jp99 Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") describes how jp99 ("jp99", "we", "us", "our") collects, uses, stores, discloses, and protects personal data provided by or collected from users ("Member", "you") of the jp99 Platform at jp99.asia.

1.2 jp99 is committed to protecting the privacy and personal data of all its Members, including those based in Kuala Lumpur, Penang, Johor Bahru, and other locations across Malaysia. This Policy is drafted in accordance with applicable data protection principles and reflects our commitment to responsible data governance.

1.3 By registering an account or using the jp99 Platform, you consent to the collection and processing of your personal data as described in this Policy. If you do not agree with any part of this Policy, please do not use the jp99 Platform.

1.4 This Policy should be read together with jp99's Terms & Conditions. In the event of any inconsistency between this Policy and the Terms, the Terms shall prevail to the extent of the inconsistency.

2. Personal Data We Collect

2.1 jp99 collects personal data through the following means: directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party verification and payment service providers.

2.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, gender, nationality;
• Contact data: Email address, Malaysian mobile phone number, residential address;
• Identity verification documents: MyKad number, passport number, or equivalent government-issued identification;
• Account credentials: Username, hashed password (never stored in plaintext);
• Financial data: Bank account details, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), transaction history;
• Communications: Content of live chat conversations, support emails, and feedback submitted through the jp99 Platform.

2.2 Data Collected Automatically

• Device & technical data: IP address, browser type and version, operating system, device identifiers;
• Usage data: Pages visited, games played, bet amounts, session duration, login timestamps, click patterns;
• Cookie data: Session identifiers, preference settings, analytics identifiers (see Section 6);
• Geolocation data: General geographic location inferred from IP address for compliance and fraud prevention purposes.

2.3 Data from Third Parties

• Identity verification results from KYC service providers;
• Transaction confirmation data from payment processors (FPX, DuitNow, Maybank2u, CIMB Clicks, and others);
• Fraud risk scores from fraud detection service providers;
• Self-exclusion status from responsible gaming databases jp99 is connected to.

3. How jp99 Uses Your Personal Data

3.1 jp99 does not use your personal data for automated individual decision-making (profiling) that produces legal or similarly significant effects without human review, except for fraud risk scoring where flagged decisions are always reviewed by a jp99 compliance team member before action is taken.

4. Legal Basis for Processing

4.1 jp99 processes your personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil the contractual obligations between jp99 and the Member — including account management, game provision, and financial transaction processing;
• Legal obligation: Processing required for jp99 to comply with applicable laws — including AML regulations, KYC requirements, and responses to lawful requests from regulatory authorities;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and improvement of jp99's services, where these interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications, optional cookies, and any other processing for which jp99 has specifically sought and obtained your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

5.1 jp99 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.

5.2 jp99 may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors and e-wallet providers: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX network banks (Maybank, CIMB, Public Bank, Hong Leong, and others) — for the purpose of processing deposits and withdrawals;
• KYC and identity verification providers: For verifying the identity and age of Members;
• Fraud prevention and AML compliance service providers;
• Game content providers and live casino studios: Limited technical data required for game provision and RNG certification;
• IT infrastructure and hosting providers: Strictly for platform operation and data storage;
• Regulatory authorities and law enforcement agencies: Where required by law, court order, or as part of lawful investigations into fraud, money laundering, or other illegal activity;
• Professional advisors: Including legal counsel and auditors, where necessary and under confidentiality obligations.

5.3 All third-party service providers who process personal data on behalf of jp99 are required to maintain appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose other than the specific service they provide to jp99.

6. Cookies & Tracking Technologies

6.1 The jp99 Platform uses cookies and similar tracking technologies to enhance your experience, maintain session state, detect fraud, and analyse Platform performance.

6.2 The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function — session management, login state, CSRF protection. These cannot be disabled.
• Functional cookies: Remember your preferences such as language, game settings, and display options.
• Analytics cookies: Collect anonymised usage data to help jp99 understand how Members interact with the Platform and identify areas for improvement.
• Security cookies: Used for fraud detection, bot prevention, and account protection.

6.3 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the jp99 Platform from functioning correctly. Analytics and functional cookies may be disabled without affecting core Platform functionality.

7. Data Retention

7.1 jp99 retains personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable law.

