Viva99 Privacy Policy – Malaysian Player Personal Data Protection

Viva99 ("we", "Platform", "Company") is fully committed to protecting the privacy and data security of every individual who uses our platform. We understand that your trust is our most valuable asset, and we never take this responsibility lightly.

This Privacy Policy is prepared in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection standards. It transparently explains how your personal data is collected, used, stored, protected, and in certain circumstances, shared with third parties.

We use plain language throughout this document so you genuinely understand what happens with your information — not buried under confusing legal jargon. If any section is unclear, please reach out to our support team and we will be happy to explain further.

To deliver quality, secure services and meet legal requirements, viva99 collects several categories of information from our users. Below is a full breakdown of the data types we collect:

We only collect data that is strictly necessary for the stated purposes — this data minimisation principle is central to our privacy commitment. You will never be asked to provide information beyond what our operations and compliance require.

The personal data we collect is used responsibly for the following purposes. We will not use your data for any other purpose without first obtaining your consent:

• Account Management: Create, maintain, and protect your account on the viva99 platform, including identity verification and the KYC process.
• Transaction Processing: Process all deposits, withdrawals, and other financial activity quickly and securely.
• Legal Compliance: Meet our obligations under anti-money laundering (AML) laws, fraud prevention requirements, and regulatory body mandates.
• Platform Security: Detect and prevent fraud, unauthorised access, and any security threats to your account and our platform.
• Customer Support: Provide technical assistance and effectively resolve your queries or complaints.
• Service Communications: Send important account-related notifications, terms updates, and security information.
• Product Improvement: Analyse usage patterns on an aggregate and anonymised basis to improve platform features and the user experience.
• Marketing (with consent): Send information about promotions, new offers, and VIP programmes — only where you have given consent to receive such communications.

Viva99 processes your personal data on the basis of one or more valid legal grounds as follows:

• Contract Performance: Processing is necessary to fulfil the service agreement between you and viva99 — including account management, payment processing, and the provision of gaming services.
• Legal Obligation: We are legally required to maintain certain records, conduct KYC checks, and report suspicious activity to the relevant authorities.
• Legitimate Interests: We process certain data based on our legitimate interests to prevent fraud, ensure platform security, and improve our services — provided these interests do not override your fundamental privacy rights.
• Consent: For marketing activities and opted-in communications, we rely on your explicit consent, which may be withdrawn at any time.

Every data processing activity we carry out is tied to at least one valid legal basis. If you wish to know the specific legal basis for any particular processing activity, please contact our privacy team.

Viva99 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. However, in the course of operating the platform, we need to share certain data with a limited set of third-party categories:

• Payment Service Providers: Banking institutions, e-wallet providers (Touch 'n Go, GrabPay, and others), and payment processors that assist in completing your financial transactions.
• KYC Service Providers: Third-party identity verification companies that help us verify user documents and identities securely and efficiently.
• Technology Infrastructure Providers: Cloud computing, data storage, and cybersecurity services that enable our platform to operate efficiently.
• Statutory Authority: Law enforcement agencies, regulatory bodies, or courts when we are legally required to do so under applicable law.
• Gaming Partners: Third-party game software providers may receive the minimum data required to deliver games correctly — this is subject to strict confidentiality agreements.

All third parties with whom we share data are bound by strict data processing agreements and must comply with security and privacy standards equal to or higher than those we apply ourselves. We conduct regular audits of all vendors to ensure ongoing compliance.

Protecting your data is not just a legal obligation for us — it is a core operational priority. viva99 continuously invests in industry-standard security infrastructure to keep your information safe at all times:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our servers is protected by 256-bit SSL encryption — the same standard used by leading banking institutions.
• Data-at-Rest Encryption: Personal data stored in our databases is encrypted using AES-256 algorithms, ensuring the data remains unreadable even in the event of unauthorised access.
• Two-Factor Authentication (2FA): We provide and encourage the use of 2FA for all accounts, adding an extra layer of security beyond just a password.
• 24/7 Monitoring: Our security monitoring system operates around the clock to detect and respond to any threats or suspicious activity in real time.
• Regular Penetration Testing: We conduct regular security testing by independent third parties to identify and address vulnerabilities before they can be exploited.
• Internal Access Controls: Access to users' personal data within our organisation is strictly limited to staff who genuinely need it to carry out their duties.

Viva99 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by law. The following are our general data retention guidelines:

• Active Account Data: Retained for the duration that your account remains active on the viva99 platform.
• Financial Transaction Data: Stored for a minimum of 7 years after the transaction occurs, in accordance with Malaysian legal and tax requirements.
• KYC Records: Stored for 5 years after the business relationship ends, or longer if required by AML regulations.
• Communication Logs: Customer support communication records are retained for 3 years for reference and dispute resolution purposes.
• Analytics Data: Anonymised usage data may be retained for a longer period for platform improvement purposes.

Once the retention period has expired or data is no longer required, we will securely delete or anonymise it using appropriate methods. Deleted data cannot be recovered.

Your data may be stored on servers located outside Malaysia. In such cases, we ensure equivalent protection is provided through appropriate contractual agreements with our storage providers.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and viva99's internal policies, you have the following rights regarding your personal data:

To submit any request relating to your rights, please contact our privacy team via live chat or email. We will process your request within 30 working days. Note: these rights are subject to certain restrictions where legal requirements or other legitimate interests override your request.

Viva99 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help websites remember your preferences and session information.

We use the following types of cookies:

• Essential Cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled.
• Performance Cookies: Collect data on how users interact with our platform to help us identify and fix issues.
• Functional Cookies: Remember your preferences and settings (such as language and display options) to deliver a more personalised experience.
• Analytics Cookies: Helps us understand aggregate traffic and usage patterns to improve platform content and navigation.

You can manage cookie settings through your web browser. However, disabling certain cookies may affect the functionality and user experience of our platform. Continued use of the viva99 platform after a cookie notification is considered consent to the use of cookies as described.

The viva99 platform is exclusively for individuals aged 18 years and above. We do not knowingly collect, store, or process any personal data from minors.

If you believe a child has provided us with personal information without parental or guardian consent, please contact us immediately. We will take the appropriate steps to remove that information as quickly as possible.

We encourage parents and guardians to monitor their children's online activity and make use of available parental control tools to block access to websites unsuitable for minors.

Viva99 reserves the right to update or amend this Privacy Policy from time to time in line with changes to legislation, technology, or our business practices. Any significant changes will be communicated to you via in-account notifications or email at least 14 days before the changes take effect.

The "Last Updated" date at the top of this document will always reflect the latest version. We encourage you to review this page periodically to stay informed about how we protect your information.

For any enquiries, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact the viva99 Privacy Officer via:

• Live Chat: Available 24/7 via the chat icon at the bottom-right corner of the platform.
• Email: [email protected] (response within 2–3 business days)
• FAQ Section: Visit FAQ page for answers to commonly asked questions.