Privacy Policy – pop99

1. Introduction

1.1 This Privacy Policy ("Policy") is issued by pop99 ("pop99", "we", "us", "our") and applies to all personal data collected through the pop99 platform at pop99.co, including the website, games, payment services, customer support interactions, and any related communications.

1.2 pop99 acts as the data controller in respect of personal data collected directly from players. Where pop99 engages third-party service providers to process data on its behalf, those providers act as data processors under binding contractual data processing agreements.

1.3 By registering an Account with pop99 or continuing to use the Platform, you acknowledge that you have read and understood this Policy. If you do not agree to the terms of this Policy, you must cease using the pop99 Platform and contact pop99 support to close your Account.

1.4 This Policy should be read together with pop99's Terms & Conditions, which govern the overall relationship between pop99 and its players.

2. Personal Data We Collect

2.1 Registration & Account Data

When you create a pop99 Account, we collect the personal information you provide directly, including:

• Full legal name (as it appears on your government-issued identification)
• Date of birth (to verify you meet the 21+ age requirement)
• Email address and contact telephone number
• Residential address (including postcode and state within Malaysia)
• Username and encrypted password

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and responsible gaming obligations, pop99 may collect:

• Copies of government-issued photo identification (MyKad, passport)
• Proof of address documentation (utility bills, bank statements not older than 3 months)
• Source of funds documentation where required by thresholds or risk assessment
• Facial verification imagery where enhanced KYC is required

2.3 Financial Transaction Data

pop99 records all financial transactions associated with your Account, including deposit amounts, withdrawal requests, payment method identifiers (e-wallet IDs, bank account numbers masked per PCI-DSS standards), and transaction timestamps.

2.4 Gaming & Betting Activity Data

pop99 retains records of your gaming and betting history, including game sessions, bet amounts, outcomes, and responsible gaming tool usage (deposit limits set, session durations, self-exclusion activations).

2.5 Technical & Device Data

When you access pop99, our servers automatically collect technical information including your IP address, device type, operating system, browser type and version, referring URL, pages visited, and session duration. This data is used for security monitoring, fraud prevention, and platform performance analytics.

2.6 Communications Data

pop99 retains records of your communications with our support team via live chat and email, including the content of those communications, timestamps, and resolution notes.

3. How We Use Your Personal Data

pop99 uses the personal data we collect for the following purposes:

• Account creation and management: To set up, maintain, and administer your pop99 Account.
• Identity verification: To verify your identity and age as required by our KYC obligations and responsible gaming commitments.
• Payment processing: To process deposits and withdrawals in MYR via your chosen payment method.
• Service delivery: To provide access to games, sportsbook, promotions, and all other pop99 Platform features.
• Customer support: To respond to your enquiries, complaints, and account-related requests.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and other prohibited conduct.
• Legal and regulatory compliance: To meet pop99's obligations under applicable gaming, AML, and data protection regulations.
• Responsible gaming: To monitor gaming patterns, implement player-requested restrictions, and intervene where problem gambling indicators are identified.
• Platform improvement: To analyse aggregate usage data and improve the Platform's performance, features, and user experience.
• Communications: To send account notifications, transaction confirmations, security alerts, and (where you have opted in) promotional communications.

4. Legal Basis for Processing

4.1 Contractual necessity: The majority of pop99's data processing is necessary to perform the contract with you — i.e., to operate your Account and deliver the Platform services you have registered for.

4.2 Legal obligation: pop99 is legally required to collect and retain certain data for AML compliance, KYC verification, responsible gaming reporting, and regulatory audits.

4.3 Legitimate interests: pop99 processes technical and device data based on its legitimate interests in maintaining platform security, preventing fraud, and improving the service — provided these interests do not override your fundamental data protection rights.

4.4 Consent: Where pop99 sends marketing communications by email or in-platform notifications, this is based on your explicit opt-in consent at registration or in Account Settings. You may withdraw this consent at any time.

5. Data Sharing & Third Parties

5.1 pop99 does not sell, rent, or trade personal data to any third party for commercial or marketing purposes.

5.2 pop99 shares personal data with third parties only in the following circumstances:

• Payment processors: Touch 'n Go eWallet, Boost, DuitNow, GrabPay, FPX banking networks, and USDT processing partners receive transaction data as necessary to execute deposits and withdrawals.
• KYC and AML service providers: Identity verification and anti-money laundering screening are conducted with the assistance of specialist third-party providers who process your identification documents under contractual data processing agreements.
• Game software providers: Game providers may receive a Player ID and session data necessary to operate their games hosted on the pop99 Platform. Game providers do not receive your full personal profile or financial data.
• Regulatory and law enforcement authorities: pop99 may disclose data to relevant authorities where required by applicable law, court order, or regulatory direction.
• Corporate transactions: In the event of a merger, acquisition, or sale of pop99's business assets, player data may be transferred to the acquiring entity, subject to equivalent privacy protections.

