Privacy Policy

1

Introduction

This Privacy Policy ("Policy") issued by Naza99 ("we", "us", "our", "the Company") and applies to all personal data collected, processed, and held in connection with your use of the Naza99 website athttps://naza99.cam and all associated services (collectively, the "Platform"). The Policy is addressed to all individuals who interact with our Platform, including registered account holders, visitors, and prospective users ("you", "User "Data Subject").

Naza99 is committed to handling all personal data responsibly, transparently, and in accordance with applicable international data protection principles. We recognise that the personal information you share with us — whether during account registration, KYC verification, payment processing, or general platform use — is entrusted to us and must be treated with the highest standard of care and confidentiality.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By registering an account or otherwise using the Naza99 Platform, you acknowledge that you have read this Policy and consent to the data practices described herein.

Your Privacy at Glance

We collect only the data necessary to operate your account and deliver our services
We never sell your personal data to third parties
We use industry-standard security measures to protect your data at rest and in transit
You hold specific rights over your personal data which you may exercise at any time
Our platform is strictly21+ and we take all practicable steps to prevent data collection from minors

2

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

"Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, including by reference to an identifier such as name, identification number, location data, or online identifier.
"Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
"Data Controller" means Naza99, which determines the purposes and means of processing personal data collected through the Platform.
"Data Processor" means any third party that processes personal data on behalf of Naza99 under a contractual agreement and our instruction.
"Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their personal data.
"Cookies" means small data files placed on your device by the Platform's web server that store information about your browsing session and preferences.
"KYC" means Know Your Customer — identity and age verification procedures conducted to comply with regulatory obligations and prevent fraud.

3

Personal Data We Collect

Naza99 collects personal data across several categories, depending on how you interact with our Platform. The categories of personal data we may collect are outlined below. We collect only what is genuinely necessary for the stated purposes and do not engage in excessive or speculative data collection.

Identity Data

Full legal name, date of birth, gender, nationality, government-issued ID number (MyKad / Passport), selfie photograph for KYC

Contact Data

Email address, phone number, residential address (including city — e.g. Kuala Lumpur, Penang, Johor Bahru)

Account Data

Username, account ID, login history, account preferences, responsible gambling settings, communication preferences

Financial Data

Payment method details (e.g. last four digits of card or e-wallet identifier), deposit and withdrawal transaction records, account balance history

Transaction Data

Details of all wagers placed, games played, bet amounts (MYR), outcomes, bonus usage, and associated timestamps

Technical Data

IP address, browser type and version, device identifiers, operating system, screen resolution, time zone, session duration

Usage Data

Pages visited, features used, game categories accessed, search queries within the Platform, referal source, click-path data

Communications Data

Records of support chat interactions, email correspondence, feedback submissions, and complaint records

Sensitive Data Note

Naza99 does not intentionally collect sensitive personal data (such as health information, religious beliefs, or political opinions) through the Platform. KYC identity documents are collected solely for age and identity verification purposes and are handled with heightened security protocols.

4

How Personal Data Is Collected

Naza99 collects personal data through the following channels and mechanisms:

Direct Collection — Information You Provide

Account registration forms — name, date of birth, email, phone number, residential address
KYC verification submissions — government-issued ID documents, proof of address, selfie photographs
Deposit and withdrawal requests — payment method identifiers and transaction details
Customer support interactions — live chat logs, emails, and complaint records
Responsible gambling tool requests — deposit limit preferences, self-exclusion applications

Automated Collection — Data Collected During Platform Use

Server logs recording IP address, access timestamps, pages visited, and referring URLs
Cookies and similar tracking technologies recording session behaviour and preferences
Game engine data capturing wager amounts, game selections, session duration, and outcomes
Device fingerprinting for fraud detection and multi-account prevention purposes

Third-Party Sources

Payment processors and e-wallet providers (Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong) — for transaction verification and fraud prevention
Identity verification service providers — for KYC document validation
Analytics platforms — for aggregated, anonymised usage pattern analysis
Fraud prevention databases — for cross-referencing against known fraudulent or prohibited accounts

5

Purpose & Legal Basis for Processing

Naza99 processes personal data only where there is a legitimate legal basis for doing so. The primary legal bases on which we rely are: (a) contractual necessity — processing required to perform our service agreement with you; (b) legal obligation — processing required to comply with applicable regulatory requirements; (c) legitimate interests — processing necessary to pursue our legitimate business interests where these do not override your rights; and (d) consent — where you have given specific, informed consent to a particular processing activity.

