Privacy Policy GMP99 – Malaysia Player Personal Data Protection

1Introduction & Scope of Privacy Policy

GMP99 respects your privacy. This document is the official GMP99 Privacy Policy, which explains in detail how we manage the personal data you provide to us when using our online betting platform at gmp99.best.

This Privacy Policy applies to:

• All visitors to the GMP99 website, whether registered or not.
• All registered members with an active account at GMP99.
• All users who interact with GMP99 via live chat, email or WhatsApp.
• All financial transactions processed through the GMP99 platform, including deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow and Malaysian FPX banking.

GMP99 acts as the data controller responsible for processing your personal data in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010 and all regulations made thereunder.

We review and update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the technologies we use. The latest version is always available on this page.

2Personal Data We Collect

GMP99 only collects personal data that is strictly necessary to provide our services. Below are the categories of data we collect and their sources:

Data you provide directly:

• Full name as stated on your MyKad or passport.
• Date of birth for age verification (must be 21 years of age or older).
• An active Malaysian phone number.
• A valid email address.
• The username and password chosen during registration.
• Identity verification documents (MyKad, passport) submitted during the KYC process.
• Payment method information — however, we do not store bank account numbers or card details directly; these are processed by certified payment gateways.

Data collected automatically during use:

• IP address and device information (operating system, browser type, screen resolution).
• Platform usage data — games played, session duration, betting history, and transaction records.
• Approximate location data based on IP address for geographic zone verification.
• Technical logs including access times, pages visited and errors encountered.
• Cookie and tracking technology data — explained further in Section 9.

Data from third parties:

• Verification information from the KYC service providers we use to confirm your identity.
• Transaction verification information from payment gateway providers such as Touch 'n Go and DuitNow operators.
• Fraud prevention information from the security service providers we work with.

3How We Use Your Personal Data

GMP99 uses the personal data we collect for clear and legitimate purposes. The table below outlines how your data is used and the legal basis for each purpose:

GMP99 will not use your personal data for any purpose other than those stated above without first obtaining your additional consent.

4Legal Basis for Data Processing

Under Malaysia's PDPA 2010, GMP99 processes your personal data on one or more of the following legal bases:

• Consent: For direct marketing activities and promotional communications — you may withdraw this consent at any time by updating your preferences in your account settings or by contacting our support team.
• Contract Performance: Data required to provide the GMP99 services you signed up for — including payment processing, game access, and customer support.
• Legal Obligation: Processing required under Malaysian law — including age verification, KYC, anti-money laundering compliance (AMLA), and reporting to the relevant authorities where required by a court order or valid regulatory directive.
• Legitimate Interests: Processing that is necessary for GMP99's legitimate business interests — such as fraud detection, platform security, business analytics and service improvement — provided these interests do not override your fundamental rights and freedoms.

GMP99 conducts regular balancing assessments to ensure that processing based on legitimate interests does not override your rightful privacy protection interests.

5Sharing Data with Third Parties

GMP99 applies a "minimum sharing" principle in all third-party data dealings. We does not sell, rent, or trade your personal data to any party for their own marketing purposes.

We share your personal data only in the following circumstances:

• Service Providers: Companies we engage to help operate the platform — including gaming software providers (Pragmatic Play, Evolution Gaming, PG Soft), payment gateway providers for processing Touch 'n Go, GrabPay, Boost, ShopeePay, and DuitNow transactions, as well as KYC service providers. All third parties are bound by strict confidentiality agreements and may only use your data for the specified purposes.
• Legal Requirement: Disclosure to Malaysian authorities — including the police, courts, or financial regulatory bodies — where required by a valid court order, applicable law, or an official investigation into financial crime, money laundering, or fraud.
• Rights Protection: Where disclosure is necessary to protect the rights, property, or safety of GMP99, our members, or the public — for example, in cases of suspected fraud or a serious security threat.
• Business Transfers: In the event of a merger, acquisition, or asset sale involving GMP99, user data may be transferred as part of that transaction — with prior notice given to you and continued privacy protections maintained.

6Data Security Measures

GMP99 continuously invests in security infrastructure to protect our members' personal data. The security measures we have in place include:

• Encryption in Transit: All communications between your browser or app and GMP99's servers are encrypted using TLS 1.3 with a 256-bit SSL certificate. You can verify this by checking the padlock icon in your browser's address bar.
• Stored Data Encryption: Sensitive data stored in GMP99's databases — including passwords (hashed using bcrypt) and identity information — is encrypted using AES-256.
• Strict Access Controls: Only GMP99 employees with a legitimate work need may access user data, and only the data relevant to their role. All access is logged and regularly audited.
• Two-Factor Authentication (2FA): GMP99 offers 2FA for all member accounts and requires 2FA for all internal administrative access.
• 24/7 Threat Monitoring: Intrusion detection systems (IDS) and security log monitoring operate continuously to identify suspicious activity.
• Regular Penetration Testing: GMP99 engages independent cybersecurity firms to conduct penetration testing at least once a year to identify and address vulnerabilities before they can be exploited.
• Secure Data Backup: Critical data is regularly backed up to geographically separate locations to ensure service continuity in the event of a technical emergency.