7.2 Indicative retention periods:

• Active account data: Retained for the duration of the Member's account and for a period of 5 years following account closure, in compliance with standard AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction;
• KYC and identity verification documents: Retained for the duration of the Member relationship and for 5 years post-closure;
• Customer support communications: Retained for 3 years from the date of the communication;
• Analytics and usage data: Retained in anonymised form indefinitely; identifiable usage data retained for 2 years.

7.3 Upon expiry of the applicable retention period, jp99 will securely delete or anonymise personal data in accordance with its internal data disposal procedures.

8. Data Security

8.1 jp99 implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key measures include:

• TLS 1.3 / 256-bit AES encryption for all data in transit between your device and jp99's servers;
• AES-256 encryption at rest for sensitive data stored on jp99's servers, including identity documents and financial data;
• bcrypt password hashing — passwords are never stored in plaintext or reversibly encrypted form;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication for all jp99 staff accessing production systems;
• Regular security audits and penetration testing by independent security professionals;
• 24/7 security monitoring with automated alerts for anomalous access patterns.

8.2 While jp99 applies industry-standard security measures, no digital system can guarantee absolute security. Members are encouraged to use strong, unique passwords for their jp99 accounts and to enable two-factor authentication via the Security Centre.

8.3 In the event of a data breach that is likely to result in risk to Members, jp99 will notify affected Members without undue delay and will take all reasonable steps to mitigate the impact of the breach.

9. Your Data Protection Rights

9.1 As a Member of jp99, you have the following rights with respect to your personal data:

• Right of access: Request a copy of the personal data jp99 holds about you;
• Right to rectification: Request correction of inaccurate or incomplete personal data;
• Right to erasure ("right to be forgotten"): Request deletion of your personal data where jp99 has no legal obligation to retain it — noting that AML and regulatory retention requirements may preclude full erasure in some cases;
• Right to restrict processing: Request that jp99 limit the way it uses your data in certain circumstances;
• Right to data portability: Request a copy of your data in a structured, machine-readable format for transfer to another service;
• Right to object: Object to processing based on jp99's legitimate interests, including direct marketing;
• Right to withdraw consent: Withdraw consent for consent-based processing at any time, without affecting the lawfulness of prior processing.

9.2 To exercise any of these rights, please contact jp99 at [email protected]. jp99 will respond to verified requests within 30 days. jp99 may require identity verification before processing data access, rectification, or erasure requests.

10. Children's Privacy

10.1 If you believe that a minor has registered on the jp99 Platform, please notify jp99 immediately at [email protected] so that appropriate action can be taken.

11. International Data Transfers

11.1 jp99 may transfer personal data to, or process it in, countries outside of Malaysia in connection with its service providers — including cloud hosting infrastructure, KYC vendors, and fraud prevention partners. Where such transfers occur, jp99 ensures that appropriate safeguards are in place, including contractual data protection obligations equivalent to or exceeding those applicable under Malaysian data protection standards.

11.2 By using the jp99 Platform, you consent to the transfer of your personal data to other jurisdictions for the purposes described in this Policy, subject to the protections described in this section.

12. Marketing Communications

12.1 jp99 may send you promotional communications — including bonus offers, seasonal promotions (such as Deepavali, Chinese New Year, or Hari Raya campaigns), and platform news — via email or SMS, subject to your communications preferences.

12.2 You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any jp99 marketing email;
• Replying STOP to any jp99 marketing SMS;
• Updating your communication preferences in your jp99 account settings.

12.3 Opting out of marketing communications does not affect transactional communications — jp99 will continue to send security alerts, deposit/withdrawal confirmations, and account notifications regardless of marketing preferences.

13. Changes to This Privacy Policy

13.1 jp99 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or operational requirements. The updated Policy will be published at jp99.asia/privacy-policy with a revised "Last updated" date.

13.2 Where changes are material, jp99 will notify Members via email or a prominent notice on the Platform. Continued use of the jp99 Platform following notification of changes constitutes acceptance of the revised Policy.

14. Contact Us

14.1 For any questions, requests, or concerns regarding this Privacy Policy or jp99's handling of your personal data, please contact:

• Email: [email protected]
• Live Chat: Available 24/7 on the jp99 Platform
• Response Time: Email queries responded to within 1 business day

14.2 jp99 takes all privacy enquiries seriously and will handle your request with care and confidentiality. Members in Malaysia may also consult the Personal Data Protection Commissioner under the Personal Data Protection Act 2010 (PDPA) if they believe their data protection rights have been infringed.