Privacy Policy SCR99 – Personal Data Protection for Malaysian Members

1Introduction & Scope of This Privacy Policy

SCR99, operating through the domain scr99.best, is an online entertainment platform offering slots, live casino, Sports Betting (including Malaysia Super League and EPL football), badminton, lottery, virtual sports, and live matches to users in Malaysia. We understand that privacy matters deeply to you, and we take that responsibility seriously.

This Privacy Policy ("Policy") clearly and transparently explains how SCR99 handles your personal data — including how it is collected, how it is used, who it may be shared with, how long it is retained, and what rights you have as the data owner.

This policy applies to all SCR99 members, including unregistered website visitors, active registered members, and individuals using any service provided through our platform. SCR99 operates in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA), and we are committed to ensuring every aspect of our data handling meets its legal requirements.

2Types of Personal Data We Collect

SCR99 follows a data minimisation principle — we only collect data that is strictly necessary to deliver our services safely and effectively. Below are the categories of data we collect:

We also collect data you voluntarily provide when contacting the SCR99 support team, submitting feedback, or participating in member surveys. This data is used to improve the quality of our services for you and all SCR99 members.

3How SCR99 Uses Your Personal Data

SCR99 uses collected personal data solely for legitimate, clearly stated purposes. Below is a full list of how your data is used:

• Account Management: Creating and maintaining your account, processing registration, and managing secure login through OTP verification.
• Transaction Processing: Processes deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as withdrawals to your Malaysian bank account.
• Identity Verification (KYC): To meet Know Your Customer compliance requirements for the prevention of fraud, money laundering, and other illicit activities.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance via live chat, email, or other communication channels.
• Platform Security: Detecting and preventing fraudulent activity, unauthorised access, bot usage, and other security threats to the SCR99 platform.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing appropriate self-control tools.
• Platform Improvements: Analysing aggregated usage data (without identifying individuals) to improve the design, performance, and features of the SCR99 platform.
• Service Communications: Sending important notifications regarding your account, changes to terms, security issues, and critical service information.
• Marketing (with consent): Sending you SCR99 promotional information, bonuses, and special offers — only where you have given explicit consent. You may withdraw this consent at any time.

4Data Sharing with Third Parties

SCR99 does not sell or distribute your personal data to third parties for marketing purposes. However, within the context of operating our platform, there are limited situations where your data may be shared with trusted third parties:

• Payment Processors: Required transaction information is shared with licensed payment processors such as Touch 'n Go, GrabPay, DuitNow, and the FPX network to securely process your deposits and withdrawals.
• Game Provider: Minimal technical data required to run games is shared with game software providers who have signed strict data confidentiality agreements with SCR99.
• Regulatory Authorities: SCR99 will disclose required data to Malaysian law enforcement agencies or regulatory bodies where mandated by law or court order.
• Fraud Prevention: Relevant data may be shared with industry bodies or regulators for fraud prevention and anti-money laundering purposes.
• Professional Advisors: Lawyers, accountants, or auditors bound by professional confidentiality obligations may access certain data during audit or legal advisory processes.

All third parties granted access to SCR99 member data are required to sign strict data protection agreements and are only permitted to use that data for explicitly stated purposes. SCR99 takes responsibility for ensuring these third parties uphold data protection standards equal to or higher than our own.

In the event of a company merger, acquisition, or sale of SCR99's assets, member data may be transferred to the new entity — however, members will be notified in advance and their rights under the PDPA will continue to be upheld.

5Use of Cookies & Tracking Technologies

SCR99 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you access the SCR99 website.

• Essential Cookies (Required): Required for the core functions of the SCR99 platform, including login session authentication, CSRF security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects anonymous data on how visitors use the SCR99 platform — including most-visited pages, time spent, and navigation paths. This helps us continuously improve the user experience.
• Functional Cookies: Saves your preferences such as display settings, language, and game choices so you don't have to reconfigure them each time you visit SCR99.
• Marketing Cookies (with consent): Used only with your consent to display relevant SCR99 promotional content. You may decline these cookies without affecting your access to core services.

