Privacy Policy

JD99 ("we", "us", "our", "the Platform") operates the online gaming and sports betting platform accessible at https://jd99.cam. We understand that your personal data is important to you, and we take our obligations as a data controller seriously. This Privacy Policy ("Policy") sets out in clear terms how JD99 collects, stores, uses, shares, and protects the personal information of registered Members and visitors to the JD99 platform.

This Policy applies to all personal data processed by JD99 in connection with the operation of the Platform, including data collected during account registration, the Know Your Customer (KYC) identity verification process, deposits and withdrawals, gameplay, customer support interactions, and your general browsing of our website.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, all of which form part of the agreement between you and JD99. By registering an account or using the JD99 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and device identifiers.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. JD99 is the Data Controller in respect of all personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of JD99 under a contractual data processing agreement.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, and deletion.
• "Member" means a natural person who holds a registered account on the JD99 Platform.
• "KYC" means Know Your Customer — the identity verification process requiring submission of government-issued identification and proof of address documents.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, remember preferences, and analyse usage.
• "Sensitive Data" means a subset of personal data warranting heightened protection, including financial account details, identity document numbers, and biometric data.

JD99 is the Data Controller for all personal data collected through the Platform at https://jd99.cam. As Data Controller, JD99 determines the purposes for which your personal data is processed and the means by which that processing takes place.

JD99 has appointed a designated privacy contact responsible for overseeing compliance with this Privacy Policy and data protection obligations. You may contact the privacy team using the details provided in Section 15 of this Policy.

Where JD99 engages third-party service providers to process personal data on its behalf (for example, payment processors, KYC verification services, and IT infrastructure providers), those parties act as Data Processors subject to binding data processing agreements that prohibit use of your data for any purpose other than delivering services to JD99.

JD99 collects personal data through several channels and at various stages of your relationship with the Platform. The categories of data collected are set out in the table below:

JD99 does not intentionally collect sensitive data categories beyond those strictly necessary for KYC compliance (identity document details) and financial transaction processing (payment method references). We do not collect racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes.

JD99 processes your personal data only where a valid lawful basis exists. The primary legal bases on which JD99 relies are:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and JD99 — specifically, to operate your Member account, process deposits and withdrawals, provide access to games, and administer bonus claims.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) regulations, and fraud prevention obligations.
• Legitimate Interests: Processing is necessary for JD99's legitimate interests, including platform security, detection of fraudulent or prohibited activity, product improvement, and responsible gambling monitoring — provided those interests are not overridden by your fundamental privacy rights.
• Consent: Where processing is based on consent (for example, for direct marketing communications), JD99 will obtain explicit consent from you and will provide a straightforward means to withdraw that consent at any time.

JD99 uses your personal data for the following defined purposes:

• Account Management: Creating, maintaining, and managing your Member account, including authentication, password resets, and account security notifications.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and cryptocurrency; processing withdrawal requests to your nominated payment method; maintaining accurate transaction records in MYR.
• Identity Verification (KYC): Verifying your identity and age (21+ requirement) in compliance with regulatory obligations and internal anti-fraud policies.
• Customer Support: Responding to support enquiries, resolving account issues, processing complaints, and maintaining records of support interactions.
• Responsible Gambling: Monitoring gameplay patterns for signs of problem gambling behaviour; administering deposit limits, cooling-off periods, and self-exclusion requests; fulfilling obligations under our Responsible Gambling Policy.
• Platform Security: Detecting, investigating, and preventing fraudulent transactions, duplicate accounts, prohibited activities, and unauthorised access attempts.
• Legal Compliance: Complying with applicable laws, regulations, court orders, and requests from competent regulatory authorities.
• Service Improvement: Analysing anonymised or aggregated usage data to improve Platform performance, game selection, and user experience.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates — only where you have opted in to receive such communications. You may unsubscribe at any time.

JD99 does not sell, rent, or trade your personal data to third parties for commercial gain. Personal data is shared only in the following defined circumstances:

• Service Providers (Data Processors): JD99 engages third-party service providers to perform specific operational functions, including payment processing (for Malaysian payment methods such as DuitNow, FPX, Touch 'n Go eWallet, and Boost), KYC verification services, IT infrastructure and cloud hosting, fraud detection tools, and customer support platform providers. All such providers are contractually bound to process your data only as instructed by JD99, to maintain appropriate security standards, and to handle data confidentially.
• Regulatory and Law Enforcement Authorities: JD99 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, in connection with anti-money laundering investigations, fraud investigations, or pursuant to a lawful court order or regulatory directive.
• Responsible Gambling Organisations: Where a Member activates self-exclusion or where JD99 identifies a Member as potentially vulnerable, limited data may be shared with recognised responsible gambling organisations to support the Member's exclusion request, consistent with our obligations under our Responsible Gambling Policy.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of JD99's business, personal data held by JD99 may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments being assumed by the acquirer.

