Privacy Policy

This Privacy Policy ("Policy") sets out how DN99 ("DN99", "we", "us", "our"), the operator of the online gambling platform at https://dn99.casa ("Platform"), collects, uses, stores, discloses, and protects the personal data of individuals who register for or use our services ("Users", "Players", "you").

DN99 recognises the importance of personal data privacy and is committed to maintaining the trust of all users — including the hundreds of thousands of Malaysian players who access our Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across the country. We process personal data in accordance with applicable data protection legislation and the principles of transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability.

By creating an account, accessing the Platform, or submitting personal data to DN99 through any channel, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• "Data Controller" means DN99, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party engaged by DN99 to process personal data on DN99's behalf, pursuant to a binding data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their personal data for a stated purpose.
• "KYC" means Know Your Customer, the regulatory identity verification process required of licensed online gambling operators prior to releasing certain account features or processing withdrawals above threshold amounts.
• "Cookies" means small text files stored on a User's device by a web browser, used to record session information, preferences, and browsing behaviour on the Platform.
• "Sensitive Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health or medical information, or biometric data, which warrants a heightened level of protection.

DN99 collects personal data through several channels: information you provide directly during account registration and KYC; information generated automatically through your use of the Platform; and, in limited circumstances, information received from third-party service providers such as payment processors and KYC verification partners.

3.1 Information You Provide Directly

• Account Registration: Full legal name, date of birth, gender, nationality, residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru), email address, and mobile phone number.
• KYC Verification: Copies of government-issued photo identification (Malaysian MyKad, Driver's Licence, or Passport), proof of residential address (utility bill or bank statement issued within 3 months), and selfie images provided for identity confirmation.
• Payment Details: Payment method identifiers used for deposits and withdrawals, including e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay), bank account details for FPX and DuitNow transfers, and card metadata (last four digits, expiry month/year — full card numbers are never stored by DN99).
• Communications: Content of any support tickets, live chat transcripts, or email correspondence you send to or receive from DN99's support team.
• Responsible Gambling Preferences: Deposit limits, self-exclusion requests, session time settings, and other responsible gambling configurations you apply to your account.

3.2 Automatically Collected Information

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers, and time zone settings.
• Usage Data: Pages visited, game sessions played (including game type, duration, wager amounts, and outcomes), login timestamps, navigation patterns within the Platform, and feature usage statistics.
• Location Data: Approximate geographic location derived from your IP address, used for fraud detection, regulatory compliance (geo-blocking), and responsible gambling assessments. We do not collect precise GPS coordinates unless expressly authorised by you.
• Cookie and Tracking Data: Session cookies, persistent cookies, and pixel tags as detailed in Section 7 (Cookies & Tracking) below.

3.3 Information from Third Parties

• Payment Processors: Transaction confirmation data and fraud risk scores from payment service providers (e.g., DuitNow, FPX network, e-wallet providers).
• KYC Verification Partners: Identity verification results, document authenticity scores, and watchlist screening outcomes from our regulated KYC service providers.
• Fraud & AML Systems: Risk assessment data from third-party anti-money laundering screening databases used to fulfil our regulatory obligations.

DN99 processes your personal data for the following purposes. Each processing activity is tied to a specific legal basis, as detailed in Section 5 below.

• Account Management: Creating, maintaining, securing, and administering your DN99 account, including authenticating your identity at login and during sensitive transactions.
• KYC & Identity Verification: Verifying your identity and age (minimum 21 years) in compliance with applicable regulatory and anti-money laundering requirements before enabling full platform functionality and processing withdrawal requests.
• Payment Processing: Facilitating deposits and withdrawals through your chosen Malaysian payment methods (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Connect, and others) and maintaining accurate transaction records.
• Service Provision & Personalisation: Delivering the games, sports betting markets, promotions, and platform features you use; personalising your platform experience based on your preferences and usage history.
• Customer Support: Responding to your queries, resolving complaints, processing account changes, and managing live chat and email communications.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, money laundering, underage gambling, and other prohibited activities on the Platform.
• Responsible Gambling: Monitoring gameplay patterns to identify indicators of problem gambling behaviour; administering deposit limits, self-exclusion requests, and cooling-off periods; contacting players where responsible gambling concerns are identified.
• Legal & Regulatory Compliance: Maintaining records as required by our gaming licence conditions, anti-money laundering (AML) regulations, and other applicable laws; responding to lawful requests from regulatory authorities and law enforcement.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform news where you have consented to receive such communications, or where we have a legitimate interest in doing so subject to your right to opt out at any time.
• Analytics & Platform Improvement: Analysing aggregated and anonymised usage data to improve the Platform's performance, functionality, and user experience.

