atas99 Privacy Policy

1 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "atas99," "we," "us," or "the Platform" refers to the online gaming platform operated at atas99.app and all services provided thereunder.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identity card number, mobile number, email address, device identifiers, and financial account details.
• "Member," "you," or "Data Subject" means any individual who has registered an account with atas99 or otherwise interacts with the platform.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "KYC" means Know Your Customer — the identity and age verification procedures required by atas99 and applicable regulatory frameworks.
• "PDPA" means the Personal Data Protection Act 2010 (Malaysia), which governs the processing of personal data in commercial transactions in Malaysia.

2 Scope of This Policy

This Privacy Policy applies to all Personal Data collected by atas99 through:

• The atas99.app website and any related subdomains;
• The atas99 mobile application, where applicable;
• Account registration, KYC verification, and ongoing account management processes;
• Customer support communications, including live chat, email, and any other channel through which Members contact atas99;
• Automated data collection through cookies and similar tracking technologies as described in Section 7.

This Policy does not apply to third-party websites or services linked to or from the atas99 platform. atas99 is not responsible for the privacy practices of any third party, including game providers, payment processors, or affiliates.

3 Data We Collect

atas99 collects Personal Data in the following categories:

atas99 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data, except where identity verification regulations require limited biometric confirmation (e.g., liveness checks during enhanced KYC).

4 How We Use Your Data

atas99 uses collected Personal Data for the following purposes:

• Account Management: To create, verify, and maintain your atas99 account, including identity verification (KYC) and age verification;
• Service Delivery: To provide access to casino games, live tables, sportsbook markets, and all other platform features;
• Payment Processing: To process deposits, verify withdrawal requests, and comply with anti-money laundering obligations;
• Responsible Gaming: To monitor gaming activity, apply self-imposed limits, and identify and respond to problem gambling patterns in accordance with our responsible gaming obligations;
• Customer Support: To respond to enquiries, resolve disputes, and maintain records of support interactions;
• Security and Fraud Prevention: To detect and prevent unauthorised access, fraud, money laundering, and other prohibited activities;
• Legal Compliance: To comply with applicable laws, regulations, licensing conditions, court orders, and regulatory requests;
• Platform Improvement: To analyse aggregate usage patterns and improve the performance, design, and features of the atas99 platform (using anonymised or pseudonymised data where possible);
• Marketing Communications: To send promotional offers and updates to Members who have opted in to receive such communications. Members may opt out at any time.

5 Legal Bases for Processing

atas99 processes Personal Data on the following legal bases under the PDPA and applicable data protection law:

• Consent: Where you have provided explicit consent, including consent to receive marketing communications or to undergo enhanced identity verification;
• Contractual Necessity: Where processing is necessary to perform the contract between atas99 and the Member, including account operation, payment processing, and service delivery;
• Legal Obligation: Where processing is required to comply with applicable law, including KYC regulations, anti-money laundering legislation, and licensing conditions;
• Legitimate Interests: Where processing is necessary for the legitimate business interests of atas99, including fraud prevention, platform security, and service improvement, provided those interests are not overridden by your rights and interests.

6 Sharing and Disclosure

6.1 atas99 does not sell, rent, or otherwise transfer Personal Data to third parties for commercial purposes. We share Personal Data only in the following limited circumstances:

• Service Providers: Third-party providers who assist in operating the platform, including payment processors (FPX, DuitNow, e-wallet providers), game software suppliers, KYC/AML verification services, and cloud hosting providers. All service providers are bound by data processing agreements and are prohibited from using your data for any purpose other than providing their contracted services to atas99;
• Regulatory and Legal Authorities: Where required by law, court order, or regulatory authority, including disclosures required under Malaysian anti-money laundering legislation or licensing authority requirements;
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of atas99's assets, Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections;
• Fraud and Security: Where disclosure is necessary to prevent, detect, or investigate fraud, security incidents, or other illegal activity.

6.2 atas99 will not disclose your Personal Data to any third party for direct marketing purposes without your prior explicit consent.

7 Cookies and Tracking Technologies

7.1 atas99 uses cookies and similar tracking technologies (including web beacons and session tokens) to operate the platform, maintain authenticated sessions, prevent fraud, and analyse aggregate usage patterns.