In all cases of data sharing, JD99 applies appropriate contractual and technical safeguards to protect your personal information consistent with the terms of this Privacy Policy.

Some of JD99's service providers operate in jurisdictions outside Malaysia. Where personal data is transferred outside the jurisdiction in which it was collected, JD99 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that afforded under applicable data protection principles.

Safeguards used for international transfers may include contractual data protection clauses between JD99 and the receiving party, binding corporate rules where the receiving party is part of the same corporate group, or reliance on adequacy determinations where the destination country has been assessed as providing an adequate level of data protection.

You may request further information about the safeguards applicable to specific international transfers by contacting the JD99 privacy team using the details in Section 15 of this Policy.

JD99 uses cookies and similar tracking technologies on the Platform to deliver core functionality, enhance your browsing experience, and analyse Platform usage patterns. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Blocking essential cookies may impair the functionality of the JD99 Platform, including your ability to log in and access your account. For analytics and marketing cookies, you may withdraw consent at any time by adjusting your cookie preferences or contacting the JD99 support team.

JD99 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulation. The following indicative retention periods apply:

• Account and Registration Data: Retained for the duration of the Member's active account relationship, plus a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations.
• KYC / Identity Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with applicable regulatory requirements.
• Transaction Records: Financial transaction records, including deposit and withdrawal history in MYR, are retained for a minimum of seven (7) years to satisfy statutory accounting and AML record-keeping requirements.
• Gameplay Records: Game session logs and betting history are retained for five (5) years to support dispute resolution, responsible gambling monitoring, and regulatory compliance.
• Customer Support Records: Support correspondence is retained for three (3) years following resolution of the relevant enquiry.
• Marketing Consent Records: Records of marketing opt-in consents are retained for the duration of the consent period plus three (3) years to demonstrate compliance.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be attributed to any identifiable individual.

As a data subject, you hold the following rights in respect of your personal data held by JD99. These rights may be subject to certain limitations under applicable law — for example, where processing is required to comply with a legal obligation or to defend legal claims.

JD99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Data at rest is encrypted using industry-standard AES-256 encryption on secured servers.
• Access Controls: Access to personal data within JD99's systems is restricted on a need-to-know basis, enforced through role-based access controls and multi-factor authentication for all internal system access.
• Security Monitoring: JD99 maintains continuous monitoring of Platform infrastructure for intrusion attempts, anomalous access patterns, and security incidents. Security events are logged and reviewed by qualified security personnel.
• Penetration Testing: JD99 engages independent security specialists to conduct periodic penetration tests and vulnerability assessments of the Platform infrastructure.
• Data Minimisation: JD99 collects and retains only the minimum personal data necessary for each defined purpose, reducing the potential impact of any security incident.
• Incident Response: JD99 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights and freedoms, JD99 will notify affected Members without undue delay and will report to the relevant regulatory authority as required by applicable law.

While JD99 takes extensive precautions to protect your data, no internet-based system is entirely immune to security risks. You also play an important role in protecting your account — choose a strong, unique password, enable two-factor authentication, do not share your credentials, and notify us immediately if you suspect unauthorised account access.

The JD99 Platform is strictly intended for adults aged 21 years and above. JD99 does not knowingly collect, process, or retain personal data from any person under the age of 21. Age verification is a mandatory component of the KYC process, and JD99 employs additional age-screening measures during account registration.

If JD99 discovers that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, it will take immediate steps to delete that data, suspend the associated account, and return any deposited funds in accordance with applicable procedures.

If you believe a minor has registered a JD99 account or submitted personal data to the Platform, please contact us immediately using the details in Section 15 so that we can take prompt corrective action.

JD99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Where amendments are material — meaning they meaningfully affect how we process your personal data or the rights available to you — JD99 will provide advance notice to registered Members via email to the registered address and/or a prominent notice on the Platform, no less than 14 days prior to the changes taking effect.

Minor amendments that do not materially affect your rights or our processing activities (such as typographical corrections, clarifications, or structural reorganisations) may be made without specific advance notification, though the updated Policy will always be published on this page with an updated effective date and version number.

Your continued use of the JD99 Platform following the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically. The current version is always available at https://jd99.cam/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights as set out in Section 11, or want to make a complaint about how JD99 has handled your personal data, please contact the JD99 privacy team using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the JD99 Platform. For privacy requests, please state clearly that your enquiry relates to your personal data or data subject rights.
• Email: [email protected] — Subject line: "Privacy Request" or "Data Subject Rights Request"

JD99 will acknowledge your privacy request within 24 hours and will provide a substantive response within 30 calendar days of receiving all information necessary to process your request. Where a request is complex or JD99 receives a large volume of requests simultaneously, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with how JD99 has handled your privacy concern, you have the right to escalate your complaint to the relevant data protection or privacy supervisory authority in your jurisdiction.