Privacy Policy

About This Policy

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal data by zk99.app ("zk99", "we", "us", "our") in connection with the operation of the zk99 online gaming Platform and all associated services accessible at zk99.app.

This Policy applies to all individuals who register an account on the Platform, visit the Platform without registering, interact with zk99 customer support, or participate in any promotional activity conducted by zk99. It does not apply to third-party websites or services that may be referenced in zk99 communications.

zk99 is committed to protecting the privacy and personal data of all players across Malaysia — including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Kota Kinabalu, and all other regions. Our data practices are designed to align with the principles of Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards.

Data Controller

For the purposes of applicable data protection legislation, zk99.app is the data controller in respect of personal data collected through the Platform. As data controller, zk99 is responsible for determining the purposes and means by which personal data is processed.

Enquiries relating to data protection and privacy matters may be directed to the zk99 data protection contact via the email address listed in Section 14 of this Policy.

Data We Collect

zk99 collects personal data in the following categories, depending on how you interact with the Platform:

3.1 Registration and Identity Data

• Full legal name as per national identity documents (MyKad or passport);
• Date of birth (for age verification — 21+ requirement strictly enforced);
• Nationality and country of residence;
• Email address and mobile number;
• Username selected at registration;
• MyKad or passport number (collected during KYC verification).

3.2 Financial Data

• eWallet identifiers associated with Touch 'n Go, Boost, GrabPay, or DuitNow accounts used for deposits or withdrawals;
• Bank account details (account holder name, bank name, account number) provided for withdrawal processing via Maybank2u, CIMB Clicks, or FPX;
• Transaction records including deposit amounts, withdrawal amounts, dates, and payment method used;
• Account balance history.

3.3 Technical and Usage Data

• IP address at time of login and during session;
• Device type, operating system, and browser version;
• Geolocation data at the level of country and region (not precise GPS);
• Session duration, pages visited, games played, and bet history;
• Cookie identifiers and session tokens.

3.4 Communications Data

• Content of support interactions via live chat, email, or WhatsApp;
• Feedback and complaint records;
• Preferences indicated in responsible gaming settings.

How We Use Your Data

zk99 processes personal data only for defined and legitimate purposes. The following describes the primary uses of each data category:

• Account Management: To create, maintain, and administer your zk99 Account, including authentication and session management.
• Age Verification: To verify that players meet the 21+ age requirement before permitting access to casino-style games, sports betting, poker, and Toto 4D products.
• Payment Processing: To process deposits and withdrawals in MYR via Touch 'n Go eWallet, DuitNow, FPX, and other supported channels; to reconcile transaction records and resolve payment disputes.
• KYC and Anti-Money Laundering (AML) Compliance: To fulfil identity verification obligations, conduct source-of-funds checks where required, and file statutory reports in accordance with applicable AML legislation.
• Platform Security: To detect, prevent, and investigate fraud, account compromise, collusion, and other prohibited activities.
• Responsible Gaming: To operate deposit limits, session time reminders, cool-off periods, and self-exclusion mechanisms; to identify patterns potentially indicative of problem gambling behaviour.
• Customer Support: To respond to enquiries, process complaints, and maintain records of support interactions for quality and regulatory purposes.
• Service Improvement: To analyse aggregated and anonymised usage data for the purpose of improving Platform performance, game selection, and user experience.
• Marketing Communications: To send promotional offers and bonus notifications where the player has provided consent and has not subsequently opted out. Players may unsubscribe from marketing communications at any time via their Account settings.
• Legal and Regulatory Obligations: To comply with requests from regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where zk99 is legally obligated to disclose data.

Legal Basis for Processing

zk99 processes personal data on the following legal bases as applicable to each processing activity:

• Contractual Necessity: Processing required to perform the contract established when a player creates a zk99 Account and accepts the Terms & Conditions — including account management, payment processing, and game operation.
• Legal Obligation: Processing required to comply with applicable law, including KYC verification, AML reporting obligations, and age verification requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregated analytics, where such processing does not override the player's fundamental privacy rights.
• Consent: Processing of data for marketing communications, where the player has provided explicit consent. Consent may be withdrawn at any time without affecting processing conducted prior to withdrawal.

Data Sharing and Disclosure

zk99 does not sell personal data. Data is shared with third parties only in the following defined circumstances:

• Payment Processors: Transaction data is shared with licensed payment gateway providers operating the Touch 'n Go, DuitNow, FPX, Boost, GrabPay, Maybank2u, and CIMB Clicks integrations, strictly for the purpose of processing the relevant transaction.
• KYC and Identity Verification Providers: Identity documents and verification data may be shared with licensed third-party KYC service providers engaged by zk99 to perform identity verification checks.
• Gaming Software Providers: Certain game-level data (session identifiers, bet data) is shared with licensed RNG game studios and live casino operators whose certified software powers games on the zk99 Platform.
• Regulatory and Law Enforcement Authorities: zk99 will disclose personal data to competent regulatory bodies, law enforcement agencies, gaming authorities, or courts of law where legally required to do so.
• Professional Advisers: Accountants, legal advisers, and auditors engaged by zk99 may have access to personal data where strictly necessary for the provision of their professional services, under binding confidentiality obligations.

