Privacy Policy

1 Introduction

mycard99 ("we", "us", "our") operates the online sports betting and live casino platform accessible at mycard99.cam (the "Platform"), primarily serving players in Malaysia. This Privacy Policy ("Policy") describes how mycard99 collects, uses, stores, shares, and protects the personal data of individuals who visit our website, register an account, or interact with our services in any way.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable international data protection principles. This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

This Policy applies to all personal data processed by mycard99 regardless of the medium through which it is collected — whether through the website, live chat, email correspondence, or during our KYC (Know Your Customer) verification process.

2 Definitions

In this Privacy Policy, the following terms have the meanings assigned to them below:

• "Data Controller" means mycard99, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of mycard99 under a formal data processing agreement.
• "Data Subject" means you — the identified or identifiable natural person whose personal data is being processed.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, national identification number, IP address, device identifiers, and financial account details.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data. mycard99 does not intentionally collect sensitive data in the ordinary course of its operations.
• "KYC" means Know Your Customer — the regulatory verification process under which mycard99 confirms the identity and eligibility of registered players.

3 Data We Collect

mycard99 collects the following categories of personal data:

4 How We Collect Your Data

mycard99 collects personal data through the following methods:

• Direct Provision: Data you actively provide when registering an account, completing KYC verification, contacting customer support, or updating your profile settings.
• Automated Collection: Technical data collected automatically through cookies, web server logs, and session tracking technologies when you access or interact with the Platform. See Section 10 (Cookies & Tracking) for details.
• Payment Processors: Transaction reference data and payment status information provided by Malaysian payment processors (e.g., DuitNow, FPX gateway operators, Touch 'n Go eWallet) following the execution of a deposit or withdrawal instruction.
• Identity Verification Services: In certain cases, mycard99 may use third-party KYC verification providers to cross-reference identity documents against authoritative sources. These providers operate under binding data processing agreements and applicable regulatory requirements.
• Publicly Available Sources: Information from publicly available databases, including fraud prevention registries and sanctions lists, used solely for AML compliance and risk management purposes.

5 Purposes of Data Processing

mycard99 processes your personal data for the following specific, legitimate purposes:

1. Account Management: To create, verify, and maintain your mycard99 account, including identity verification and authentication.
2. Service Delivery: To process deposits and withdrawals via Malaysian payment channels (including Maybank2u, CIMB Clicks, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX), settle bets and game outcomes, and operate the Platform's features.
3. Legal and Regulatory Compliance: To fulfil our obligations under anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) regulatory frameworks applicable to online gaming operators.
4. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, and other prohibited activities described in our Terms & Conditions.
5. Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance via live chat, email, and other support channels.
6. Responsible Gambling: To monitor betting patterns in connection with our responsible gambling obligations, identify indicators of problem gambling, and facilitate the operation of self-exclusion, deposit limit, and cool-off period tools.
7. Marketing Communications: To send you promotional offers, bonus notifications, and service updates, subject to your marketing consent preferences. You may withdraw consent for marketing communications at any time.
8. Platform Improvement: To analyse anonymised or aggregated usage data for the purpose of improving the functionality, content, and user experience of the mycard99 Platform.

6 Legal Basis for Processing

mycard99 relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing required to fulfil the agreement between you and mycard99 under our Terms & Conditions — including account management, payment processing, and bet settlement.
• Legal Obligation: Processing necessary to comply with applicable legal and regulatory requirements, including AML/KYC obligations, record-keeping obligations, and responses to lawful regulatory enquiries.
• Legitimate Interests: Processing that serves our legitimate business interests, including fraud prevention, platform security, IT system integrity, and product improvement, where such interests are not overridden by your rights and freedoms as a data subject.
• Consent: Processing based on your freely given, informed, and specific consent — principally for marketing communications and optional data analytics participation. Consent may be withdrawn at any time without detriment to your account access.

7 Data Sharing & Disclosure

mycard99 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share personal data only in the following limited and controlled circumstances:

• Payment Service Providers: Malaysian payment processors and e-wallet operators (including but not limited to entities facilitating Maybank2u, CIMB Clicks, FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay transactions) receive transaction-relevant data strictly for payment execution and confirmation purposes.
• Identity Verification Providers: Third-party KYC and identity verification services receive submitted identity documents and reference data for the purpose of fulfilling our regulatory verification obligations.
• Regulatory and Law Enforcement Authorities: We may be required by law to disclose personal data to competent regulatory bodies, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where lawfully required. mycard99 will disclose the minimum data necessary to satisfy such requirements.
• Fraud Prevention Databases: Where required by our AML obligations or fraud prevention policies, we may share account or transaction data with shared fraud detection databases or screening services.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of assets involving mycard99, personal data held by mycard99 may be transferred to the acquiring or successor entity, subject to equivalent data protection obligations.

8 International Data Transfers

In the course of operating the mycard99 Platform and engaging certain technology and payment processing service providers, your personal data may be transferred to, stored, or processed in countries outside Malaysia. Where such transfers occur, mycard99 takes appropriate steps to ensure that your data receives a level of protection consistent with internationally recognised data protection standards.