6. Data Retention

6.1 pop99 retains personal data for as long as your Account remains active and for a minimum period of five (5) years following Account closure, in accordance with applicable AML and gaming regulatory record-keeping requirements.

6.2 Financial transaction records are retained for a minimum of seven (7) years to comply with financial reporting and AML obligations.

6.3 Following the expiry of mandatory retention periods, personal data is securely deleted or anonymised. Anonymised aggregate data (with all personal identifiers removed) may be retained indefinitely for statistical and platform improvement purposes.

6.4 Where you have requested Account closure and completed the mandatory retention period, you may submit a formal data deletion request to pop99 support. Such requests will be reviewed against applicable legal retention requirements before processing.

7. Data Security

7.1 pop99 implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and pop99 servers
• Salted cryptographic hashing of all Account passwords
• Role-based access controls restricting staff access to personal data on a need-to-know basis
• Regular security audits and penetration testing of Platform infrastructure
• Intrusion detection systems and real-time monitoring for anomalous access patterns
• Physical security controls for data centre facilities

7.2 In the event of a personal data breach that poses a risk to affected players, pop99 will notify the affected individuals without undue delay and take all reasonable steps to contain and remediate the breach.

8. Cookies & Tracking Technologies

8.1 pop99 uses cookies and similar technologies to deliver and maintain Platform functionality. The types of cookies deployed by pop99 are:

• Essential cookies: Required for the Platform to function, including session management, login authentication, and security tokens. These cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: Aggregate, anonymised data on page usage, navigation paths, and session durations used to improve the Platform. These do not identify individual users.
• Preference cookies: Cookies that remember your Platform preferences (language settings, odds display format, etc.) to improve your experience on return visits.

8.2 pop99 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies.

8.3 Most browsers allow you to control cookie preferences through browser settings. Disabling essential cookies will affect your ability to log in and use the Platform.

9. Your Data Rights

As a pop99 player, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data pop99 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. For data that can be updated directly, this can be done via Account Settings.
• Right to erasure: You may request deletion of your personal data, subject to pop99's legal retention obligations. Where deletion cannot be fulfilled in full due to regulatory requirements, pop99 will explain the specific retention grounds.
• Right to restriction: You may request that pop99 restricts processing of your personal data in specified circumstances, such as where accuracy is contested.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests. You may also withdraw consent for marketing communications at any time via Account Settings or by contacting pop99 support.

To exercise any of these rights, contact pop99 at [email protected]. pop99 will respond to verified requests within 30 days.

10. Children and Minors

10.1 The pop99 Platform is strictly intended for individuals aged 21 years and above. pop99 does not knowingly collect personal data from individuals below this age threshold.

10.2 If pop99 discovers or is notified that personal data has been collected from an individual below the minimum age, the associated Account will be closed immediately, all transactions will be voided, and the relevant personal data will be securely deleted.

10.3 If you believe a minor has registered with pop99, please contact us immediately at [email protected].

11. International Data Transfers

11.1 pop99's primary data storage and processing infrastructure is located within the applicable licensing jurisdiction. Where personal data is transferred to third-party service providers operating in other jurisdictions — for example, KYC verification providers or cloud infrastructure partners — pop99 ensures that appropriate contractual safeguards are in place.

11.2 Such safeguards may include standard contractual clauses, binding corporate rules, or reliance on adequacy decisions covering the recipient jurisdiction. pop99 will not transfer personal data to a jurisdiction that does not provide an adequate level of data protection without implementing appropriate transfer mechanisms.

12. Changes to This Privacy Policy

12.1 pop99 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or Platform practices. Material changes will be communicated to registered players via email notification and/or an in-Platform announcement at least seven (7) days before the revised Policy takes effect.

12.2 Continued use of the pop99 Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to any revision, please contact pop99 support to close your Account prior to the effective date.

13. Contact Us

For any queries, requests, or complaints regarding this Privacy Policy or pop99's handling of your personal data, please contact the pop99 Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 via the pop99 Platform

pop99 targets acknowledgement of privacy-related requests within 48 hours and full responses within 30 calendar days of the request being received and verified.