaction.
• Identity Verification Service Providers — to carry out KYC and AML checks as required by law.
• Game Providers — game companies that provide gaming content on our platform. Data is shared in a limited form and protected by strict contractual agreements.
• Cloud Infrastructure and Cybersecurity — hosting and security providers that help us maintain platform availability and security.

Legal Obligations

Gaya99 may be required to disclose personal information when mandated by law or court order, including requests from the Royal Malaysia Police (PDRM), Bank Negara Malaysia or any relevant regulatory authority. We will notify you of any such disclosure unless prohibited by law from doing so.

Gaya99 continuously invests in cybersecurity infrastructure to ensure our members' personal data is protected at all times. We apply a multi-layered protection approach covering technical, operational and organisational aspects.

Technical Measures

• Encryption in transit using TLS 1.3 and 256-bit SSL.
• Encryption at rest using AES-256 for all sensitive data.
• Intrusion detection system (IDS) and 24/7 security monitoring.
• Two-factor authentication (2FA) is available for all member accounts.
• Security penetration testing is conducted periodically by independent experts.
• Automated data backups with tested disaster recovery procedures.

Operational and Organisational Measures

• Access to members' personal data is restricted to staff who require it on a need-to-know basis (principle of least privilege).
• All staff who handle personal data undergo regular data protection training.
• A comprehensive security incident response procedure has been established and tested.
• Internal and external security audits are conducted annually.

The gaya99 platform uses cookies and similar tracking technologies to ensure the platform functions correctly, enhance user experience, and analyse usage patterns in aggregate. Below are the categories of cookies we use:

You can manage your cookie settings through your browser at any time. Please note that disabling certain cookies may affect the functionality of some sections of the gaya99 platform.

Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have certain rights regarding your personal data held by gaya99. We are committed to making it easy for you to exercise these rights in a straightforward and barrier-free manner.

The gaya99 platform is intended exclusively for individuals aged 18 and above. We do not knowingly collect, store, or process personal data from individuals under the age of 18.

If we discover that we have inadvertently collected personal data from a minor, we will immediately take the following steps:

• Promptly deleting all related data from our systems.
• Closing any account registered by a minor without delay.
• Reporting the incident to the relevant authorities if required.

Parents or guardians who believe their child has registered an account at gaya99 are advised to contact our support team immediately via Live Chat or email for prompt action.

In operating a global platform, your personal data may be processed or stored on servers located outside Malaysia. gaya99 ensures that any cross-border data transfers are carried out with adequate safeguards and in compliance with Malaysia's PDPA requirements.

The safeguards we apply to cross-border data transfers include:

• Use of approved Standard Contractual Clauses (SCC) for data transfers to countries without an equivalent level of data protection.
• A Transfer Impact Assessment is conducted before any new data transfer is approved.
• All third-party servers storing Malaysian member data must comply with ISO 27001 security standards or equivalent.

Gaya99 adheres to the principle of data minimisation — we retain your personal data only for as long as necessary for the stated purposes or to fulfil our legal obligations. The key retention schedule is as follows:

Upon expiry of the applicable retention period, your personal data will be securely deleted or permanently anonymised using industry-standard methods, ensuring it cannot be recovered or re-linked to you.

Gaya99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or platform improvements. We are committed to informing you of any significant changes.

• The "Updated" date at the top of this page will always reflect the currently active version of the Privacy Policy.
• For significant amendments, we will send a notification to your registered email address at least 14 days before the changes take effect.
• Your continued use of the gaya99 platform after the effective date of any amendment is considered acceptance of the new terms.
• If you disagree with any amendments made, you have the right to close your account and discontinue use of the platform before the changes take effect.

If you have any questions, concerns, or wish to exercise your rights regarding personal data, the gaya99 Data Protection Officer (DPO) team is ready to assist you.

• Live Chat — available 24 hours a day, 7 days a week via the chat icon at the bottom corner of the gaya99 platform.
• DPO Email — [email protected] with the subject "Data Privacy Request" for faster processing.
• Help Centre — visit our FAQ for a complete guide on account management and privacy.