7.2 The following categories of cookies are used:

• Strictly Necessary: Required for the platform to function. These cannot be disabled without impairing core functionality;
• Functional: Used to remember your preferences (e.g., language settings, game display options);
• Analytical: Used in anonymised or aggregated form to understand how Members use the platform, enabling us to improve the service;
• Security: Used to detect and prevent fraudulent activity and unauthorised account access.

7.3 atas99 does not use third-party advertising cookies or tracking pixels that share data with external advertising networks.

7.4 You may configure your browser to reject cookies; however, doing so may impair your ability to log in or use certain platform features.

8 Data Retention

atas99 retains Personal Data for the following periods:

• Account and Identity Data: For the duration of your active account relationship with atas99, plus a minimum of five (5) years following account closure, as required by applicable AML and licensing regulations;
• Financial Transaction Data: A minimum of seven (7) years from the date of the transaction, in accordance with financial record-keeping requirements;
• Gaming History: Three (3) years from the date of each gaming session, used for dispute resolution, responsible gaming monitoring, and regulatory reporting;
• Support Communications: Two (2) years from the date of the communication, or longer where the communication relates to an ongoing dispute or regulatory matter;
• Technical and Log Data: Twelve (12) months from the date of collection, unless retained longer for active security investigations.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.

9 Data Security

atas99 implements technical and organisational security measures appropriate to the sensitivity of the Personal Data we hold, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and atas99's servers;
• Encryption at rest for sensitive fields including identity data, financial data, and authentication credentials;
• Role-based access controls limiting staff access to Personal Data to those with a documented need;
• Continuous monitoring and anomaly detection on platform systems;
• Regular security assessments and penetration testing by independent security professionals;
• Incident response procedures with defined notification timelines in the event of a data breach.

Notwithstanding these measures, no system is entirely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights and freedoms, atas99 will notify affected Members promptly in accordance with applicable law.

10 Your Rights

Subject to the provisions of the PDPA and applicable data protection law, you have the following rights with respect to your Personal Data held by atas99:

• Right of Access: You may request a copy of the Personal Data atas99 holds about you;
• Right to Correction: You may request correction of inaccurate or incomplete Personal Data;
• Right to Erasure: You may request deletion of your Personal Data, subject to our legal retention obligations. Note that certain data must be retained for regulatory compliance and cannot be deleted on request;
• Right to Restrict Processing: You may request that atas99 restrict the processing of your Personal Data in certain circumstances;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal;
• Right to Complain: You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

To exercise any of the above rights, please contact atas99's data team at [email protected] (plain text only — not a clickable link). Requests are acknowledged within five (5) business days and resolved within thirty (30) days, subject to complexity.

11 Cross-Border Data Transfers

atas99 may transfer Personal Data to service providers or hosting infrastructure located outside Malaysia where necessary for platform operation. Any such transfer is conducted subject to appropriate safeguards, including contractual data protection clauses equivalent to those required under the PDPA. By using the atas99 platform, you consent to such transfers in accordance with the terms of this Policy.

12 Children and Minors

The atas99 platform is strictly for individuals aged 21 years and above. atas99 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that we have inadvertently collected data from a minor, we will immediately close the associated account and delete the data. If you believe an account belonging to a minor has been created on atas99, please contact support immediately.

13 Amendments to This Policy

atas99 reserves the right to update this Privacy Policy at any time. Notification of material changes will be provided to registered Members by email to their registered address, or by a prominent notice on the atas99 platform, no less than fourteen (14) days before the changes take effect. Continued use of the platform following the effective date of any amendment constitutes your acceptance of the updated Policy. The "Last Updated" date at the top of this page reflects the most recent revision.

14 Contact and Data Enquiries

For all privacy-related enquiries, including requests to exercise your data rights, questions about this Policy, or concerns about how atas99 handles your Personal Data, please contact the atas99 data team:

Email: [email protected] (plain text — not a clickable link). Please include "Privacy Enquiry" in the subject line of your message.

Response Times: atas99 aims to acknowledge all privacy enquiries within five (5) business days. Substantive responses to data rights requests are provided within thirty (30) days of receipt, in accordance with applicable data protection law. Complex requests may require additional time; we will keep you informed of progress throughout.

atas99 is committed to resolving all privacy concerns promptly and in good faith. If you are not satisfied with our response, you retain the right to escalate your complaint to the relevant data protection authority.