SCR99 Privacy Policy – Malaysia Member Personal Data Protection

1Introduction and Scope of Privacy Policy

SCR99 is an online sports betting and casino platform operating for users in Malaysia. We take our responsibility to protect the privacy and personal data of every member who trusts our platform seriously.

This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of your personal data when you use the SCR99 website, our mobile app, or any services we provide.

This policy applies to all individuals who:

• Visiting the scr99 website as a guest or registered member
• Registering an account and using any scr99 services
• Contacting our customer support team through any channel
• Interacting with SCR99 content or marketing communications

SCR99 acts as the data controller for the personal information you provide to us. We are committed to ensuring your data is processed lawfully, transparently, and securely in accordance with data protection principles recognised in Malaysia.

2Types of Personal Data We Collect

SCR99 only collects data that is strictly necessary to provide our services safely and effectively. The following are the categories of data we collect:

The data we collect comes from the following sources:

• Information you provide directly – during registration, the KYC process, contact forms, or live chat sessions.
• Automatically generated data – technical information such as IP addresses, device types, and usage patterns recorded by our systems while you use the platform.
• Authorised third-party sources – in certain situations such as identity verification through approved third-party KYC services, or feedback from payment providers to confirm transactions.

We do not collect sensitive data such as health information, religious beliefs, or political views unless specifically required by applicable law.

3How SCR99 Uses Your Data

SCR99 uses your personal data only for lawful and appropriate purposes. Every use of data has a clear legal basis, whether grounded in contract, legal obligation, legitimate interest, or your consent.

• Account management and identity verification – to ensure only eligible individuals who have completed the KYC process can securely access their accounts.
• Processing deposits and withdrawals – to accurately process your financial transactions and fulfil financial compliance requirements.
• Fraud prevention and anti-money laundering – to identify and block suspicious activity, protecting all members and the integrity of the SCR99 platform.
• Customer support provision – to enable our support team to understand the context of your issue and provide accurate, effective assistance.
• Product improvement and user experience – to analyse usage patterns in aggregate and make continuous improvements to the SCR99 platform.
• Account-related communications – to send important notifications regarding your account, policy changes, or security activity that requires your attention.
• Legal compliance – to meet reporting or investigation requirements mandated by the relevant authorities under Malaysian law.

4Sharing and Disclosing Data

SCR99 does not sell, rent, or trade members' personal data to any third party for commercial purposes. However, in limited and specific situations, we may share data with the following parties:

• Payment service providers – such as FPX processors, DuitNow, and approved e-wallet platforms, solely to securely process your financial transactions.
• KYC and identity verification service providers – authorised third parties engaged to carry out identity checks to ensure the security of all SCR99 members.
• Technology infrastructure providers – including cloud computing and hosting services used to operate the SCR99 platform, all of which are subject to strict data confidentiality agreements.
• Authorities and law enforcement bodies – when required by Malaysian law or a valid court order, SCR99 will disclose the necessary data to the relevant authorities.
• Professional advisors – such as lawyers, accountants, or auditors bound by professional confidentiality obligations, in limited and necessary contexts only.

All third parties that receive SCR99 members' personal data are required to comply with data protection standards equal to or higher than SCR99's privacy policy. We do not permit third parties to use our members' personal data for their own purposes.

In the event of a change in business ownership or company merger, members' personal data may be transferred to the receiving entity. In such situations, SCR99 will notify members before the data is transferred and ensure continued protection of that data.

5Data Security Measures

SCR99 continuously invests in the latest security infrastructure to protect our members' personal data. The following are the key security layers we employ:

• Data-in-transit encryption (SSL/TLS 256-bit): All communications between your device and SCR99's servers are fully encrypted using the latest SSL/TLS protocols, ensuring no party can intercept your data.
• Data-at-rest encryption (AES-256): Sensitive data such as financial information and KYC documents are encrypted in the database using military-grade AES-256 encryption.
• Two-factor authentication (2FA): SCR99 offers two-factor authentication for an added layer of security on member accounts.
• Real-time threat monitoring: SCR99's automated monitoring system operates 24/7 to detect and block suspicious activity before it affects member accounts.
• Strict internal access controls: Only authorised SCR99 staff who require data access for their job responsibilities may view member personal data.
• Regular security audits: SCR99 conducts regular internal and external security audits to ensure our systems consistently meet the latest security standards.

6Cookies and Tracking Technology

SCR99 uses cookies and similar tracking technologies to enhance the user experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session verification and bet basket management. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects aggregated, anonymised information about how visitors use our platform for internal analytics and product improvement purposes.
• Functional Cookies: Allows the platform to remember your preferences such as language, region, and display settings for a more personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, and to ensure the security of transactions and user sessions.

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality and user experience of the SCR99 platform. SCR99 does not use third-party cookies for remarketing (retargeting) purposes without your consent.

7Your Rights Regarding Personal Data

As a SCR99 member and data subject under Malaysia's PDPA, you have important rights regarding your personal data. SCR99 is committed to respecting and facilitating the exercise of these rights:

To exercise any of the above rights, please contact the SCR99 customer support team via live chat or email. We will verify your identity before processing any data-related request. SCR99 does not charge for reasonable data rights requests.

8Data Retention Period

SCR99 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable Malaysian law.

• Active account data: Retained throughout your active membership period and for up to 7 years after account closure to meet financial compliance requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's financial and tax legal requirements.
• Customer support communication records: Retained for 3 years for service quality and dispute resolution purposes.
• Technical and security log data: Retained for 12 months for fraud detection and security analysis purposes.
• Marketing data: Retained until you withdraw your consent or close your account.

Once the retention period has ended, your personal data will be securely deleted or anonymised using methods that ensure the data cannot be recovered or re-identified.

9Child Data Protection

SCR99 is an exclusive platform for adults aged 18 and above. We take the protection of children's privacy very seriously and do not knowingly collect personal data from individuals under the age of 18.

Steps we take to protect minors:

• Age verification during registration uses a KYC system to confirm that every new member has reached the age of 18.
• Continuous monitoring to detect accounts that may belong to underage individuals, with immediate action taken to suspend such accounts while an investigation is conducted.
• Full cooperation with parents or guardians who report that their child may have registered without authorisation.

If you believe a child under the age of 18 has registered an account on SCR99, please contact our support team immediately. We will investigate and take appropriate action, including deleting all data related to that individual.

10Amendments to the Privacy Policy

SCR99 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments. All changes take effect upon publication on the SCR99 website.

We will notify members of important changes through:

• In-account notification during the next login session
• Push notification via the scr99 mobile app
• Notice prominently displayed on the platform's home page

The "Updated" date at the top of this document always reflects the date of the most recent amendment. We encourage you to review this Privacy Policy periodically. Continued use of the SCR99 platform after an amendment takes effect constitutes acceptance of the updated Privacy Policy.

11Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how SCR99 handles your personal data, our data privacy team is ready to assist.

We aim to respond to all privacy-related enquiries within 7 business days. For formal complaints regarding data processing, please submit them in writing via email, stating your full name, account number, and details of your complaint.