Clu99 Privacy Policy – Malaysian Player Data Protection

This Privacy Policy is issued by clu99 and applies to all users of the clu99 platform accessible at clu99.best. This document explains how clu99 collects, processes, stores and protects your personal data in our capacity as data controller.

Clu99 is committed to protecting the privacy and security of every Malaysian player's personal information on our platform. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and all relevant data protection regulations in the course of our operations.

This policy covers all services offered by clu99, including slots, live casino (baccarat, blackjack, roulette, dragon tiger, sic bo), Sports Betting, online lottery and all account functions such as deposits, withdrawals and the VIP programme. It also covers all communications between you and the clu99 team across all channels, including live chat, email and phone support.

Clu99 collects various types of personal data in the course of its operations. This data is collected either directly from you, automatically through your use of the platform, or from authorised third parties. The main categories of data we collect are as follows:

Clu99 applies the principle of data minimisation – we only collect data that is genuinely necessary for the stated purposes and do not gather data that is excessive or irrelevant to platform operations.

Clu99 uses the personal data we collect solely for legitimate purposes directly related to platform operations. Every use of your data is grounded in a solid legal basis as outlined in Section 4 of this policy. The primary purposes for which we use your data are as follows:

• Account operations: Creating and managing your clu99 account, enabling secure login, managing account settings and processing account-related requests.
• Financial transaction processing: Processing deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX (Maybank2u, CIMB Clicks), as well as processing withdrawals to registered payment accounts within 3 minutes.
• Identity verification (KYC): Verifying that you meet eligibility requirements including the minimum age of 18, confirming your identity for account security, and satisfying anti-money laundering (AML) requirements.
• Fraud prevention: Identifying and preventing duplicate accounts, unauthorised access, suspicious transactions and platform abuse.
• Customer support: Responding to enquiries, resolving complaints and providing technical support via 24/7 live chat or email.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and sending appropriate alerts to players who may need support.
• Platform improvements: Analysing aggregated, anonymised usage data to improve the performance, interface design, and overall user experience of the clu99 platform.
• Marketing communications: Sending information about relevant clu99 promotions, bonuses, and offers — only to players who have given their consent to receive such communications.
• Legal compliance: To fulfill legal and regulatory obligations applicable to clu99's operations, including mandatory reporting requirements to relevant authorities where required.

Clu99 only processes your personal data on a valid legal basis. There are four primary bases we rely on when processing personal data for Malaysian players:

• Contract performance: Processing required to provide the clu99 services you have requested – including account operations, payment processing, and game management. Without this processing, we are unable to provide services to you.
• Legitimate interests: Processing based on clu99's legitimate interests where those interests do not override your fundamental rights and freedoms — for example, fraud prevention, platform security, and service improvement. We always weigh our interests against your right to privacy.
• Legal obligations: Processing required to comply with applicable laws, including Malaysia's PDPA, anti-money laundering requirements and directions from competent authorities.
• Your consent: For marketing communications and certain uses not covered by the three bases above, clu99 will obtain your explicit consent beforehand. You have the right to withdraw this consent at any time without affecting your access to clu99 services.

Clu99 does not sell, rent or trade player personal data to any third party for marketing purposes. Data sharing only occurs in the following limited situations and with appropriate safeguards in place:

• Authorised service providers: clu99 shares necessary data with service providers that help us operate the platform – including game providers (Evolution Gaming, Pragmatic Play Live, SA Gaming, Sexy Gaming), payment processors for Malaysia e-wallet transactions, and technical infrastructure providers. All these providers are bound by strict data protection agreements and are prohibited from using your data for any purpose other than delivering the contracted services.
• Legal authorities: clu99 may be required to disclose personal data to government authorities or regulatory bodies when mandated by law, court order, or valid official request. In such circumstances, clu99 will notify you if permitted by law to do so.
• Crime prevention: In cases where there is reasonable belief that disclosure of data is necessary to prevent crime, protect public safety or safeguard the rights, property or security of clu99, its players or the general public.
• Business restructuring: If clu99 is involved in a merger, acquisition, or asset sale, player data may be transferred as part of that transaction. You will be notified in advance, and your rights under this policy will remain fully protected.