Safeguards applied to international transfers may include contractual data protection clauses in agreements with the relevant data processors, and selection of service providers operating in jurisdictions that maintain adequate data protection frameworks. If you have questions about the specific safeguards applied to any particular international transfer, you may contact us at the address set out in Section 16.

9 Data Retention

mycard99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

• Account and KYC Records: Retained for a minimum of five (5) years from the date of account closure, in accordance with AML and regulatory record-keeping obligations commonly applied to online gaming operators.
• Transaction Records: Deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years following the transaction date.
• Customer Support Records: Live chat transcripts, email correspondence, and support ticket records are retained for up to three (3) years from the date of the last interaction, or longer where required for ongoing dispute resolution.
• Marketing Preferences: Consent records and unsubscribe requests are retained for a minimum of three (3) years from the date of the consent or opt-out action.
• Technical and Log Data: Server logs and session data are retained for up to twelve (12) months for security monitoring and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify you.

10 Cookies & Tracking Technologies

mycard99 uses cookies and similar technologies (including local storage and session tokens) to ensure the Platform functions correctly and to provide a secure, personalised experience. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the Platform — including session authentication, login state management, and security token handling. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, preferred currency display (MYR), and remembered login details to enhance your experience on return visits.
• Analytical / Performance Cookies: Used to collect anonymised data about how players interact with the Platform — including page views, session duration, and navigation paths — to help us improve Platform performance. These cookies do not identify you personally.
• Fraud Prevention Cookies: Assist our security systems in identifying suspicious activity patterns, device fingerprinting for multi-account detection, and IP-based risk profiling.

mycard99 does not deploy third-party advertising or behavioural targeting cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may affect your ability to use the Platform.

11 Children's Privacy

The mycard99 Platform is not intended for use by any person under the age of 21. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that we have inadvertently collected personal data from a person under this age threshold, we will take immediate steps to delete such data and close the associated account.

12 Security Measures

mycard99 implements a multi-layered approach to data security designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security infrastructure includes:

• Transport Layer Encryption: All data transmitted between your device and mycard99 servers is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Access Controls: Access to systems holding personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Infrastructure Security: Our servers are hosted in secured data centres with physical access controls, fire suppression systems, and redundant power supplies. Regular penetration testing and vulnerability assessments are conducted by independent security firms.
• Incident Response: mycard99 maintains a formal data breach incident response procedure. In the event of a security incident that results in a material risk to affected data subjects, we will notify the relevant parties in accordance with applicable notification obligations.

While mycard99 takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your account login credentials and for ensuring your device and internet connection are adequately secured.

13 Your Rights as a Data Subject

Subject to applicable law and certain regulatory exceptions (including AML record-keeping obligations), you have the following rights in respect of personal data held by mycard99:

• Right of Access (Article 15 equivalent): The right to request a copy of the personal data we hold about you and information about how it is processed.
• Right to Rectification (Article 16 equivalent): The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17 equivalent): The right to request deletion of your personal data, subject to our legal retention obligations.
• Right to Restrict Processing (Article 18 equivalent): The right to request that we limit processing of your personal data in certain circumstances.
• Right to Data Portability (Article 20 equivalent): The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21 equivalent): The right to object to processing based on legitimate interests, including direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected] with your registered account details and the specific right you wish to exercise. We will acknowledge your request within 48 hours and respond substantively within 30 days, or sooner where possible.

14 Third-Party Links

The mycard99 Platform may contain references to third-party payment providers, game suppliers, or service partners in the context of service descriptions. mycard99 does not operate external websites and does not include outbound hyperlinks to third-party sites within the Platform's navigable pages.

Where third-party services are accessed via mycard99's infrastructure (for example, payment gateways for Maybank2u, CIMB Clicks, FPX, or DuitNow transactions), those services are governed by the privacy policies of the respective service providers. mycard99 is not responsible for the privacy practices of third-party payment processors acting as independent data controllers in relation to their own service obligations.

15 Policy Amendments

mycard99 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or regulation, or Platform functionality. The "Last Updated" date displayed at the top of this page will be updated whenever material changes are made.

Where changes are material — affecting your rights or the substantive ways in which we process your personal data — we will provide advance notice via email to your registered address or via a prominent on-site notification before the amended Policy takes effect. For minor or non-material changes (such as typographical corrections or clarifications), the updated Policy will take effect immediately upon publication.

Your continued use of the mycard99 Platform following the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

16 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which mycard99 processes your personal data, please contact our Data Support team using the details below. We take all privacy enquiries seriously and are committed to resolving any concerns promptly and transparently.

We will acknowledge all privacy-related enquiries within 48 hours and aim to provide a full substantive response within 30 days. For complex requests involving data access, erasure, or portability, the 30-day period may be extended by up to an additional 60 days in exceptional circumstances, with notification provided to you.

If you are not satisfied with how mycard99 has handled your data privacy concern following exhaustion of our internal process, you have the right to escalate your complaint to an appropriate supervisory authority or data protection regulator in your jurisdiction.