CRS99 Privacy Policy – How We Protect the Personal Data of Malaysian Players

CRS99 collect your personal data through several channels — during account registration, during your use of the platform, and when you interact with our support team. We collect only the data that is genuinely necessary to provide you with a safe, legally compliant, and high-quality service.

CRS99 use your personal data only for legitimate, clearly defined purposes. Below are the primary purposes for which your data is used and the legal basis that permits such processing:

• Service Delivery: To verify your identity during registration, manage your CRS99 account, process deposits and withdrawals in MYR, and grant access to over 1,000 games on the platform.
• Legal & Regulatory Compliance: To comply with Anti-Money Laundering (AML), Know Your Customer (KYC), and Malaysia's Personal Data Protection Act 2010 obligations, CRS99 is required to retain player transaction records and identity information under these regulations.
• Platform Security: To detect and prevent fraud, unauthorised access, account abuse, and activities that violate CRS99's Terms & Conditions. Technical data such as IP addresses helps identify suspicious activity patterns.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and, where necessary, applying appropriate safeguards in line with CRS99's commitment to responsible gaming.
• Customer Support: Handling inquiries, complaints, and support requests submitted to the CRS99 support team, as well as maintaining communication records for reference and dispute resolution.
• Service Improvement: Analysing aggregated, anonymised usage data to understand platform usage patterns, identify areas for improvement, and develop new features relevant to Malaysian players.
• Service Communications: Sending important notifications about your account, updates to our Terms & Conditions or Privacy Policy, security information, and relevant promotions (with your consent).

Data security is the absolute priority for CRS99. We continually invest in the latest technologies and procedures to keep your personal data safe from cyber threats and unauthorised access. The following are the layers of protection we have in place:

• 256-Bit SSL Encryption: All communication between your browser or app and CRS99's servers is encrypted using 256-bit TLS/SSL protocol. This means that even if someone were to intercept your network traffic, they would be unable to read its contents.
• Data Encryption at Storage Level: Sensitive data stored in CRS99's databases — including passwords — is encrypted using a one-way hashing algorithm that cannot be decrypted. This means that even in the event of a server breach, your password remains protected.
• Internal Access Controls: Only CRS99 staff who require access to your data in order to carry out their authorised duties are permitted to do so. All access is logged, monitored, and periodically audited.
• 24/7 Security Monitoring: The CRS99 cybersecurity team monitors platform activity around the clock using advanced anomaly detection systems to identify and address any threats promptly.
• Regular Penetration Testing: CRS99 conducts regular security audits carried out by independent parties to identify and address any system vulnerabilities before they can be exploited.
• Secure Server Infrastructure: CRS99 servers are protected by multi-layered firewalls, intrusion detection systems, and physical security measures at certified data centres.

CRS99 does not sell, rent, or commercialise your personal data to any third party. However, in the course of operating the platform, CRS99 may need to share certain data with specific parties in the following limited and strictly controlled situations:

• Payment Service Providers: When you make a deposit using Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, or FPX via Maybank2u/CIMB Clicks, the relevant transaction information must be shared with those payment providers to process your transaction. All such providers are bound by their own strict privacy and security policies.
• Game Providers: Usernames (not full identifying information) may be shared with game providers such as Pragmatic Play, PG Soft, Evolution Gaming, and others for the technical purposes of running games and resolving technical disputes. These providers are bound by strict confidentiality agreements.
• Malaysian Authority: CRS99 will disclose your data to the relevant Malaysian authorities – including the Royal Malaysia Police (PDRM), Bank Negara Malaysia, or the courts – when required to do so by law or a valid court order. This includes cooperation in fraud and money laundering investigations.
• Technical Service Providers: Technical infrastructure service providers such as server hosting and cybersecurity firms may have limited access to your data within the scope of the services they provide. All such parties are bound by contractually enforceable confidentiality and data protection agreements.

Platform CRS99 use cookies and similar tracking technologies to enhance the user experience, maintain security, and ensure certain platform functions operate correctly. Below is an explanation of the types of cookies we use:

• Essential Cookies: These cookies are strictly necessary for the core functions of the CRS99 platform – including login authentication, session management, and security. Without them, the platform will not function properly. Essential cookies cannot be disabled.
• Performance Cookies: Used to collect information on how users interact with the CRS99 platform – such as which pages are visited most frequently, response times, and any errors encountered. This data is used in aggregate form to improve platform performance.
• Functional Cookies: Allows the platform to remember your preferences – such as your preferred language, region, and display settings – so you don't have to reconfigure them every time you log in.
• Analytics Cookies: CRS99 uses anonymised analytics data to understand overall platform usage patterns. This data contains no information that could personally identify any individual.

Most web browsers allow you to manage cookie settings through the settings menu. You may choose to block or delete cookies, though doing so may affect certain functions of the CRS99 platform. For more information on managing cookies on your device, please refer to your web browser's documentation.

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have certain rights regarding the personal data held by CRS99. We fully respect these rights and have clear processes in place to facilitate their exercise:

CRS99 only retains your personal data for as long as it is needed for the stated purposes or as required by Malaysian law. Once the data is no longer necessary, it will be securely deleted or anonymised.

• Active Account Data: For as long as your CRS99 account remains active, your identity data, contact data, and financial data will be retained for account management and legal compliance purposes.
• Transaction & Gaming Records: Financial transaction records and game history are retained for a minimum of 7 years from the transaction date, in compliance with Malaysia's anti-money laundering and tax requirements.
• Communications Data: Customer support conversation records, emails, and complaints are retained for 3 years from the date of communication for reference and dispute resolution purposes.
• Technical Data & Logs: Access logs, IP addresses, and session data are retained for 12 months for security and fraud detection purposes.
• After Account Closure: After an account is closed, the minimum data required for legal compliance will be retained for the period prescribed by Malaysian law. All other data that is not legally required will be deleted within 90 days.

When CRS99 determines that personal data is no longer needed, a secure deletion procedure is carried out to ensure the data cannot be recovered by any party. This process is performed on a regular basis and is overseen by the CRS99 security team.

If you have any questions, concerns, or complaints regarding this Privacy Policy CRS99 or how we handle your personal data, our privacy team is here to help. We take every privacy inquiry seriously and will provide a thorough response within a reasonable timeframe.

• Privacy Email: support@crs99.my – Please include "Privacy Inquiry" in the subject line for faster processing.
• Live Chat: Available 24/7 within the CRS99 platform — ideal for general enquiries and immediate assistance.
• Response Time: General enquiries will be responded to within 2 business days. Formal data rights requests will be processed within 21 business days as required under the PDPA.

This Privacy Policy is governed by the laws of Malaysia, including the Personal Data Protection Act 2010 (PDPA). If you believe CRS99 has not complied with this Privacy Policy or the PDPA, you have the right to lodge a complaint with the Malaysian Personal Data Protection Commissioner through the designated official channels.