Specific Processing Purposes

Account creation and management — to register, verify, and maintain your Naza99 account (contractual necessity)
Identity and age verification (KYC) — to verify that you meet the 21+ minimum age requirement and confirm your identity (legal obligation + contractual necessity)
Payment processing — to process deposits and withdrawals via your selected payment methods including Malaysian e-wallets and bank transfers (contractual necessity)
Game and betting services — to deliver the sports betting, live casino, and slot game services you have registered to use (contractual necessity)
Fraud prevention and security — to detect and prevent fraudulent activity, multi-accounting, and money laundering (legal obligation + legitimate interests)
Responsible gambling compliance — to monitor play patterns, enforce limits, and fulfil our duty of care obligations (legal obligation)
Customer support — to respond to your enquiries, resolve disputes, and improve our service (contractual necessity + legitimate interests)
Marketing communications — to send promotional offers and platform updates, where you have opted in and subject to your communication preferences (consent)
Platform improvement — to analyse usage patterns, identify bugs, and improve product features (legitimate interests)
Legal compliance — to comply with applicable laws, court orders, and regulatory requests (legal obligation)

6

Data Sharing & Disclosure

Naza99 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Full stop. Disclosure of your data is limited to the specific circumstances outlined below, each of which is necessary for the legitimate operation of our services.

Permitted Disclosure Scenarios

Payment processors and financial institutions — including Malaysian payment providers (DuitNow, FPX, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, Hong Leong) and cryptocurrency processors — solely for the purpose of processing your transactions
Identity verification providers — third-party KYC service providers engaged to verify the identity documents you submit, under strict data processing agreements
Platform infrastructure providers — cloud hosting, cybersecurity, and analytics service providers who process data on our behalf under binding data processing agreements and our explicit instruction
Game content providers — limited technical data may be shared with game studio infrastructure for the purpose of delivering gameplay and recording outcomes
Fraud prevention networks — data may be shared with industry fraud prevention databases where we have reasonable grounds to suspect fraudulent activity
Regulatory and legal authorities — where required by law, court order, regulatory direction, or in connection with the investigation of suspected illegal activity
Business successors — in the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the acquiring entity, subject to equivalent privacy protections

All third-party Data Processors engaged by Naza99 are required to process your data only on our instructions, to maintain appropriate technical and organisational security measures, and to refrain from using your data for any purpose other than that for which it was disclosed.

7

Data Retention

Naza99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention guidelines apply:

Account data — retained for the duration of your account's active status and for a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements
KYC documentation — retained for a minimum of five (5) years from the date of verification or account closure, whichever is later
Transaction records — retained for a minimum of five (5) years for regulatory compliance and financial audit purposes
Customer support records — retained for up to three (3) years from the date of the relevant interaction
Technical and usage data — retained for up to twenty-four (24) months unless required longer for security or fraud investigation purposes
Marketing consent records — retained for the duration of your active consent and for one (1) year following withdrawal of consent, as evidence of the original consent

Upon expiry of the applicable retention period, personal data is either securely deleted, anonymised to standard where reidentification is not possible, or archived in accordance with our internal data management procedures.

8

Data Security

Naza99 implements a comprehensive range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes, but is not limited to:

256-bit SSL/TLS encryption applied to all data transmitted between your device and our servers, including login sessions, payment transactions, and personal data submissions
Encryption at rest for all sensitive personal data stored in our systems, including identity documents and financial records
Access controls ensuring that personal data is accessible only to authorised personnel with a legitimate operational need, on a strictly defined least-privilege basis
Multi-factor authentication for all internal staff access to systems containing personal data
Regular security audits and penetration testing to identify and remediate vulnerabilities in our infrastructure
24/7 monitoring of platform systems for unusual access patterns, data exfiltration attempts, and other security anomalies
Incident response procedures to contain, investigate, and notify affected parties in the event of a personal data breach

Your Role in Data Security

While we maintain strong security on our end, the security of your account also depends on you maintaining a strong, unique password and not sharing your login credentials with anyone. If you believe your account has been accessed without your authorisation, please contact us immediately at [email protected].

