Privacy Policy 99kopitiam –
Your Data, Your Rights, Your Control

99kopitiam takes the privacy and personal data protection of every member extremely seriously. We understand that the information you share with us is valuable and sensitive, and we have a significant responsibility to ensure it is managed in a manner that is transparent, secure and fully respectful of your rights.

This Privacy Policy applies to all information collected through the 99kopitiam official website at https://99kopitiam.click, the official 99kopitiam mobile app for Android and iOS, and all official communication channels operated by the 99kopitiam team, including live chat, email, and WhatsApp.

This policy is written entirely in Bahasa Melayu because we believe every Malaysian member deserves a clear understanding of how their data is managed – not through confusing documents in a foreign language. We encourage you to read this document carefully and to contact us if anything is unclear.

99kopitiam collects several categories of personal data that are necessary to operate the platform and provide services to you. Below is a summary of the types of data we collect, the purposes for which it is collected, and the legal basis that permits such collection:

We do not collect sensitive data categories such as medical information, biometric data, political views or religious beliefs unless directly relevant to the provision of our services and you have given your explicit consent for such collection.

99kopitiam uses the personal data collected for the following legitimate and necessary purposes. We do not use your data for any purpose beyond what is stated here without first obtaining your additional consent:

• Account management and identity verification – verifying that each account belongs to a legitimate individual who meets the age requirement and is not in breach of the 99kopitiam platform's terms of use.
• Processing deposits and withdrawals — enables smooth and secure financial transactions via Malaysian payment methods such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
• Service provision and improvement – using anonymised gameplay activity data to understand usage patterns and make better product decisions for all members.
• Platform security and fraud prevention – detecting and preventing unauthorised access, fraud attempts, money laundering and other illegal activities that could harm other members or compromise the integrity of the platform.
• Legal compliance – fulfilling legal obligations applicable to the platform's operations, including record-keeping and reporting requirements prescribed by relevant Malaysian law.
• Service communications – sending you important notifications relating to your account, transactions, policy updates and relevant security information.
• Responsible gambling support – monitoring gaming activity patterns to identify potential warning signs of problem gambling and offering appropriate support where needed, in line with 99kopitiam's commitment to member wellbeing.
• Marketing communications – sending information about 99kopitiam's latest promotions, bonuses and offers to members who have given their consent to receive such communications. You may withdraw this consent at any time.

99kopitiam does not sell, rent or trade members' personal data to any third party for marketing or commercial purposes. However, there are limited situations in which we may need to share certain information with other parties in order to operate the platform effectively:

• Payment processors – transaction information that must be shared with payment service providers such as Touch 'n Go gateway, DuitNow and FPX in order to process your deposits and withdrawals. Such sharing is kept to a minimum and covers only the data necessary for the transaction in question.
• Gaming service providers — the minimum technical data required by third-party game providers to operate the live dealer games and slots accessible through the 99kopitiam platform. These providers are bound by strict confidentiality agreements.
• Legal authorities – information that is required by law or a valid court order to be shared with law enforcement agencies, regulatory bodies or courts of competent jurisdiction.
• Technical service providers – cloud computing, server hosting and cybersecurity service providers that assist in operating 99kopitiam's technical infrastructure, subject to data processing agreements compliant with the PDPA.

All third parties that receive data from 99kopitiam are required to handle that data with the same high standards of security and confidentiality that we apply ourselves, and only for the purposes we have specifically authorised.

99kopitiam uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit the 99kopitiam website. The following are the types of cookies we use:

• Essential Cookies (Required) — required for core platform functions such as maintaining your login session, account security, and language preferences. Without these cookies, the platform cannot function properly and they cannot be disabled.
• Analytics Cookies – collecting anonymised information about how visitors use the 99kopitiam platform, such as the most frequently visited pages and time spent in each section. This data helps us improve the platform's design and performance.
• Functional Cookies – remembering your preferences and settings such as preferred bet limits, favourite game types and display settings, so you do not have to reconfigure them each time you log in.
• Security Cookies – helping to detect suspicious activity, unauthorised login attempts and other cyber threats in order to protect your account and the platform as a whole.