DN99 processes your personal data on the following legal bases under applicable data protection law:

• Contractual Necessity: Processing required to perform the contract between you and DN99 — including account creation, KYC verification, payment processing, and service delivery. Without this processing, DN99 cannot provide its services to you.
• Legal Obligation: Processing necessary to comply with our obligations under applicable gaming licensing conditions, anti-money laundering (AML) regulations, financial reporting requirements, and other mandatory legal frameworks.
• Legitimate Interests: Processing conducted in pursuit of DN99's legitimate business interests, including fraud prevention, platform security, system analytics, and service improvement — provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your specific, freely given consent, including the use of non-essential cookies and the sending of direct marketing communications. You may withdraw your consent at any time by contacting us or adjusting your account settings, without affecting the lawfulness of processing carried out prior to withdrawal.

DN99 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to binding data protection obligations:

• Payment Service Providers: Financial institutions, e-wallet operators (Touch 'n Go, Boost, GrabPay), and payment networks (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong) to facilitate your deposits and withdrawals.
• KYC & Identity Verification Providers: Regulated third-party identity verification services engaged to authenticate your identity and screen against AML and sanctions watchlists, as required by our licensing obligations.
• Fraud Detection & Security Partners: Third-party risk management and fraud prevention systems that assist DN99 in detecting suspicious activity, preventing unauthorised account access, and maintaining platform integrity.
• Technology & Infrastructure Providers: Cloud hosting providers, database management services, analytics platforms, and content delivery networks that support the technical operation of the Platform, all bound by strict data processor agreements.
• Customer Support Tools: Live chat platform providers and helpdesk software vendors used to deliver our 24/7 customer support service.
• Regulatory & Law Enforcement Authorities: Competent regulatory authorities, licensing bodies, financial intelligence units, and law enforcement agencies where disclosure is required by law, court order, or regulatory mandate.
• Professional Advisers: Legal, accounting, and auditing professionals bound by professional confidentiality obligations, where disclosure is necessary for the operation or defence of DN99's legal rights.

DN99 uses cookies and similar tracking technologies to operate and improve the Platform, analyse user behaviour, and personalise your experience. By continuing to use the Platform after being presented with our cookie notice, you consent to the use of cookies as described in this section.

The following categories of cookies are used on the DN99 Platform:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session authentication tokens, security cookies, and preferences required to maintain your logged-in state across page navigations.
• Performance & Analytics Cookies: These cookies collect anonymised information about how Users interact with the Platform — pages visited, game categories accessed, time spent on each section — to help DN99 improve functionality and user experience.
• Functional Cookies: These cookies remember your preferences and settings, such as language selection, responsible gambling limit configurations, and display preferences, so that you do not need to re-enter them on each visit.
• Fraud Prevention Cookies: Cookies used by our fraud detection systems to identify unusual patterns of activity associated with account takeover attempts, multi-accounting, or other security threats.

You may manage non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform, including your ability to remain logged in or access certain features. Strictly necessary cookies cannot be disabled without affecting core platform operations.

DN99 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Active Account Data: Personal data associated with an active DN99 account is retained for the duration of the account relationship and for a period of five (5) years following account closure, to satisfy AML record-keeping obligations and potential legal claims.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following the termination of the account relationship, in accordance with anti-money laundering regulatory requirements.
• Transaction Records: Financial transaction records (deposits, withdrawals, wager history) are retained for a minimum of five (5) years following the date of each transaction, or for such longer period as required by applicable law.
• Support Communications: Customer support correspondence is retained for three (3) years from the date of the last interaction, for quality assurance, dispute resolution, and compliance audit purposes.
• Marketing Consent Records: Records of your marketing preferences and consent history are retained for three (3) years from the date you last updated your preferences or closed your account, whichever is later.
• Technical & Log Data: Server logs and technical access records are retained for twelve (12) months unless there is a legitimate security or legal reason to retain them for longer.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with DN99's internal data disposal procedures. Where data cannot be immediately deleted due to technical constraints, it is isolated and restricted from further processing until deletion is completed.

