Privacy Policy

1. Who We Are

rm99a ("we", "us", "our") is the operator of the online gaming platform accessible at https://rm99a.app. rm99a holds a licence issued by an international gaming authority permitting it to offer online sports betting, casino, slots, lottery, and live game products to eligible Members. As the operator, rm99a is the data controller responsible for personal data collected through the Platform.

This Privacy Policy applies to all personal data collected from individuals who visit, register on, or otherwise interact with the rm99a website and its associated gaming products. By creating an rm99a account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

2. Personal Data We Collect

rm99a collects personal data in the following categories:

2.1 Registration Data — Information you provide when creating an rm99a account, including: full legal name, date of birth, residential address, email address, and phone number. This information is required to verify your identity, confirm your eligibility (21+ age restriction), and set up your MYR Wallet.

2.2 Verification Documents — Copies of government-issued identity documents (e.g., MyKad, passport), proof of address documents, and where applicable, source of funds documentation. These are collected as part of rm99a's Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations under its gaming licence conditions.

2.3 Financial Data — Information related to deposits, withdrawals, and payment methods used on the Platform, including e-wallet identifiers (Touch 'n Go, Boost, GrabPay), FPX bank account identifiers, and USDT wallet addresses where applicable. rm99a does not store full payment card numbers.

2.4 Transaction & Gaming Activity Data — Records of all bets placed, games played, outcomes, bonus use, and Wallet transaction history. This data is retained for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.

2.5 Device & Technical Data — Information automatically collected when you access the Platform, including IP address, browser type and version, device type and operating system, screen resolution, referring URL, session duration, and pages visited. This data is used for security, fraud prevention, and platform analytics.

2.6 Communications Data — Records of your interactions with rm99a's customer support team, including live chat transcripts and support ticket history. These records are retained for quality assurance and dispute resolution.

3. How We Use Your Personal Data

rm99a uses the personal data it collects for the following purposes:

• Account creation and management: To register your rm99a account, verify your identity, process your MYR Wallet, and manage your account settings.
• Service delivery: To provide access to the rm99a Sportsbook, Casino, Slots, Live Game, and Lottery products, and to process your bets, winnings, and withdrawals.
• Regulatory compliance: To fulfil rm99a's obligations under its gaming licence, including age verification (21+), KYC, AML screening, and reporting requirements.
• Fraud prevention and security: To monitor for suspicious login attempts, unusual betting patterns, duplicate accounts, and payment fraud. This includes automated risk-scoring of account activity.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, enforce self-exclusion orders, and apply deposit or session limits requested by Members or mandated by rm99a's responsible gaming policy.
• Customer support: To respond to enquiries, process complaints, and maintain records of support interactions.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to Members who have consented to receive such communications. Members may withdraw this consent at any time.
• Platform improvement: To analyse aggregate usage patterns, identify technical issues, and improve the rm99a user experience.

4. Legal Basis for Processing

rm99a processes personal data on the following legal bases:

Processing Purpose	Legal Basis
Account registration and service delivery	Performance of a contract (the Member Agreement)
KYC, AML, age verification	Legal obligation (gaming licence conditions)
Fraud prevention and security	Legitimate interests of rm99a and its Members
Responsible gaming monitoring	Legal obligation and legitimate interests
Marketing communications	Consent (opt-in); withdrawable at any time
Platform analytics	Legitimate interests (improving the service)
Legal claims and disputes	Legitimate interests; legal obligation

5. Sharing Your Personal Data

5.1 rm99a does not sell, rent, or trade your personal data to third parties for their own commercial purposes. rm99a may share your personal data with the following categories of recipient, strictly for the purposes described in Section 3:

• Payment service providers: E-wallet operators (Touch 'n Go, Boost, GrabPay), FPX banking networks, and cryptocurrency processors, to the extent necessary to process your deposits and withdrawals.
• Game content providers: Licensed game studios and aggregators (such as Pragmatic Play, PG Soft, and Spadegaming) receive limited session tokens to deliver game content. They do not receive your full registration details.
• KYC and identity verification services: Third-party providers engaged to perform automated identity document checks. These providers act as data processors under rm99a's instruction and are bound by confidentiality agreements.
• Fraud prevention and AML screening services: Providers of real-time fraud detection, IP reputation, and sanctions screening tools used to protect the integrity of the Platform.
• Regulatory and law enforcement authorities: rm99a will disclose personal data to its licensing authority, financial intelligence units, or law enforcement agencies where required by law, by regulatory direction, or where rm99a has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or harm to persons.
• Professional advisers: Solicitors, auditors, and insurers engaged by rm99a, where necessary and subject to confidentiality obligations.

5.2 All third parties with whom rm99a shares personal data are required to handle that data in accordance with applicable data protection principles and are prohibited from using it for purposes beyond those for which it was disclosed.