You can manage and delete cookies through your browser settings at any time. Please note, however, that disabling essential cookies may affect the functionality of the 99kopitiam platform. For more information on managing cookies across different browsers, please refer to the help documentation for your browser.

99kopitiam implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and 99kopitiam's servers.
• Encryption of sensitive data at rest, including passwords stored as non-reversible hashes.
• Strict access controls – only 99kopitiam staff who require access to specific data in order to perform their authorised duties are permitted to do so, with access records audited on a regular basis.
• Regular security scans and penetration testing conducted by independent cybersecurity experts.
• An intrusion detection system (IDS) and intrusion prevention system (IPS) operating 24/7 to detect and block cyber threats in real time.
• Well-documented incident response procedures to ensure any security breach is handled swiftly and effectively.

Your personal data is retained for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. As a general rule, active account records are kept for the duration of membership and for the period prescribed by Malaysian law following account closure. Data that is no longer required is securely deleted or anonymised in accordance with 99kopitiam's internal procedures.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have several rights regarding your personal data held by 99kopitiam. Below are those rights and how to exercise them:

• Right of Access – you have the right to request a copy of the personal data we hold about you and information on how it is used. We will process this request within 14 business days.
• Right to Rectification – if the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. We will update our records within 7 business days of receiving a verified request.
• Right to Erasure – you may request the deletion of your personal data in certain circumstances, such as when the data is no longer needed for the purpose it was originally collected, or when you withdraw your consent. Deletion requests are subject to legal record-keeping obligations that may prevent immediate deletion in some cases.
• Right to Object to Processing – you may object to the processing of your personal data for direct marketing purposes at any time, and we are required to cease such processing upon receipt of your objection.
• Right to Withdraw Consent – where our processing of your data is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the validity of any processing carried out prior to that point.
• Right to Complain – if you believe that 99kopitiam has violated your privacy rights, you have the right to submit a complaint to our privacy team at support@99kopitiam.click. We are committed to investigating and responding to all complaints within 21 business days.

To exercise any of the rights above, please contact us by email at support@99kopitiam.click, stating the right you wish to exercise and providing the information needed to verify your identity. We may request additional identity verification before processing your request in order to protect the security of your data.

The 99kopitiam platform is restricted to individuals aged 21 and above and is not intended for minors. 99kopitiam does not knowingly collect personal data from children.

If you believe we may have inadvertently collected personal data from someone under the age of 21, please contact us immediately at support@99kopitiam.click. We will investigate the matter and take prompt action to delete the relevant data and close any account that does not meet our age requirements, in line with our commitment to child protection.

The 99kopitiam platform contains only internal links to pages within the 99kopitiam.click domain. We do not include links to third-party websites within our platform content.

This Privacy Policy applies solely to the 99kopitiam platform and does not cover the privacy practices of any third parties that may have an operational relationship with us, such as payment service providers. We encourage you to read the privacy policies of your payment service providers – such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or your Malaysian bank – separately, to understand how they handle your data during transaction processing.

99kopitiam reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, legal developments, or new operational requirements. When significant changes are made, we will:

• Updating the "Last updated" date displayed at the top of this page.
• Displaying a clear in-platform notification the first time you log in after the changes take effect.
• Sending an email to all active members outlining the key changes made, where those changes materially affect how we use your personal data.
• For changes that require your fresh consent, we will request that consent explicitly before the changes take effect on your data.

We recommend reviewing this page at least once every three months to ensure you are always up to date with the latest privacy policy governing your use of the 99kopitiam platform.

For any enquiries, concerns or requests relating to the privacy and protection of your personal data on the 99kopitiam platform, please contact our Privacy Officer through the following channels:

• Email: support@99kopitiam.click — please include "PRIVACY" in the subject line of your email to ensure it is routed directly to the appropriate officer.
• Live Chat: Available 24/7 within the 99kopitiam platform – ideal for straightforward privacy enquiries that require an immediate response.
• WhatsApp: The number is available in the "Contact Us" section once you have logged in to your account.

The 99kopitiam team operates 24 hours a day, 7 days a week. All communications are handled in Bahasa Melayu. We are committed to responding to all privacy-related enquiries within 3 business days and to resolving more complex issues within 21 business days.