Cookies and Tracking Technologies

zk99 uses cookies and similar tracking technologies to operate the Platform effectively and securely. The following cookie categories are used:

• Strictly Necessary Cookies: Required for authentication, session maintenance, and basic Platform security. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember player preferences such as language settings and game lobby view configurations.
• Analytics Cookies: Aggregated, anonymised data used to understand how the Platform is used and identify areas for improvement. No individual player is identifiable from analytics data.

zk99 does not deploy third-party advertising or behavioural profiling cookies. Players may manage cookie settings via their browser's privacy controls. Disabling strictly necessary cookies will impair or prevent login functionality.

Data Retention

zk99 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to legal and regulatory retention requirements:

• Account and Identity Data: Retained for the duration of the active account relationship and for a period of five (5) years following permanent account closure, consistent with AML record-keeping obligations.
• Transaction Records: Retained for seven (7) years from the date of each transaction, in compliance with financial record-keeping requirements.
• KYC Documents: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Support Communications: Retained for three (3) years from the date of the interaction.
• Technical / Log Data: Retained for twelve (12) months from collection, unless retained for longer as part of a security investigation.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with zk99's data disposal procedures.

Data Security

zk99 implements technical and organisational security measures commensurate with the sensitivity of the personal data processed and the risks associated with the Platform's operations. These measures include:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit;
• PCI-DSS compliant payment processing infrastructure;
• Access controls limiting personal data access to authorised personnel on a need-to-know basis;
• Two-factor authentication available for all player accounts and mandatory for internal administrative access;
• Regular penetration testing and security audits conducted by independent specialists;
• Incident response procedures for detecting, containing, and notifying relevant parties of data breaches within applicable statutory timeframes.

Despite these measures, no system is completely impenetrable. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their zk99 Account as an additional layer of individual security.

Your Data Rights

Subject to applicable law, players have the following rights in relation to their personal data held by zk99:

• Right of Access: The right to request a copy of the personal data zk99 holds about you.
• Right of Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right of Erasure: The right to request deletion of personal data where there is no legitimate continuing purpose or legal obligation for retention. Note that certain data categories cannot be deleted prior to the expiry of mandatory statutory retention periods.
• Right to Restrict Processing: The right to request that zk99 limit processing of your personal data in certain circumstances.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact the zk99 support team via the channels listed in Section 14. zk99 will respond to data rights requests within thirty (30) days of receipt, or within such extended period as may be permitted by applicable law where the request is complex or voluminous.

Children's Privacy

The zk99 Platform is strictly for users aged 21 and above. zk99 does not knowingly collect personal data from persons under the age of 21. If zk99 becomes aware that personal data has been collected from a person under 21, that account will be closed immediately, all associated data will be deleted (subject to any mandatory legal retention requirements), and any deposited funds will be handled in accordance with zk99's underage account procedures.

Parents or guardians who believe that a minor may have created an account on the Platform should contact zk99 support immediately with supporting evidence.

International Data Transfers

zk99 may process or store personal data on servers located outside Malaysia in connection with the operation of the Platform — for example, where licensed gaming software providers or payment processors operate infrastructure in other jurisdictions. In all such cases, zk99 takes steps to ensure that appropriate safeguards are in place to protect personal data transferred outside Malaysia, consistent with the requirements of the Personal Data Protection Act 2010 and applicable international standards.

Where personal data is transferred to third-party processors located in other countries, zk99 requires those processors to comply with contractual data protection standards no less protective than those applied by zk99 itself.

Changes to This Policy

zk99 reserves the right to update this Privacy Policy from time to time to reflect changes in data practices, legal requirements, or Platform functionality. Where changes are material, zk99 will notify active players by email or via a prominent notice on the Platform at least seven (7) days prior to the updated Policy taking effect.

The date of the most recent revision is displayed at the top of this Policy. Continued use of the Platform following any revision constitutes acceptance of the updated Policy. Players who do not accept a revised Policy should contact support to close their Account and arrange withdrawal of any remaining balance.

Contact & Data Requests

For privacy-related enquiries, data rights requests, or concerns about how zk99 handles your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 via the support widget on the Platform after login.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in the subject line of your email.
• WhatsApp: Contact details are provided within the Account dashboard after logging in.

zk99 aims to respond to all privacy-related requests within thirty (30) days. For requests exercising formal data protection rights, zk99 may request proof of identity before actioning the request, to ensure personal data is only disclosed to the individual to whom it belongs.