Privacy Policy — Gampak99

This Privacy Policy (the "Policy") is issued by Gampak99, the operator of the online gaming platform accessible at gampak99.cam (the "Platform"). References in this Policy to "Gampak99", "we", "us", or "our" refer to the Platform operator. References to "you", "your", or "the User" refer to any individual who accesses, browses, registers on, or otherwise interacts with the Platform.

Gampak99 is an English-language online gaming platform designed and operated for the Malaysian market. We are committed to protecting your personal data and respecting your privacy in accordance with applicable data protection legislation, including the Personal Data Protection Act 2010 of Malaysia (PDPA 2010) and any other applicable legal instruments.

This Policy explains what personal data Gampak99 collects from you, why we collect it, how it is processed and stored, with whom it may be shared, how long we retain it, and what rights you have in relation to your data. Please read this document carefully.

For the purposes of this Privacy Policy, the following terms shall carry the meanings assigned to them below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data — including name, national identity number (MyKad), email address, mobile number, IP address, payment details, and device identifiers.
• "Processing" means any operation performed on Personal Data, whether automated or manual — including collection, recording, storage, retrieval, use, disclosure, alteration, combination, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, Gampak99.
• "Data Processor" means any third party that processes Personal Data on behalf of and under the instructions of Gampak99.
• "Cookies" means small text files placed on your device by the Platform when you access or browse gampak99.cam, used to recognise your device, preferences, and session state.
• "KYC" means Know Your Customer — the identity verification process through which Gampak99 confirms the identity and eligibility of registered Players.
• "Sensitive Personal Data" means categories of data requiring heightened protection under applicable law — including financial account details, identification documents, and data relating to criminal records or proceedings.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia and all subsidiary legislation, guidelines, and codes of practice issued thereunder.

Gampak99 acts as the Data Controller in respect of Personal Data collected through the Platform. As Data Controller, Gampak99 determines the purposes for which your Personal Data is collected and processed, and is responsible for ensuring that processing activities are conducted lawfully, fairly, and transparently in accordance with this Policy and applicable data protection law.

The Platform is operated in respect of Malaysian users, and Gampak99 acknowledges its obligations under the Personal Data Protection Act 2010 (Malaysia) with respect to the collection and processing of personal data belonging to individuals in Malaysia, including players located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions of the country.

For all data protection enquiries, access requests, or complaints, you may contact us using the details provided in Section 16 of this Policy.

Gampak99 collects the following categories of Personal Data from users of the Platform. We collect only the data that is necessary to fulfil the purposes described in this Policy.

Gampak99 collects Personal Data through the following means:

5.1 Direct Collection

Data you provide directly when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion. This includes all information submitted via registration forms, identity upload portals, and live chat interfaces on the Platform.

5.2 Automated Collection

Data collected automatically through your use of the Platform — including IP address, device identifiers, browser type, session activity, game and betting history, and navigation patterns. This data is collected through server logs, cookies, and similar tracking technologies as described in Section 9.

5.3 Third-Party Sources

In certain circumstances, Gampak99 may receive Personal Data about you from third parties, including:

• Payment Service Providers: Transaction confirmation and payment method verification data from channels such as Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Boost, GrabPay, and Hong Leong Bank;
• Identity Verification Services: Confirmation of identity document authenticity from accredited KYC service providers;
• Fraud Prevention Services: Risk scoring and device intelligence data from anti-fraud technology partners;
• Referral Partners: Basic registration information where a Player has been referred to the Platform through the gampak99 referral programme.

Gampak99 processes your Personal Data only where a lawful basis for doing so exists. Under the Personal Data Protection Act 2010 (Malaysia) and applicable international data protection frameworks, our processing activities are based on one or more of the following lawful grounds:

• Contractual Necessity: Processing that is required to perform the contract between you and Gampak99 — including Account registration, processing deposits and withdrawals, delivering gaming services, and administering bonuses.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations — including anti-money laundering (AML) requirements, counter-financing of terrorism (CFT) obligations, KYC verification, and regulatory reporting duties.
• Legitimate Interests: Processing undertaken for Gampak99's legitimate business interests, where those interests are not overridden by your fundamental rights — including fraud prevention, platform security, product improvement, and responsible gambling monitoring.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — including direct marketing communications and non-essential cookie placement. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Gampak99 processes your Personal Data for the following specific purposes:

7.1 Platform Operations

To operate and maintain your Account, process deposits and withdrawals in MYR, authenticate your identity at login, deliver gaming services, and administer the VIP loyalty programme.

7.2 Identity Verification & Compliance

To conduct KYC verification confirming your identity and age (21+), to comply with AML/CFT obligations, to screen transactions against sanctions and watchlists, and to report to regulatory authorities where required by law.

7.3 Customer Support

To respond to your support enquiries submitted via live chat, email, or WhatsApp; to investigate complaints; and to maintain records of support interactions for quality assurance and dispute resolution purposes.

7.4 Security & Fraud Prevention

To detect, investigate, and prevent fraudulent activity, unauthorised Account access, bonus abuse, money laundering, and other conduct in breach of our Terms and Conditions.

7.5 Responsible Gambling

To monitor for indicators of problem gambling behaviour, to enforce self-exclusion and self-limit tools selected by the Player, and to fulfil our responsible gambling obligations in accordance with our Responsible Gambling Policy.

7.6 Marketing Communications

To send you promotional communications about gampak99 bonuses, game updates, and relevant offers — where you have provided your consent or where we have a legitimate interest to do so. You may opt out of marketing communications at any time by contacting us at [email protected].