6. Data Retention

6.1 rm99a retains personal data for the following periods, or longer where required by law or regulatory obligation:

• Account registration data: Retained for the duration of the account plus 5 years following account closure, in accordance with AML and gaming licence record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years from the date of verification, as required under international AML standards adopted by rm99a's licensing authority.
• Transaction and betting records: Retained for 5 years from the date of each transaction. Regulatory audits may require access to records beyond this period in exceptional circumstances.
• Customer support communications: Retained for 2 years from the date of the last interaction.
• Device and technical data: Retained for 12 months from collection, unless retained longer for fraud investigation purposes.
• Marketing consent records: Retained until consent is withdrawn, plus 1 year thereafter as evidence of consent.

6.2 When personal data is no longer required for any lawful purpose, rm99a will securely delete or anonymise it in accordance with its data destruction policy.

7. Cookies and Tracking Technologies

7.1 The rm99a Platform uses cookies and similar technologies for the following purposes:

• Essential cookies: Required for session management, login authentication, and security token validation. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to understand aggregate user behaviour, page performance, and navigation patterns. rm99a uses anonymised analytics data only; individual browsing sessions are not profiled.
• Fraud prevention cookies: Used to fingerprint devices and detect anomalous login behaviour. These are essential for the security of your account.
• Preference cookies: Used to remember your language preference and display settings across sessions.

7.2 rm99a does not use third-party advertising cookies or retargeting pixels on the Platform. You will not be served rm99a advertisements on other websites based on your Platform activity.

7.3 You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent login and normal Platform use. Disabling analytics or preference cookies will not affect your ability to use the Platform.

8. Data Security

8.1 rm99a implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and rm99a's servers;
• AES-256 encryption for personal data stored at rest in rm99a's databases;
• Role-based access controls limiting internal access to personal data on a need-to-know basis;
• Regular penetration testing and security audits by independent third-party specialists;
• Multi-factor authentication requirements for all rm99a staff with access to personal data systems;
• Incident response procedures for the detection, containment, and notification of data security incidents.

8.2 Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be completely secure. Members are encouraged to protect their own account security by using a strong, unique password and not sharing their rm99a login credentials.

9. Your Data Rights

Subject to applicable law and any overriding legal obligations, Members have the following rights with respect to their personal data held by rm99a:

• Right of access: You may request a copy of the personal data rm99a holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to rm99a's legal retention obligations.
• Right to restrict processing: You may request that rm99a limit processing of your data in certain circumstances.
• Right to object: You may object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time.
• Right to data portability: You may request a copy of data you have provided to rm99a in a structured, machine-readable format.

To exercise any of these rights, contact rm99a support via live chat or email at: [email protected] (plain text — not a clickable link). rm99a will respond to all valid requests within 30 calendar days. Identity verification will be required before any data subject request is actioned.

10. Children's Privacy

The rm99a Platform is strictly for adults aged 21 and above. rm99a does not knowingly collect personal data from individuals under the age of 21. If rm99a discovers that personal data has been collected from a person under the minimum age, the account will be closed immediately, all data will be deleted (subject to any mandatory regulatory retention obligations), and any funds deposited will be reviewed in accordance with rm99a's minor account procedures. If you believe a minor has registered an rm99a account, please contact support immediately.

11. International Data Transfers

11.1 rm99a may transfer personal data to service providers or infrastructure located outside Malaysia, including in jurisdictions where rm99a's gaming licence is issued and where its technology partners operate. Where such transfers occur, rm99a ensures that appropriate safeguards are in place, including contractual data transfer agreements and data processing agreements that impose equivalent privacy protections to those described in this Policy.

11.2 By using the rm99a Platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside Malaysia. rm99a takes reasonable steps to ensure such transfers are handled responsibly and in accordance with applicable data protection principles.

12. Third-Party Links and Services

The rm99a Platform may reference or link to third-party services, including payment processors and licensed game providers. These third parties operate their own privacy policies, which govern how they process personal data within their own systems. rm99a is not responsible for the privacy practices of third-party services. Members should review the privacy policies of any third-party service they interact with in connection with their rm99a account.

13. Changes to This Privacy Policy

13.1 rm99a may update this Privacy Policy from time to time to reflect changes in its data processing practices, regulatory requirements, or Platform features. Where changes are material, rm99a will notify Members by email or by displaying a prominent notification on the Platform prior to the change taking effect.

13.2 The "Last Updated" date at the top of this Policy indicates when the current version was published. Continued use of the rm99a Platform after any update constitutes acceptance of the revised Policy. Where a Member does not accept the revised Policy, they should cease using the Platform and may request account closure in accordance with the rm99a Terms and Conditions.

14. Contact and Data Protection Enquiries

For all privacy-related enquiries, data subject access requests, or concerns about rm99a's handling of your personal data, please contact the rm99a support team:

Email: [email protected] (plain text — not a clickable link)

Live Chat: Available 24/7 via the rm99a Platform.

rm99a aims to acknowledge all privacy enquiries within 3 business days and to resolve substantive requests within 30 calendar days. Where a request requires additional time due to its complexity, rm99a will notify you within the initial 30-day period and provide an estimated resolution date.

This Privacy Policy was last reviewed and updated on 1 June 2026.