You may manage or disable cookies through your web browser settings at any time. Please note that disabling essential cookies may affect the functionality of the SCR99 platform. For guidance on managing cookies in popular browsers such as Chrome, Safari, or Firefox, please refer to the official documentation for your browser.

6SCR99 Data Security Measures

SCR99 continually invests in security infrastructure to ensure your personal and financial data is protected to the highest standard. Below are the security layers we have in place:

• 256-bit SSL Encryption: All communications between your device and SCR99's servers are protected by 256-bit SSL encryption — the same standard used by Maybank and CIMB for their online banking.
• Two-Factor Authentication (2FA): Members can enable 2FA for an additional layer of security beyond their password. Every login attempt from a new device or location will require OTP verification.
• 24/7 Monitoring: The SCR99 system is continuously monitored by our security team to detect any unusual activity, unauthorised access attempts, or emerging security threats.
• Strict Access Controls: Member data is accessible only to SCR99 staff with a legitimate business need. All access is logged and regularly audited.
• Regular Security Testing: SCR99 conducts regular penetration testing and security audits by independent cybersecurity firms to identify and address vulnerabilities before they can be exploited.
• Secure Password Storage: Member passwords are not stored in plain text — they are hashed using modern, irreversible cryptographic algorithms.

7Data Retention Period

SCR99 does not retain your personal data longer than necessary for the purposes stated in this Privacy Policy or as required by applicable Malaysian law.

• Active Account Data: Your data will be retained for as long as your account remains active and you continue using SCR99's services, ensuring uninterrupted service continuity.
• Financial Transaction Data: Deposit, withdrawal, and betting transaction records are retained for a minimum of 7 years from the transaction date, as required by Malaysia's anti-money laundering laws.
• KYC Verification Data: Identity verification documents are retained for a minimum of 5 years following account closure to meet regulatory compliance requirements.
• Communication Data: Customer support chat logs are retained for 2 years for historical reference and dispute resolution purposes.
• Technical Data (Logs): System and security logs are retained for 90 days, and critical security audit logs are retained for 1 year.
• After Account Closure: Upon account closure, personal data that is no longer required will be deleted or anonymised within 30 days, except for data that must be retained for legal reasons as stated above.

Once the retention period ends, data is securely deleted using methods that ensure it cannot be recovered. Data that has been anonymised for analytical purposes can no longer be linked to your personal identity and is not subject to this personal data retention policy.

8Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by SCR99:

To exercise any of the above rights, submit a written request to the SCR99 privacy team by email at support@scr99.best with the subject line "Data Rights Request — [Your Username]". Include sufficient proof of identity so we can verify your request. SCR99 will respond within 21 business days and will not charge any fee for the first valid request within any consecutive 12-month period.

9Children's Privacy & Age Restrictions

The SCR99 platform is strictly for individuals aged 18 and above. SCR99 does not knowingly collect, process, or store personal data from individuals under the age of 18.

During registration, we require date of birth and MyKad number verification to confirm that every new member meets the minimum age requirement. Should SCR99 become aware or suspect that a member is under 18 years of age, the account will be suspended immediately and all collected data will be deleted within the applicable timeframe in accordance with our data deletion policy.

10Privacy Policy Amendments & How to Contact Us

SCR99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new Malaysian legal requirements, or updates to the SCR99 platform. The "Updated" date at the top of this document will reflect the date of the most recent amendment.

• For non-material amendments, we may update this document without prior notice.
• For material and significant amendments — particularly those affecting how we use or share your data — SCR99 will notify you by email or in-account notification at least 14 days before the changes take effect.
• Your continued use of the SCR99 platform after an amended Privacy Policy has been published will be considered acceptance of those changes.
• If you do not agree with the changes to the Privacy Policy, you have the right to close your account and request data deletion before the changes take effect.

For any enquiries, concerns, or requests relating to your data privacy at SCR99, please reach us through the following channels: