Privacy Policy — SC99

SC99 ("we", "us", "the Company", or "SC99") is the operator of the online gaming and sports betting platform accessible at sc99.cam. As a platform serving registered players across Malaysia — including users Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — we recognise that the privacy and security of your personal data are fundamental to the trust you place in us.

This Privacy Policy (the "Policy") describes in detail how SC99 collects, receives, uses, stores, shares, and otherwise processes personal data relating to individuals who visit, register on, or otherwise interact with the SC99 platform (collectively, "Platform Users", "Players", or "you").

This Policy should be read in conjunction with SC99's Terms & Conditions and our Responsible Gambling Policy, both of which are available on this platform. This Policy applies solely to data processed in connection with your use of the SC99 platform and does not apply to third-party websites or services to which we may occasionally refer.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, a living individual who can be identified directly or indirectly by reference to that information, including by name, identification number, location data, or online identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, recording, storage, adaptation, retrieval, use, disclosure, or erasure.
• "Data Controller" means SC99, the entity that determines the purposes and means of the Processing of your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of SC99 under a data processing agreement.
• "Consent" means any freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data.
• "KYC" means Know Your Customer — the identity and address verification process required before withdrawals are processed.
• "Platform" means the SC99 website at sc99.cam, its subdomains, and any associated mobile applications or interfaces.

SC99 collects personal data through your interactions with the Platform. The categories of data we collect include, but are not limited to, the following:

SC99 collects personal data through the following channels and mechanisms:

4.1 Direct Collection

Data you actively provide to SC99 when you: (a) register a new account on the Platform; (b) complete the KYC identity verification process; (c) make a deposit or request a withdrawal through any of our supported Malaysian payment methods, including Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost eWallet, GrabPay, DuitNow, or FPX; (d) contact our customer support team via live chat, email, or any other communication channel; (e) participate in promotions, competitions, or surveys; or (f) update your account profile or preferences.

4.2 Automated Collection

Data collected automatically as you interact with the Platform, including via cookies, web beacons, pixel tags, log files, and similar tracking technologies. This includes technical data such as your IP address, browser type, referring URLs, pages visited, time spent on the Platform, and session identifiers. See Section 10 (Cookies & Tracking) for further detail.

4.3 Third-Party Sources

SC99 may receive personal data about you from third-party sources where permitted by applicable law, including: identity verification service providers used to conduct KYC checks; fraud detection and anti-money laundering screening services; and payment processors who confirm transaction status and flag suspicious activity.

SC99 processes your personal data only for specified, explicit, and legitimate purposes. The table below sets out the primary purposes for which we process personal data and the corresponding data categories used for each:

SC99 processes personal data on the basis of one or more of the following lawful grounds:

• Contractual Necessity: Processing required to perform the contract between you and SC99 — specifically, providing the gaming and payment services to which you have subscribed by registering an account. This includes identity verification, processing transactions, and managing your account.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations, KYC regulatory requirements, and any order or direction issued by a competent regulatory authority or court.
• Legitimate Interests: Processing carried out in the pursuit of SC99's legitimate business interests where those interests are not overridden by your fundamental rights — including fraud prevention, platform security, responsible gambling monitoring, and business analytics.
• Consent: Where SC99 relies on your consent as the legal basis for processing — for example, for non-essential marketing communications — you have the right to withdraw that consent at any time by contacting us or using the opt-out mechanism in our communications. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

SC99 does not sell, rent, or otherwise transfer your personal data to third parties for commercial marketing purposes. We may, however, share your personal data with the following categories of recipients where necessary and proportionate to the purpose:

7.1 Service Providers & Data Processors

SC99 engages third-party service providers who process personal data on our behalf under contractual arrangements that impose data protection obligations consistent with this Policy. These include: payment processors and gateway providers (including those facilitating Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, and similar Malaysian payment channels); KYC and identity verification service providers; fraud detection and anti-money laundering technology providers; cloud hosting and IT infrastructure providers; and customer support technology vendors.

7.2 Legal & Regulatory Disclosure

SC99 may disclose personal data to competent governmental authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or a binding order from an authority with jurisdiction over SC99. SC99 will, where legally permissible, endeavour to notify affected Players of any such disclosure.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of SC99's business, personal data held by SC99 may be transferred to the acquiring entity or successor organisation. Players will be notified of any such transfer and the Privacy Policy applicable to their data following the transaction.

SC99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements.

8.1 Active Accounts

Personal data relating to active SC99 accounts is retained for the duration of the account relationship and for a period of not less than five (5) years following account closure, in order to satisfy our legal and regulatory record-keeping obligations, including anti-money laundering requirements.

