Bonus99 Privacy Policy – Data Protection for Malaysian Players

1 Introduction & Scope of the Bonus99 Privacy Policy

Bonus99 ("we", "our platform") is the data controller responsible for all personal information collected through the bonus99.cash website and all related services. This Privacy Policy outlines our data processing practices and our commitment to the privacy of every member who trusts Bonus99 as their entertainment platform of choice.

This document has been prepared to meet the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) — the principal legislation governing the collection, use, and disclosure of personal information in Malaysia. We are committed to complying with all provisions of the PDPA and internationally recognised data protection principles across all our operations.

This policy applies to all individuals who:

• Registering for or holding a Bonus99 account
• Using any gaming, betting, or promotional service on our platform
• Visiting the bonus99.cash website even without registering
• Contacting the Bonus99 customer support team through any channel

2 Types of Personal Data We Collect

Bonus99 only collects data that is necessary to deliver our services effectively, securely, and in compliance with the law. We do not collect excessive or irrelevant data beyond what is needed to operate the platform.

Data you provide directly to Bonus99:

• Registration information: Full name, date of birth, active Malaysian phone number, email address, and your preferred username.
• Identity verification (KYC) information: A copy of your Malaysian identity card (MyKad) or passport, along with a selfie holding the document, may be required to verify withdrawal requests.
• Financial information: Details of the payment methods you use — your Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay account numbers, or your FPX account number (Maybank2u, CIMB Clicks). We do not store your e-wallet password or PIN.
• Communications: Your conversation history with the Bonus99 customer support team via live chat, WhatsApp, or email.

Data collected automatically when you use the Bonus99 platform:

• Game activity data: Game history, bets, winnings, losses, and bonus usage on the Bonus99 platform.
• Technical data: IP address, device type and operating system, browser type and version, screen resolution, and access log data.
• Location data: General location based on IP address, for geographic region verification and account security purposes.
• Session data: Login time, logout time, session duration, and pages visited within the platform.

3 How Bonus99 Uses Your Personal Data

Every piece of data Bonus99 collects has a clear and legitimate purpose. We do not process your data for any other reason without first obtaining your consent. Below are the primary purposes for which we process data at Bonus99:

Bonus99 does not use your data to make automated decisions that significantly affect you without human involvement. All decisions relating to account suspension or withdrawal rejections are reviewed by our team before any action is taken.

4 Sharing & Disclosure of Data to Third Parties

Bonus99 does not sell, rent, or disclose your personal data to any third party for their own marketing purposes. This is our absolute commitment. That said, there are certain situations where sharing data is both necessary and legally permissible:

Third parties that may receive your data in the context of Bonus99's operations:

• Licensed game providers: Companies such as Pragmatic Play, Evolution Gaming, and Spadegaming receive the minimum information required to operate their games (such as a player ID that does not contain your real name), enabling secure technical integration.
• Payment processors: Payment gateway providers that process DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and FPX transactions receive the transaction data required to process your deposits and withdrawals.
• KYC service provider: Licensed third-party identity verification companies assist us in verifying your identity documents during the KYC process in accordance with industry standards.
• Malaysian authorities: Bank Negara Malaysia, the Malaysian Anti-Corruption Commission (MACC), or any legitimate law enforcement authority where there is a formal request under applicable Malaysian law.
• Professional advisors: Lawyers, accountants, or auditors bound by professional confidentiality obligations in the context of services they provide to Bonus99.

5 Bonus99 Data Security Measures

Protecting your personal data is Bonus99's highest technical and operational priority. We continuously invest in security infrastructure to ensure your data is always protected against unauthorised access, loss, or accidental disclosure.

Technical security layers we have implemented:

• 256-bit SSL encryption: All communications between your device and Bonus99 servers are encrypted using 256-bit TLS/SSL — the same standard used by Malaysia's leading financial institutions such as Maybank and CIMB.
• Data encryption at rest: Sensitive data, including identity information and financial details, is stored in encrypted format on our servers using internationally recognised encryption algorithms.
• Internal access controls: Access to members' personal data within Bonus99 is restricted to staff who genuinely require it to carry out their duties. All access is logged and audited on a regular basis.
• Two-factor authentication (2FA): Bonus99's internal systems require 2FA for all administrative access to databases containing members' personal information.
• 24/7 security monitoring: An automated monitoring system operates around the clock to detect suspicious activity or intrusion attempts against our infrastructure.
• Regular security audits: Bonus99 undergoes regular security audits by independent cybersecurity experts to identify and address potential vulnerabilities.

While we take all reasonable steps to protect your data, no system can guarantee absolute 100% security. You also play an important role in keeping your account safe — never share your password, use a strong and unique password, and notify us immediately if you suspect any suspicious activity on your Bonus99 account.