DN99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• Transport Encryption: All data transmitted between your device and the DN99 Platform is encrypted using TLS 1.2 or higher (HTTPS). You can verify this by checking for the padlock icon in your browser's address bar.
• Data-at-Rest Encryption: Personal data and financial records stored on DN99's servers are encrypted at rest using AES-256 encryption or equivalent.
• Access Controls: Access to personal data within DN99's systems is restricted on a strict need-to-know basis. All staff access is authenticated using multi-factor authentication (MFA) and is logged for audit purposes.
• Regular Security Audits: DN99's infrastructure undergoes regular third-party penetration testing and security audits to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: DN99 maintains a documented data breach response procedure. In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, DN99 will notify you and the relevant regulatory authority as required by applicable law.
• Employee Training: All DN99 staff who handle personal data receive mandatory data protection and security awareness training as part of their onboarding and on an annual refresher basis.

Subject to applicable law, you hold the following rights in respect of the personal data that DN99 holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request — [Right Type]". We will respond within 30 calendar days of receiving a verified request.

• Right of Access: You have the right to request a copy of all personal data DN99 holds about you, together with information about how it is being processed. This is commonly referred to as a Subject Access Request (SAR).
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may also update certain information directly through your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, you withdraw consent, or you object to processing. Note that certain data must be retained for legal and regulatory compliance reasons and cannot be erased on request alone.
• Right to Restriction of Processing: You may request that DN99 restrict processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to the processing of your personal data where such processing is carried out on the basis of legitimate interests. DN99 will cease such processing unless there are compelling legitimate grounds that override your interests or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. For marketing communications, you may opt out via the unsubscribe link in any marketing email or by contacting our support team.

The DN99 Platform is strictly restricted to individuals who are at least 21 years of age. DN99 does not knowingly collect, store, or process personal data from any person under the age of 21. Our account registration process includes age declaration requirements and KYC age verification procedures to prevent underage access.

If DN99 becomes aware that personal data has been collected from a person under the age of 21 without parental or guardian consent, we will immediately close the associated account, refund any deposits to the originating payment method, and delete all personal data collected from that individual in accordance with our internal data disposal procedures.

If you believe that a minor has registered an account on the DN99 Platform or that we may hold personal data relating to a person under the age of 21, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

DN99 operates a globally distributed technical infrastructure. As a result, your personal data may be transferred to, stored in, or processed in countries outside Malaysia, including countries whose data protection laws may differ from those applicable in Malaysia.

Where such transfers occur, DN99 implements appropriate safeguards to ensure that your personal data is afforded a comparable level of protection to that which applies in Malaysia. These safeguards include:

• Data processing agreements with standard contractual clauses approved by applicable regulatory bodies, where required.
• Transfer impact assessments to evaluate the adequacy of data protection in the recipient jurisdiction and to implement supplementary safeguards where necessary.
• Ensuring that third-party processors engaged in countries outside Malaysia are bound by equivalent data protection obligations as those applicable in Malaysia.

By using the DN99 Platform and submitting personal data, you acknowledge that your personal data may be transferred and processed in other jurisdictions as described in this Policy. If you have concerns about cross-border transfers, please contact us for further information.

DN99 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. When material changes are made to this Policy, DN99 will provide notice to registered Players via email notification or a prominent Platform announcement, where practicable.

The "Last Updated" date displayed at the top of this Policy reflects the date on which the most recent revision was published. The most current version of this Policy will always be accessible at https://dn99.casa/privacy-policy. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms.

We encourage you to review this Policy periodically to stay informed about how DN99 protects your personal data. If you have any concerns about any amendment, please contact us before continuing to use the Platform.

If you have any questions, concerns, or complaints regarding this Privacy Policy, DN99's data processing practices, or the exercise of your data rights, please contact our Data Protection team through any of the following channels:

• Email: Write to us at [email protected] with the subject line "Privacy Policy Query" or "Data Rights Request — [Right Type]". We aim to acknowledge all privacy-related correspondence within 24 hours and provide a substantive response within 30 calendar days.
• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the DN99 Platform. For formal data rights requests, we recommend using email to ensure a documented record of your request.

Where you are unsatisfied with our response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.