Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how Kaya99 ("Kaya99", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the website located at https://kaya99.cam and all associated services (collectively, the "Platform").

Kaya99 is committed to handling your personal data with care, transparency, and in compliance with applicable data protection legislation. This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Kaya99 Platform. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately and may request closure of your account in accordance with the account closure provisions in our Terms & Conditions.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

Data We Collect

Kaya99 collects personal data through several channels in the course of operating the Platform and providing Services to Players. The categories of data we collect are detailed in the table below.

3.1 Data You Provide Directly

The majority of personal data we hold is provided directly by you during the account registration process, KYC verification, payment transactions, or when you contact our customer support team. You are responsible for ensuring that all information provided to Kaya99 is accurate, complete, and current.

3.2 Data Collected Automatically

When you access the Platform, certain technical and usage data is collected automatically through server logs, cookies, and similar technologies. This data is used for security monitoring, fraud detection, platform performance optimisation, and improving the overall player experience. For further details on how cookies are used, please refer to Section 7 of this Policy.

How We Use Your Data

Kaya99 processes personal data for specific, explicit, and legitimate purposes. We do not process personal data in a manner incompatible with these stated purposes. The primary purposes for which we use your personal data are as follows:

• Account Administration: To create, manage, and maintain your Kaya99 account, including verifying your identity, processing login sessions, and maintaining account records.
• Service Delivery: To provide you with access to all Platform services — including live casino games, sports betting, slot games, and associated features — and to process your gameplay and betting activity.
• Payment Processing: To process deposits and withdrawals in MYR via your selected payment method (including Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and other supported channels), and to maintain financial transaction records as required by our licensing obligations.
• KYC Compliance: To verify your identity and address in accordance with anti-money laundering (AML) regulations and our licensing requirements, and to satisfy any reporting obligations arising from those regulations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and other security threats to the Platform and its players.
• Customer Support: To respond to your enquiries, resolve complaints, process disputes, and provide assistance through our support channels.
• Responsible Gambling: To administer your responsible gambling settings — including deposit limits, session limits, reality checks, and self-exclusion requests — and to monitor for signs of problematic gambling behaviour in accordance with our responsible gambling obligations.
• Marketing Communications: Where you have provided explicit consent, to send you promotional communications regarding bonuses, new games, sports betting markets, and other Platform features. You may withdraw this consent at any time.
• Legal Compliance: To comply with applicable laws, regulations, licensing requirements, court orders, and lawful requests from regulatory or law enforcement authorities.
• Platform Improvement: To analyse usage patterns, conduct A/B testing, and improve the functionality, design, and overall quality of the Kaya99 Platform.

Legal Basis for Processing

Kaya99 processes your personal data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing required to enter into and perform the contract between you and Kaya99 as described in our Terms & Conditions — including account creation, service delivery, and payment processing.
• Legal Obligation: Processing necessary to comply with legal obligations imposed on Kaya99, including KYC identity verification, AML reporting, responsible gambling requirements, and licensing conditions.
• Legitimate Interests: Processing carried out on the basis of Kaya99's legitimate business interests — including fraud prevention, platform security, and service improvement — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

Data Sharing & Disclosure

Kaya99 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may, however, share your personal data with carefully selected third parties in the following circumstances:

6.1 Service Providers and Data Processors

Kaya99 engages third-party service providers who process personal data on our behalf — including payment processors (handling MYR transactions via DuitNow, FPX, and eWallet providers), identity verification services, cloud hosting providers, fraud detection systems, and customer communication platforms. All such providers are bound by data processing agreements that restrict their use of your data to the specific services they provide to Kaya99.

6.2 Regulatory and Law Enforcement Authorities

Kaya99 may disclose personal data to regulatory bodies, gaming authorities, financial intelligence units, or law enforcement agencies where required by applicable law or our licensing obligations — including in connection with AML/CFT reporting, the investigation of suspected criminal activity, or compliance with a court order or lawful demand.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Kaya99's assets, personal data held by Kaya99 may be transferred to the acquiring entity, subject to the same level of data protection as described in this Policy. Players will be notified of any such transfer.

6.4 Consent-Based Sharing

With your explicit consent, Kaya99 may share your data with third parties for purposes other than those described above. You may withdraw such consent at any time by contacting our support team.

Cookies & Tracking Technologies

The Kaya99 Platform uses cookies and similar tracking technologies to enhance your user experience, maintain session state, and gather analytics data. By continuing to use the Platform after being presented with our cookie notice, you consent to our use of cookies as described in this section.

7.1 Types of Cookies We Use

7.2 Managing Cookies

You may manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from accessing certain features, including logging into your account. Detailed instructions for managing cookies are available in the help documentation for all major browsers including Chrome, Firefox, Safari, and Microsoft Edge.