Clu99 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, damage, or accidental disclosure. These measures include:

• Data encryption in transit: All data transmitted between your device and clu99's servers is protected by TLS 1.3 protocol and 256-bit SSL encryption – intercepted data cannot be read without the correct decryption key.
• Encryption of data at rest: Sensitive data including payment information and identification numbers is stored in encrypted form within clu99's database. Even in the event of unauthorised server access, sensitive data remains unreadable.
• Strict access controls: Access to player data within clu99's internal systems is restricted to staff who require it to perform their duties only. All access is logged and audited on a regular basis.
• Two-factor authentication: Players can enable two-factor authentication (2FA) on their clu99 account for an added layer of security. clu99 recommends that all players activate this feature.
• Continuous threat monitoring: clu99's security monitoring system operates 24 hours a day to detect and respond to suspicious activity, intrusion attempts, and other security threats in real time.
• Regular penetration testing: clu99 conducts regular security testing and audits carried out by independent third-party security experts to identify and address vulnerabilities before they can be exploited.

Clu99 only retains your personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our data retention policy is as follows:

• Active account data: For the duration your clu99 account remains active, and for 5 years after account closure for audit, dispute resolution, and legal compliance purposes.
• Financial transaction records: Minimum 7 years from the transaction date, in line with Malaysia's financial and anti-money laundering legal requirements.
• Support communication records: 3 years from the date of last interaction, for quality control purposes and to resolve any disputes that may arise.
• Cookie & analytics data: Between 30 days and 2 years depending on the type of cookie used — further details are provided in Section 9 of this policy.
• Identity verification (KYC) data: Identity verification documents are retained for 5 years after the business relationship ends, in line with Malaysia's AML legal requirements.

Once the relevant retention period has expired, your personal data will be securely deleted or anonymised so that it can no longer be linked to your identity. clu99 conducts periodic data retention reviews to ensure that data no longer required is deleted in a timely manner.

As a clu99 player and an individual protected under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding the personal data we hold about you:

• Right of access: You have the right to request a copy of the personal data clu99 holds about you. clu99 will provide this data in a readable format within 14 working days of receiving your request.
• Right to rectification: If the personal data we hold is inaccurate or out of date, you have the right to request a correction. Basic profile information can be updated directly through your clu99 account settings. For changes to sensitive information, please contact our support team.
• Right to erasure: Under certain circumstances, you have the right to request the deletion of your personal data. This is subject to clu99's legal obligations to retain certain records – we will inform you if any part of a deletion request cannot be fulfilled and explain why.
• Right to restriction of processing: You have the right to request that we restrict how we process your data in certain circumstances — for example, while we investigate the accuracy of data you have disputed.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time. You may also object to processing based on our legitimate interests if you have compelling grounds relating to your particular situation.
• Right to data portability: You have the right to receive the personal data you have provided to clu99 in a structured, machine-readable format, so that you may transfer it to another data controller if you wish.

To exercise any of the rights above, contact the clu99 data protection team by email at support@clu99.best with the subject line "Personal Data Rights Request". Include your account number and the specific right you wish to exercise. We will acknowledge receipt of your request within 24 hours and provide a full response within 14 working days.

Clu99 uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you browse the clu99 website. The following are the types of cookies we use:

• Essential cookies (required): These cookies are required for the core functionality of the clu99 platform – including login sessions, account security, and gaming features. Without them, the platform will not function properly. These cookies do not require your consent and cannot be disabled.
• Performance & analytics cookies: These cookies help us understand how players interact with the clu99 platform – which pages are visited most, time spent on the platform, and any technical issues encountered. This data is used in aggregate, anonymised form to improve the platform. You can disable these cookies without affecting core platform functionality.
• Preference cookies: These cookies remember your preferences on the clu99 platform — such as language, display settings, and game choices — so you don't have to reconfigure them every time you log in. You can disable these cookies, but the platform may not retain your preferences between sessions.
• Marketing cookies: These cookies are only used with your consent to display relevant clu99 promotions and advertisements. You may withdraw this consent at any time through the cookie settings on the platform or in your browser settings.

Clu99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the way we operate the platform. The updated policy will be published on this page with a clear amendment date.

• Material amendment notice: For significant changes to the way we process your data, clu99 will send a notice to the email address registered on your account at least 30 days before the changes take effect.
• Periodic review: clu99 recommends that players review this Privacy Policy periodically to stay informed of our latest privacy practices. The "Updated" date at the top of this page will reflect the most current version.
• Continued use: Continued use of the clu99 platform after an amendment notice has been sent will be considered acceptance of those amendments. If you do not agree with the changes, you have the right to close your clu99 account before they take effect.

For any questions, concerns, or requests relating to this Privacy Policy or how clu99 handles your personal data, please contact us via:

• Email: support@clu99.best (email subject: "Data Privacy Enquiry")
• Live chat: Directly through the clu99 platform – available 24 hours a day