Mega999 Privacy Policy – User Data Protection for Malaysian Players

This Privacy Policy is published by mega999 and applies to all users who register, browse, or use the mega999 platform via mega999.site or any related applications. This document clearly sets out your rights as a data subject and mega999's responsibilities as a data controller under Malaysia's Personal Data Protection Act (PDPA) 2010.

When you register a mega999 account, make a deposit via Touch 'n Go eWallet or DuitNow, play slots or Live Casino, or simply browse our website, certain information is collected by our systems. This privacy policy explains in detail what that information is, how it is used, who can access it, and how long it is retained.

Mega999 operates as a responsible data controller. This means we determine the purposes and means of processing our users' personal data, and we are fully accountable for ensuring that processing is lawful, fair, and transparent in accordance with Malaysia's PDPA principles.

Mega999 collects only the data genuinely required to operate the platform safely and efficiently. Below are the categories of data we collect from our Malaysian users:

Identity & Account Data

• Full name as stated on your MyKad or Malaysian passport.
• An active Malaysian mobile number for OTP verification and communications.
• The username and password you chose at registration (passwords are stored in a non-readable hashed format).
• Your email address (if provided at registration or updated afterwards).
• Date of birth for minimum age verification of 18 years.
• MyKad or passport information for identity verification (KYC) purposes when required.

Financial & Payment Data

• Details of the payment method used — Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, Maybank2u, CIMB Clicks, or FPX — including the associated account name and phone number.
• Deposit and withdrawal transaction history, including amounts in Malaysian Ringgit (RM), dates, times, and transaction status.
• Account balance and fund movements within the mega999 platform.

Gaming Activity Data

• Gaming history including game types played (slots, Live Casino, Sports Betting, virtual sports, Table Games, roulette, and others), wager amounts, and outcomes.
• Gaming session times and durations.
• Claimed bonuses and promotions, along with their associated rollover status.
• The deposit limits, loss limits, and time limits you have activated on your account.

Technical & Device Data

• The IP address of the device used to access the mega999 platform.
• Browser type, operating system, and device model.
• Access log data including pages visited, time of visit, and actions taken within the platform.
• Cookie data and session identifiers to maintain your login session.

All personal data collected by mega999 used only for legitimate and necessary purposes. We do not use your data for any purpose beyond what is stated below:

• Account Management & Verification: To verify your identity, create and manage your mega999 account, process deposits and withdrawals, and resolve any technical or financial issues related to your account.
• Gaming Services Provision: To give you access to the full mega999 games catalogue — slots, Live Casino, Sports Betting, virtual sports, table games, and roulette — and to ensure a smooth, fair gaming experience.
• Bonus & Promotion Processing: To determine bonus eligibility, calculate daily cashback, manage the VIP programme, and process promotions you qualify for based on your playing activity.
• Fraud Prevention & Security: To detect and prevent suspicious activity, duplicate accounts, money laundering, and any form of platform abuse on mega999.
• Regulatory Compliance: To meet Malaysian legal requirements, including the PDPA, anti-money laundering (AML) procedures, and Know Your Customer (KYC) identity verification requirements.
• Platform Improvements: To analyse aggregate usage patterns (without identifying individuals) for the purpose of improving user experience, introducing new games, and optimising platform performance.
• Service Communications: To send important account-related notifications — such as deposit confirmations, withdrawal notices, security alerts, and material updates to our terms — via SMS to your Malaysian phone number or within the platform.
• Marketing Communications (With Consent): To send you information about mega999's latest promotions, bonuses, and offers, where you have given consent to receive marketing communications. You may withdraw this consent at any time through the notification settings in your account.

Mega999 does not use your personal data to make automated decisions that could have a material impact on you without human review. Any account blocks or suspensions triggered by our automated systems will be reviewed by our human security team before any permanent action is taken.

Mega999 does not sell, rent, or trade users' personal data to any third party for marketing or commercial purposes. This is a non-negotiable policy and forms the foundation of the trust we build with every Malaysian player.