Data Retention

Kaya99 retains personal data only for as long as is necessary to fulfil the purposes outlined in this Policy, or as required by applicable law and our licensing obligations. Specific retention periods are as follows:

• Account Data: Retained for the duration of your active account relationship with Kaya99, and for a minimum of five (5) years following account closure — as required by AML regulations and our gaming licence obligations.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, in compliance with applicable financial record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of the last transaction or account closure, whichever is later.
• Customer Support Correspondence: Retained for a period of three (3) years from the date of the most recent interaction, unless the correspondence relates to an ongoing dispute, investigation, or legal proceeding.
• Marketing Consent Records: Retained for as long as your consent remains active, and for a period of three (3) years following consent withdrawal, as evidence of your prior consent decision.
• Technical and Usage Data: Generally retained for up to twenty-four (24) months, after which it is anonymised or deleted, unless required for an ongoing security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Kaya99's data destruction procedures.

Your Rights

As a data subject, you have a number of rights in relation to your personal data held by Kaya99. These rights are set out below. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered account username.

Data Security

Kaya99 implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser and the Kaya99 Platform is encrypted using Transport Layer Security (TLS 1.3) with 256-bit SSL certificates.
• Encryption at Rest: Personal data stored in Kaya99's databases, including KYC documents and financial information, is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal access is controlled through role-based permissions and multi-factor authentication requirements for all administrative systems.
• Security Monitoring: Kaya99 operates continuous security monitoring systems to detect and respond to anomalous activity, potential intrusions, and data breach indicators.
• Regular Security Audits: The Platform and its underlying infrastructure undergo regular independent security assessments, penetration testing, and vulnerability scans.
• Employee Training: All Kaya99 personnel with access to personal data receive regular training on data protection obligations and security best practices.

While Kaya99 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Kaya99 will notify you without undue delay in accordance with applicable notification requirements.

Third-Party Services

The Kaya99 Platform integrates with third-party service providers to deliver certain Platform functions, including payment processing, identity verification, fraud detection, and analytics services. These integrations involve the transfer of specified personal data to the relevant provider solely for the purpose of delivering the contracted service.

All third-party processors engaged by Kaya99 are subject to due diligence assessments prior to engagement and are required to enter into data processing agreements that bind them to processing personal data only on Kaya99's documented instructions, for no other purpose, and with security standards no less rigorous than those described in this Policy.

Kaya99 does not embed third-party social media plugins, advertising trackers, or cross-site tracking technologies on the Platform that would result in your personal data being shared with social media networks or advertising platforms without your explicit consent.

Minors & Age Verification

The Kaya99 Platform is strictly intended for individuals aged 21 years and above. Kaya99 does not knowingly collect personal data from individuals under the age of 21. Age verification is enforced at the point of account registration and as part of the KYC process.

If Kaya99 becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately, the associated account will be closed, and any deposited funds will be returned to the originating payment method. If you have reason to believe that an individual under 21 has registered an account on the Kaya99 Platform, please notify us immediately at [email protected].

Parents and guardians are encouraged to use available parental control tools and internet filtering software to prevent minors from accessing online gambling platforms.

International Data Transfers

In the course of operating the Platform and engaging third-party service providers, personal data may be transferred to and processed in countries outside Malaysia. Such transfers may be necessary for payment processing, cloud hosting, fraud detection, or identity verification services.

Where personal data is transferred internationally, Kaya99 ensures that appropriate safeguards are in place — including contractual protections with the receiving party that require them to maintain data security standards equivalent to those applied by Kaya99. All transfers are conducted in accordance with applicable data protection requirements.

By using the Kaya99 Platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia where necessary for the delivery of our Services, subject to the safeguards described in this section.

Changes to This Policy

Kaya99 reserves the right to update, amend, or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will be revised to reflect the date of any material change.

Where any amendment materially affects how we collect or use your personal data, Kaya99 will notify you by email to the address registered on your account and/or via a prominent notice on the Platform, at least fourteen (14) days prior to the change taking effect. Your continued use of the Platform following the effective date of an amendment constitutes your acceptance of the revised Policy.

If you do not accept a material change to this Policy, you may request closure of your account and withdrawal of your remaining funds in accordance with the procedures set out in our Terms & Conditions.

Contact & Data Rights Requests

If you have any questions, concerns, or complaints regarding this Privacy Policy or Kaya99's handling of your personal data, or if you wish to exercise any of your data rights as described in Section 9, please contact us using the details below.

• Data Protection Enquiries: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" to ensure your message is directed to the appropriate team.
• Live Chat: Available 24/7 via the chat widget on the Kaya99 Platform for immediate assistance with general privacy queries.
• Response Time: All data rights requests and formal privacy complaints will receive a written acknowledgement within five (5) business days and a substantive response within thirty (30) calendar days of receipt.

When submitting a data rights request, please include your registered Kaya99 account username and a clear description of your request. For identity verification purposes, we may ask you to confirm certain details before processing your request.