6 Personal Data Retention Period

Bonus99 does not retain your personal data longer than necessary for the stated purposes or as required by Malaysian law. Below is a general guide to our data retention periods:

• Active account data: Retained for the duration that your account remains active and in use on Bonus99.
• Data after account closure: Bonus99 retains transaction data and account information for 7 years after account closure to meet Malaysia's accounting and anti-money laundering legal requirements.
• KYC data: Identity verification documents are retained for 5 years after the business relationship ends, in accordance with Malaysian legal requirements.
• Customer support communication logs: Retained for 3 years from the date of last interaction, for reference and dispute resolution purposes.
• Marketing data: Retained until you withdraw your consent or close your Bonus99 account, whichever comes first.

Once the retention period expires and there is no legal obligation to retain the data further, Bonus99 will securely delete or anonymise it using methods that ensure the data cannot be recovered.

7 Cookies & Tracking Technologies on the Bonus99 Platform

The Bonus99 website uses cookies and similar tracking technologies to enhance the user experience, maintain platform security, and understand how players use our services. Below are the types of cookies we use:

• Essential cookies (required): These cookies are required for the Bonus99 platform to function properly. They manage your login session, maintain account security, and enable navigation within the platform. Without these cookies, the platform will not operate normally and you will not be able to use it.
• Performance cookies: Helps us understand how players use the platform — the most frequently visited pages, time spent, and any technical issues that may arise. This information is used in aggregated (anonymised) form to improve Bonus99's services.
• Functional cookies: Saves your preferences such as display language, display settings, and game preferences so you do not need to reconfigure them each time you use the Bonus99 platform.
• Security cookies: Helps us detect and prevent fraudulent activity, suspicious login attempts, and other security threats to your Bonus99 account.

You can manage your cookie settings through your web browser settings. However, disabling essential cookies may affect your ability to use certain functions of the Bonus99 platform as intended.

8 Your Rights as a Data Subject under Malaysia's PDPA

As a Bonus99 member, you have certain rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). Bonus99 is committed to respecting and facilitating the exercise of these rights in a reasonable manner and in accordance with the provisions of the law.

Your rights as a Bonus99 data subject:

• Right to access: You have the right to request a copy of the personal data we hold about you. Bonus99 will process access requests within 21 days of receiving a complete request.
• Right to rectification: If any data we hold is inaccurate, outdated, or incomplete, you have the right to request a correction. You can update basic account information directly through your Bonus99 account settings.
• Right to erasure: Under certain circumstances, you have the right to request that we delete your personal data. This right is subject to the legal retention obligations set out in section 6.
• Right to restrict processing: You may ask us to restrict the processing of your data in certain situations, such as while you are disputing the accuracy of the data.
• Right to withdraw consent: For processing that relies on your consent (such as marketing communications), you may withdraw that consent at any time via your account settings or by contacting us.
• Right to object: You may object to the processing of your data for specific purposes, including direct marketing, by contacting our team.

To exercise any of the above rights, email us at support@bonus99.cash with the subject line "Privacy Rights Request", along with your full name and Bonus99 account number. We will verify your identity before processing the request in order to protect your privacy from unauthorised claims.

9 Children's Data Protection

The Bonus99 platform is a service restricted to individuals aged 18 and above only. We do not knowingly collect or process personal data of individuals under the age of 18.

If we discover or are informed that we have collected personal data from an individual under the age of 18, we will immediately take the following steps:

• Suspending the relevant account immediately
• Delete all collected personal data as promptly as possible
• Refunding any deposited funds
• Reporting cases to the relevant authorities when required

If you suspect that a minor has accessed or is using the Bonus99 platform, please notify us immediately by emailing support@bonus99.cash. We take this responsibility seriously as part of our commitment to responsible gaming.

10 Changes to This Privacy Policy

Bonus99 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal developments, or feedback from our player community. We are committed to keeping you informed of any material changes.

When this Privacy Policy is updated:

• The "Updated" date at the top of this page will be changed to reflect the latest update
• Material changes will be communicated via email to your registered address and through in-platform notifications on Bonus99
• For very significant changes, we may ask you to reconfirm your consent before you can continue using the platform

It is your responsibility to review this page periodically. Continued use of the Bonus99 platform after the update date constitutes acceptance of the revised Privacy Policy.

11 How to Contact Us About Privacy

If you have any questions, concerns, or complaints regarding how Bonus99 handles your personal data, we encourage you to reach out to us directly. We take all privacy enquiries seriously and are committed to providing a satisfactory response.

• Privacy email: support@bonus99.cash — use the subject line "Privacy Enquiry" to get a faster response. We reply within 2 business days.
• Live chat: Available 24/7 within the Bonus99 platform — ideal for general enquiries that need a quick response.
• WhatsApp: Available via the number listed in your account after logging in — for more detailed enquiries.

For formal complaints regarding a PDPA breach by Bonus99, you also have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia, which operates under the Ministry of Communications and Digital Malaysia.