However, there are limited situations where mega999 needs to share users' personal data with certain parties for legitimate operational purposes:

• Licensed Payment Processors: Data required to process your deposit and withdrawal transactions — such as your phone number and name for verification — is shared with licensed payment processors including Touch 'n Go eWallet, DuitNow, and FPX service providers. All processors are bound by strict confidentiality agreements and comply with industry payment security standards.
• Game Software Providers: Game session data required to run games from providers such as Evolution, Pragmatic Play, and PG Soft is shared with those providers within a secure and controlled environment. These providers are bound by data protection agreements that comply with international standards.
• Malaysian Authorities: Mega999 will disclose personal data to Malaysian government or law enforcement authorities when required to do so by law, court order, or a valid official investigation. In all such cases, we will disclose only the minimum data necessary to fulfil the relevant requirement.
• Technical Service Providers: Technical infrastructure providers, such as the server hosting services used by mega999, may have limited access to user data as part of their technical operations. All such providers are bound by data processing agreements that comply with PDPA.

Mega999 takes user data security seriously. The following technical and organisational measures are in place to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or app and the mega999 servers is encrypted using 256-bit SSL/TLS encryption — the same standard used by Malaysia's major banking institutions such as Maybank and CIMB.
• Data-at-Rest Encryption: Sensitive data stored in mega999's databases — including financial information, KYC details, and passwords — is encrypted at rest using strong encryption algorithms. Passwords are stored as one-way hashes that cannot be reversed.
• Strict Access Controls: Access to user data within mega999's internal systems is restricted on a need-to-know basis. Only staff who require access to carry out their operational duties are permitted to access the relevant data categories, and all access is logged for audit purposes.
• Two-Factor Authentication (2FA): All internal mega999 staff accounts with access to user data are required to use two-factor authentication. mega999 platform users are also encouraged to enable 2FA through their account security settings.
• Periodic Security Imaging: mega999's systems undergo regular security testing (penetration testing) and security audits by certified independent third parties to identify and address vulnerabilities before they can be exploited.
• 24/7 Threat Monitoring: mega999's security monitoring system operates 24 hours a day to detect suspicious activity, intrusion attempts, and anomalies in data access patterns. Any detected security incidents are responded to promptly.
• Incident Response Plan: Mega999 has a documented data security incident response procedure in place. In the event of a material data breach, affected users will be notified within the timeframe stipulated by Malaysia's PDPA.

While mega999 takes every reasonable measure to protect your personal data, no system can be guaranteed 100% secure against all cyber threats. You also play an important role in keeping your account safe — protect your password, do not share your login credentials, and report any suspicious activity to the mega999 support team immediately.

Platform mega999 uses cookies and similar tracking technologies to deliver a better user experience and to keep essential platform functions running properly. The types of cookies used are as follows:

• Session Cookies: Temporary cookies used to maintain your login session while you are using the mega999 platform. These cookies are automatically deleted when you close your browser.
• Preference Cookies: Cookies that store your settings and preferences — such as display language and interface preferences — so you don't have to reconfigure them each time you log in to mega999.
• Security Cookies: Cookies used to verify that account activity is legitimate and to detect suspicious login attempts from unrecognised devices or locations.
• Analytics Cookies: Cookies that collect aggregated usage data (without identifying individuals) to help mega999 understand how users interact with the platform, which pages are visited most frequently, and where users encounter difficulties.

You can manage or delete cookies through your browser settings. However, blocking session and security cookies may affect the functionality of the mega999 platform — including your ability to log in and play. mega999 recommends that you do not block cookies that are required for core platform functionality.

Mega999 retains users' personal data only for as long as necessary for the purposes set out in this policy, or as required by applicable Malaysian law:

• Active Account Data: While your account is active on mega999, your account data, transaction history, and gaming history are fully retained to support platform operations and meet regulatory requirements.
• Data After Account Closure: When your mega999 account is closed — whether at your request or by mega999 — your personal data will be retained for a minimum of seven (7) years in accordance with financial record-keeping requirements under Malaysian law. After this period, your data will be securely deleted or anonymised.
• Security Log Data: Security logs and access logs related to your account are retained for a period of two (2) years for security investigation and digital forensics purposes if required.
• KYC Verification Data: Copies of identity verification documents (MyKad) submitted during the KYC process are retained for a minimum of five (5) years, in line with Malaysia's AML requirements.
• Communication Data: Communication records between you and the mega999 support team are retained for two (2) years for service quality and dispute resolution purposes.