Although GMP99 takes all reasonable steps to protect your data, no security system is foolproof. We encourage you to also take responsibility by keeping your password secure and enabling 2FA in your account settings.

7Data Retention Period

GMP99 retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy or as required by Malaysian law. Our data retention policy is as follows:

Once the specified retention period has elapsed, your personal data will be securely deleted or fully anonymised so that it can no longer be linked to you.

8Your Rights Under Malaysia's PDPA 2010

As a data subject under Malaysia's PDPA 2010, you have the following rights regarding your personal data held by GMP99:

To exercise any of the rights above, please contact GMP99's Privacy Officer at privacy@gmp99.best by stating the right you wish to exercise and your identifying information. GMP99 will process your request within 14 business days from the date the request is received. No fee is charged for the first request of each type within any 12-month period.

If you are dissatisfied with how GMP99 handles your personal data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) under the Ministry of Communications and Digital.

9Cookies & Tracking Technologies

GMP99 uses cookies and similar tracking technologies to enhance your experience on our platform and ensure it functions properly. The following are the types of cookies we use:

• Essential Cookies (Required): Required for the platform's core functions — including login session verification, account security, and transaction processing. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information on how visitors use our platform — such as the most frequently visited pages and error messages received. All information is collected in aggregate and anonymised form.
• Functional Cookies: Allows the platform to remember your preferences — such as your preferred language, display settings, and game choices — to deliver a more personalised experience.
• Analytics Cookies: Helps us understand overall platform usage patterns for continuous improvement. Analytics data is not linked to your personal identity.

You can manage and delete cookies through your browser settings. However, disabling essential cookies may affect certain functions of the GMP99 platform. For more information on managing cookies in your browser, please refer to the Help section of the browser you are using.

GMP99 does not use third-party cross-site tracking technologies for targeted advertising purposes.

10Cross-Border Data Transfers

In operating the GMP99 platform, your personal data may be processed by service providers operating outside Malaysia — including international gaming software suppliers and cloud infrastructure providers.

When cross-border data transfers occur, GMP99 ensures:

• The recipient country provides an adequate level of data protection, or
• Appropriate data transfer agreements have been put in place with recipient parties, incorporating standard data protection clauses equivalent to Malaysia's PDPA, or
• Your explicit consent has been obtained for specific transfers.

Such data transfers are limited strictly to what is necessary to provide GMP99's services to you and do not occur for third-party marketing or commercial purposes.

11Protection of Children & Young Persons

GMP99 does not provide services to individuals under the age of 21. Our platform is not designed for, and does not knowingly collect data from, minors.

As a protective measure, GMP99 implements:

• Mandatory age verification at registration using date of birth and official identification documents.
• Ongoing monitoring by our security systems to identify potential account use by underage individuals.
• Immediate account closure procedure if the account holder is suspected or confirmed to be under 21 years of age.

If you believe that a minor has registered for or is using the GMP99 platform, please notify us immediately at support@gmp99.best so that appropriate action can be taken promptly.

12Changes to This Privacy Policy

GMP99 reviews and updates this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements to how we operate.

When we make significant changes to this Privacy Policy:

• We will update the "Last Updated" date at the top of this page.
• For significant changes — particularly those affecting your privacy rights or how we use your data — we will send a notification to your registered email address at least 14 days before the changes take effect.
• In-platform notifications will also be displayed upon login to ensure you are aware of any important changes.

Continued use of the GMP99 platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and withdraw all funds before they take effect.

13Contact GMP99's Privacy Officer

GMP99 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with this Privacy Policy and handling all privacy-related enquiries from our members.

For any enquiries, complaints, or requests relating to privacy and personal data, please contact:

• Privacy Email: privacy@gmp99.best — for official requests relating to data rights (access, correction, deletion, etc.)
• General Support Email: support@gmp99.best — for general enquiries about the Privacy Policy
• Live Chat: Available 24/7 on the GMP99 platform for general enquiries

GMP99 is committed to responding to all privacy enquiries within 3 business days and resolving data rights requests within 14 business days of receipt.

For complaints that GMP99 is unable to resolve to your satisfaction, you have the right to refer the matter to the Department of Personal Data Protection Malaysia (JPDP) under the Ministry of Communications and Digital.