7.7 Platform Improvement

To analyse usage patterns, game performance, payment channel reliability, and user experience data in aggregate and anonymised form for the purpose of improving and optimising the Platform.

Gampak99 does not sell, rent, or commercially transfer your Personal Data to unaffiliated third parties for their own marketing purposes. Your Personal Data may be shared with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements and confidentiality obligations:

8.1 Service Providers & Data Processors

Third-party companies that process data on our behalf to provide essential platform services, including: payment processors (Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong), KYC and identity verification providers, fraud prevention and risk management services, cloud hosting infrastructure providers, and customer support platform operators. All such processors are bound by contractual obligations to process data only as instructed by Gampak99 and to maintain appropriate security standards.

8.2 Game Providers

Third-party game software providers may receive limited technical data (such as Player identifiers and bet values) that is necessary to deliver and settle the specific games you play on the Platform. Such data sharing is governed by our data processing agreements with each provider.

8.3 Legal & Regulatory Disclosure

Gampak99 may disclose your Personal Data to competent authorities, law enforcement agencies, courts, regulatory bodies, and government departments where we are required or permitted to do so by applicable law — including for the purposes of AML/CFT compliance, fraud investigation, tax reporting, or the enforcement of legal rights.

8.4 Business Transfers

In the event that Gampak99 undergoes a merger, acquisition, restructuring, or sale of assets, your Personal Data may be transferred to the successor entity, subject to the same or equivalent data protection standards set out in this Policy. We will notify you of any such transfer where required by applicable law.

Gampak99 uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, maintain your login session, and collect aggregate usage analytics. By continuing to use the Platform following acceptance of this Policy, you consent to our use of cookies as described below.

9.1 Types of Cookies Used

9.2 Managing Cookies

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Please note that disabling essential cookies may impair the functionality of the Platform, including login and payment processing. As this Platform is designed for authenticated, registered users, many core features require essential cookies to operate correctly.

Gampak99 retains your Personal Data for as long as is necessary to fulfil the purposes described in this Policy, to maintain your Account relationship with us, and to comply with our legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, your Personal Data will be securely deleted or anonymised such that it can no longer be associated with your identity. Where data is retained in anonymised, aggregated form for statistical or analytical purposes, it is no longer considered Personal Data and is not subject to these retention limits.

Gampak99 implements comprehensive technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. Our key security measures include:

• Transport Layer Security: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS protocols, consistent with the encryption standards employed by major Malaysian financial institutions.
• Data Encryption at Rest: Sensitive Personal Data stored on our systems — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to Personal Data is restricted to authorised Gampak99 personnel and service providers on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Password Security: User passwords are stored exclusively in hashed, salted form. Plaintext passwords are never stored or transmitted by our systems.
• Fraud Detection Systems: Automated fraud monitoring and anomaly detection systems continuously monitor Account activity for indicators of unauthorised access or suspicious behaviour.
• Incident Response: Gampak99 maintains a documented data breach response procedure. In the event of a security incident that affects your Personal Data, we will notify you and relevant authorities as required by applicable law.

Subject to applicable law and any overriding legal obligations that may limit the exercise of certain rights, you have the following rights in relation to your Personal Data held by Gampak99. These rights are exercisable by contacting us using the details in Section 16.

The Gampak99 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data belonging to any person under the age of 21. The Platform employs age verification procedures through the KYC process to enforce this restriction.

If Gampak99 becomes aware — through any means — that Personal Data belonging to an individual under the age of 21 has been collected, we will immediately suspend the relevant Account, void any associated transactions, delete the Personal Data in question, and take such further action as is required under applicable law.

Gampak99 is an online platform that may engage service providers located in jurisdictions outside of Malaysia. Where your Personal Data is transferred to a country outside Malaysia — including for cloud hosting, payment processing, or KYC verification purposes — we ensure that such transfers are conducted under appropriate legal safeguards, including:

• Contractual clauses that impose PDPA-equivalent data protection obligations on the receiving party;
• Transfer only to jurisdictions that have been assessed as providing an adequate level of data protection;
• Implementation of technical security measures equivalent to those applied to data processed within Malaysia.

Gampak99 will not transfer your Personal Data to a third country unless appropriate safeguards are in place as described above. Where required, Gampak99 will obtain your consent before conducting cross-border data transfers.

Gampak99 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services offered on the Platform. The effective date at the top of this Policy will be updated to reflect any material changes.

Where changes are material — meaning they significantly affect how your Personal Data is used or your rights in relation to it — Gampak99 will provide advance notice via the email address registered to your Account and/or via a prominent notification on the Platform prior to the changes taking effect.

Your continued use of the Platform following the publication of any amendment constitutes your acceptance of the revised Policy. It is your responsibility to review this Policy periodically. The current version is always available at gampak99.cam/privacy-policy.

For all privacy-related enquiries — including data access requests, correction requests, erasure requests, marketing opt-out requests, or complaints regarding our data practices — please contact the Gampak99 team using the details below. We will acknowledge your request within five (5) business days and aim to provide a substantive response within ten (10) business days.

• General & Privacy Enquiries: [email protected]
• Responsible Gaming & Self-Exclusion: [email protected]
• Live Chat Support: Available 24/7 via the Platform — average response time 3–5 minutes

When submitting a data request, please provide your full name, registered email address, and a clear description of the nature of your request to enable us to process it efficiently. We may request additional identity verification before fulfilling certain requests to prevent unauthorised disclosure of your data.

If you are dissatisfied with our response to any privacy concern, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction — in Malaysia, the Department of Personal Data Protection (PDPD) under the Ministry of Digital.