When data that is no longer needed is deleted, mega999 follows secure deletion procedures to ensure it cannot be recovered or accessed again.

Under Malaysia's Personal Data Protection Act (PDPA), you as a data subject have specific rights regarding your personal data held by mega999. Here are your rights and how to exercise them:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Data access requests can be submitted to the mega999 support team via live chat or by emailing support@mega999.site. We will process your request within 21 working days.
• Right to Rectification: If the personal data we hold about you is inaccurate, outdated, or incomplete, you have the right to request a correction. Basic account details such as phone number and email can be updated directly through your mega999 account settings.
• Right to Object to Processing: You have the right to object to the processing of your personal data for direct marketing purposes at any time. This can be done through the notification settings in your mega999 account without needing to contact support.
• Right to Withdraw Consent: Where the processing of certain data is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place prior to the withdrawal.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. However, this right is not absolute — mega999 may need to retain certain data to comply with Malaysian legal obligations, prevent fraud, or resolve outstanding disputes.

To exercise any of the above rights, please contact the mega999 support team via in-platform live chat or send a detailed email to support@mega999.site. We may need to verify your identity before processing data-related requests in order to protect the security of your account.

Platform Operations mega999 involves the use of technology infrastructure and service providers that may be located outside Malaysia. In situations where a user's personal data is transferred outside Malaysia for technical processing purposes, mega999 ensures that:

• Data transfers are made only to countries or recipients with a level of data protection equivalent to or exceeding Malaysia's PDPA standards.
• All data recipients outside Malaysia are bound by data processing agreements that require them to protect mega999 users' data to strict standards.
• Data transfers are carried out using appropriate technical safeguards — including end-to-end encryption — to ensure data cannot be intercepted or accessed in transit.
• Data transferred is the minimum required for the relevant technical purpose — mega999 does not transfer personal data that is irrelevant to the processing at hand.

Financial and identity data of Malaysian users — including KYC details and transaction history in MYR — is stored on servers located within the Asian region, with strict access controls in place to minimise cross-border data transfer risks.

Platform mega999 is strictly limited to individuals aged 18 and above. Mega999 does not knowingly collect, store, or process personal data from individuals under the age of 18.

Should mega999 discover that personal data belonging to an individual under the age of 18 has been collected without their knowledge — or, in cases involving underage users, without the consent of a parent or legal guardian, we will:

• Promptly deleting the relevant data from our systems.
• Closing the associated account and blocking further access.
• Returning any legitimate remaining balance to the original payment method used for the deposit.

If you believe that mega999 may have collected personal data from someone under the age of 18, please contact us immediately at support@mega999.site so that we can take the appropriate action without delay.

Mega999 welcomes any enquiries, concerns, or requests relating to your privacy and personal data protection. Please reach us through any of the following channels:

• Live Chat: The fastest channel — available on the mega999 platform 24 hours a day, 7 days a week. Our Bahasa Melayu-fluent agents will assist you within minutes.
• WhatsApp: Send us a message on WhatsApp for enquiries that require a more detailed conversation. The mega999 WhatsApp number is displayed on the platform after you log in.
• Email: For more formal written requests — such as data access, rectification, or deletion requests — please email support@mega999.site. We will respond within three (3) business days.

When contacting mega999 about a privacy matter, please provide your account number and describe your request or concern clearly. For requests that require identity verification, we may ask you to confirm certain information to protect the security of your account.

Mega999 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data handling practices, new Malaysian legal requirements, or new technologies we adopt:

• The "Last Updated" date at the top of this page will always be updated whenever any changes are made to this policy.
• For material amendments — that is, changes that significantly alter the way we collect or use personal data — mega999 will notify users via in-platform notifications or SMS to your registered Malaysian phone number before the changes take effect.
• Your continued use of the mega999 platform after an amended policy comes into effect will be taken as your acceptance of the updated policy.
• If you disagree with any amendments made, you have the right to close your mega999 account and request deletion of your personal data as outlined in Section 8.

We encourage you to review this Privacy Policy page periodically — once every three to six months — to stay informed about how mega999 handles your personal data. Any questions about amendments that have been made can be directed to our support team.