9

Cookies & Tracking Technologies

Naza99 uses cookies and similar tracking technologies (including web beacons and pixel tags) to improve your experience on the Platform, enable essential functionality, and gather analytics data that helps us understand how the Platform is used and where improvements can be made.

Categories of Cookies We Use

Strictly Necessary Cookies — essential for core Platform functionality, including maintaining your login session, remembering your security settings, and enabling payment processes. These cannot be disabled without significantly impairing the Platform.
Performance & Analytics Cookies — collect anonymised data about how visitors interact with the Platform, including which pages are visited most frequently and how long sessions last. This data is used exclusively to improve Platform performance.
Functional Cookies — remember your personal preferences such as language settings, display preferences, and game category favourites to provide a more personalised experience on return visits.
Security Cookies — used for fraud detection and multi-account prevention, including device fingerprinting to identify suspicious access patterns.

You may control the use of non-essential cookies through your browser settings. Most modern browsers allow you to refuse, delete, or be notified when cookies are set. Please note that disabling certain cookies may impact the functionality of the Naza99 Platform. For full details, consult your browser's help documentation.

10

Your Data Protection Rights

Subject to applicable data protection law and certain conditions, you hold the following rights with respect to your personal data held by Naza99. We will respond to all valid requests within a reasonable timeframe, and in any event within thirty (30) days of receipt:

Right of Access

You have the right to request a copy of the personal data we hold about you, together with information about how it is being used, on what legal basis, and with whom it has been shared.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

Right to Erasure

In certain circumstances, you may request that we delete your personal data. This right is subject to our legal obligations to retain certain records (e.g. KYC and transaction data for regulatory purposes), which may limit its application.

Right to Restrict Processing

You may request that we restrict our processing of your data in specific circumstances — for example, while you contest the accuracy of data we hold, or where you have objected to processing based on legitimate interests.

Right to Data Portability

Where processing is based on your consent or contractual necessity and carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object at any time to processing of your personal data carried out on the basis of our legitimate interests, including profiling. You may also object to processing for direct marketing purposes at any time, with immediate effect.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request" and your account details. We may be required to verify your identity before processing your request.

11

Minors & Age Verification

The Naza99 Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect personal data from any person under the age of 21 and actively take steps to prevent minors from accessing our Platform.

All account registrations are subject to age verification as part of our KYC process. Where we become aware that personal data has been collected from a person under 21 — whether through registration, KYC checks, or other means — we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by our legal obligations, and refund any deposits subject to verification.

Protecting Minors —21+ Strictly Enforced

If you are a parent or guardian and believe that a minor under your care has registered an account on the Naza99 Platform, please contact us immediately at [email protected]. We will treat all such reports as urgent and will take immediate action to investigate and, where confirmed, close the account and delete associated data without delay.

12

International Data Transfers

In the course of providing the Naza99 Platform and its associated services, your personal data may be transferred to, stored in, or processed in countries outside of Malaysia. Such transfers occur where our infrastructure providers, KYC verification partners, or game content providers operate data centres or support functions in other jurisdictions.

Where personal data is transferred internationally, Naza99 ensures that appropriate safeguards are in place to protect the data to a standard consistent with this Policy. Safeguards may include binding contractual clauses with the recipient requiring equivalent data protection standards, or reliance on the recipient operating under a recognised framework that provides adequate protection.

By using the Naza99 Platform and consenting to this Privacy Policy, you acknowledge and consent to the international transfer of your personal data in accordance with the safeguards described above.

13

Changes to This Privacy Policy

Naza99 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. When material changes are made, we will use reasonable endeavours to notify registered Users via the email address associated with their Account, or through a prominent notice on the Platform, prior to or at the time the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically to remain informed about how we protect your data. Your continued use of the Platform following any update to this Policy constitutes acceptance of the revised version.

14

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices — including any data rights requests — please contact the Naza99 data team through the channels below:

Privacy & Data Contact Details

General & Privacy Enquiries: [email protected]
Data Rights Requests: [email protected] — subject line: "Data Rights Request"
Responsible Gambling & Data: [email protected]
Response Commitment: All privacy-related enquiries are acknowledged within 48 hours and fully addressed within 30 calendar days

For urgent matters relating to suspected unauthorised access to your Account or potential data breach incidents, please mark your communication as "URGENT — Security" to ensure it is escalated immediately within our team.