8.2 KYC Documents

Identity and address verification documents submitted during the KYC process are retained for a minimum of five (5) years from the date of submission or the date of account closure, whichever is later, in accordance with applicable financial crime prevention regulations.

8.3 Transaction Records

Financial transaction records, including deposit and withdrawal histories, are retained for a minimum of seven (7) years from the date of each transaction for regulatory compliance purposes.

8.4 Marketing Data

Where we process personal data for marketing purposes on the basis of your consent, such data will be retained until you withdraw your consent or request erasure, whichever occurs first, subject to any overiding legal retention obligations.

As a data subject, you are entitled to exercise the following rights in respect of your personal data held by SC99. Requests should be directed to our support team at [email protected] with the subject line "Data Rights Request" and should include your registered username and a description of the right you wish to exercise. SC99 will respond within a reasonable timeframe, typically within 30 days of receipt.

SC99 uses cookies and similar tracking technologies to ensure the proper functioning of the Platform, to improve your user experience, and to gather aggregated analytics about Platform usage. A cookie is a small text file stored on your device by web browser when you access a website.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session management cookies, security cookies, and authentication tokens. These cannot be disabled without impairing platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how visitors use the Platform — including pages visited, session duration, and error events — to help us improve platform performance and user experience.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred currency display, and interface customisations, so that you do not need to reconfigure these settings on each visit.
• Marketing Cookies: Used to track your interactions with SC99 content and to deliver relevant promotional material. These are only deployed where you have provided explicit consent.

10.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies, restrict certain types of cookies, or receive notification when a cookie is being set. Please note that disabling strictly necessary cookies will impair your ability to use the SC99 Platform correctly. For guidance on managing cookies in specific browsers, please refer to your browser's help documentation.

SC99 implements a comprehensive suite of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following controls:

• Encryption in Transit: All data transmitted between your device and the SC99 Platform is encrypted using TLS 1.2 or higher. HTTPS is enforced across all platform pages.
• Encryption at Rest: Sensitive personal data stored on SC99's infrastructure is protected by AES-256 encryption.
• Access Controls: Access to personal data within SC99's systems is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for privileged accounts.
• Penetration Testing: SC99 conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses in our platform infrastructure.
• Incident Response: SC99 maintains a data breach response procedure. In the event of a breach that is likely to result in a risk to your rights, affected individuals will be notified in accordance with applicable legal obligations.

The SC99 Platform is strictly intended for individuals aged 21 years and above. SC99 does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the KYC process and may be requested at any point during the account lifecycle.

If SC99 becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the relevant account. If you believe that a minor has submitted personal data to SC99, please notify us promptly at [email protected] so that we can take appropriate action.

SC99 strongly encourages parents and guardians to monitor the internet activity of minors in their household and to make use of parental control tools available through internet service providers and device manufacturers to prevent access to gambling websites.

In the course of providing our services, some of your personal data may be transferred to, stored in, or processed in countries other than Malaysia. This may occur when we engage service providers whose infrastructure is hosted outside Malaysia, or where cross-border transaction processing is required.

Where personal data is transferred outside Malaysia, SC99 takes steps to ensure that appropriate safeguards are in place to protect the confidentiality and integrity of that data. These safeguards include: contractual data processing agreements that impose data protection standards equivalent to those described in this Policy; use of service providers certified under recognised international data security frameworks; and transfer only to jurisdictions that offer an adequate level of data protection as recognised by applicable law.

By using the SC99 Platform and providing your personal data, you consent to the transfer of your personal data to countries outside Malaysia as described in this section, subject at all times to the safeguards and standards described herein.

SC99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Material changes to this Policy — that is, changes that meaningfully affect your privacy rights or our data processing activities — will be communicated to you by email to your registered address and/or by a prominent notice on the Platform, with at least seven (7) days' notice before the changes take effect.

Minor or administrative updates — such as typographical corrections, clarifications of existing language, or updates to contact details — may be made without advance notice. The "Last Updated" date at the top of this Policy will reflect the date of the most recent revision. We recommend that you review this Policy periodically to remain informed of how SC99 handles your personal data. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way SC99 processes your personal data, please contact our support team using the following channels:

• Email: [email protected] — please include "Privacy Request" or "Data Rights Request" in the subject line, along with your registered username and a clear description of your query or request
• Live Chat: Available in-platform 24 hours a day, 7 days a week, accessible after login
• Response Timeframe: SC99 aims to respond to all data-related queries within 5 business days and to formal data rights requests within 30 calendar days of receipt

Our support team operates on Malaysian Standard Time (UTC+8) and is available around the clock. Players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia are welcome to contact us at any time.

This Privacy Policy was last reviewed and updated on 1 January 2026. SC99 recommends that all registered Players review this document periodically. Prior versions of this Policy are available upon request directed to [email protected].