Club98 Privacy Policy — Member Personal Data Protection

Welcome to the club98 Privacy Policy page. club98 is an online entertainment platform operating under a valid licence, providing casino games, slots, bingo, Live Casino, and sports betting to members in Malaysia. We understand that your trust is our most valuable asset, and that trust begins with transparency about how we manage your data.

This document constitutes a binding privacy agreement between you as a member and Club98 as the data controller. By registering and using our platform, you agree to the terms set out herein. If you do not agree with any part of this policy, please contact us or discontinue use of the platform.

This Privacy Policy is drawn up in accordance with the requirements of the Personal Data Protection Act 2010 (PDPA) Malaysia and updated periodically to reflect legal developments and industry best practices. The version you are reading now is the latest version in effect from 1 January 2026.

Club98 collects various categories of personal data depending on the type of interaction you have with our platform. Below is a full breakdown of the data types we collect:

We do not collect sensitive data such as health information, criminal records, or religious information unless specifically required by applicable law.

Your personal data is collected through several different methods throughout your interactions with the Club98 platform:

• During account registration — you enter basic personal information such as name, email, phone number, and date of birth directly.
• During the KYC process — you upload the required identity verification documents before your first withdrawal is processed.
• During financial transactions — your bank account or digital wallet information is recorded when you make a deposit or withdrawal.
• Automatic platform usage — our systems automatically record technical and behavioural data such as IP address, device type, and gaming history using cookies and relevant tracking technologies.
• Customer support communications — when you contact our team via live chat or email, all communications are stored for record-keeping and service improvement purposes.
• Trusted third-party sources — in certain cases, we may receive information from payment providers or third-party identity verification bodies for additional verification purposes.

Every piece of data we collect is used for a specific and legitimate purpose. club98 does not use your data for any other purpose not stated without your prior consent:

• Account management — verifying your identity, processing registration, and maintaining account security.
• Transaction processing — ensuring deposits and withdrawals are processed accurately, securely, and in accordance with your instructions.
• Legal compliance — fulfilling obligations under the PDPA, the Anti-Money Laundering Act 2001 (AMLA), and directives from relevant regulatory bodies.
• Platform security — detecting and preventing fraud, money laundering, multi-account usage, and other unlawful activities.
• Service improvements — analysing usage patterns to improve user experience, fix technical bugs, and develop better new features.
• Marketing communications — sending promotional information, bonuses, and exclusive offers to members who have consented to receive them. You may unsubscribe at any time.
• Responsible gaming — monitoring gameplay patterns to identify potential gambling issues and offer the necessary support to members.

We will not use your data to make automated decisions that negatively affect you without appropriate human review.

Club98 takes a strictly limited approach to sharing members' personal data. We only share data in the following situations:

• Payment service providers — payment gateways and banks involved in processing your deposits and withdrawals. They are bound by strict confidentiality agreements and only receive data necessary to complete the transaction.
• KYC verification providers — third-party services that assist us in verifying your identity and documents to meet regulatory requirements.
• Technology infrastructure providers — companies providing cloud computing, cybersecurity, and analytics services that we use to operate the platform.
• Legal authorities — government agencies, courts, or law enforcement bodies where we are required to do so under applicable Malaysian law, such as criminal investigations or court orders.
• Business transfers — in the event of a company merger, acquisition, or asset sale, personal data may be transferred as part of that transaction. You will be notified in advance.

Data security is at the core of club98's operations. We continuously invest in the latest security infrastructure to protect your information:

• 256-bit SSL/TLS Encryption — all communications between your device and club98's servers are encrypted using the most robust transport layer security protocols.
• Data-at-rest encryption — personal data stored in our databases is also encrypted using AES-256, ensuring the data remains unreadable even in the event of unauthorised access.
• Two-factor authentication (2FA) — members are encouraged to enable 2FA on their accounts for an additional layer of protection during login.
• 24/7 Monitoring — our cybersecurity team continuously monitors systems using advanced AI-powered threat detection tools.
• Regular security audits — we conduct penetration testing (penetration testing) and security audits by independent firms at least twice a year.
• Internal access controls — club98 staff only have access to data required for their specific roles, based on the principle of least privilege.

While we take all reasonable precautions, no digital system can be guaranteed 100% secure. You also play an important role — never share your account password with anyone and ensure the device you use to access club98 is adequately protected.

Club98 uses cookies (cookies) and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential cookies — required for core platform functions such as login, session security, and language preferences. These cookies cannot be disabled as they are critical to website operation.
• Analytics cookies — helping us understand how members use the platform, which pages are most popular, and where technical issues occur. This data is used in aggregate form and does not personally identify you.
• Functionality cookies — remembering your preferences such as display settings, favourite games, and language selection to personalise your experience.
• Performance cookies — optimising platform speed and reliability by identifying technical issues before they affect your experience.

Under Malaysia's PDPA and Club98's internal policies, you have the following rights regarding your personal data. All requests may be sent to us at [email protected] and will be processed within 14 working days:

Club98 retains your personal data only for as long as necessary to fulfil the original purpose of collection or to comply with legal obligations. The following are our data retention guidelines:

• Active account data — retained for the duration your account is active, plus any period required by law.
• Financial transaction records — retained for 7 years after a transaction occurs, in line with Malaysia's tax and financial regulatory requirements.
• KYC Documents — retained for 5 years after account closure, in accordance with Malaysia's AMLA requirements.
• Support communication logs — retained for 3 years for reference and dispute resolution purposes.
• Analytics and cookie data — deleted or anonymised after a period of 12 to 24 months.

Once the retention period expires, your data will be securely deleted using industry-standard data destruction procedures, ensuring no residual data remains.

Club98 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in law, technology, or the way we conduct business. When significant changes occur, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on the club98 homepage for a minimum of 14 days.
• Sending a notification to your registered email for changes that materially affect your privacy rights.

Continued use of the club98 platform after changes take effect is considered your acceptance of the updated policy. If you disagree with the changes, you have the right to close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or the management of your personal data, please contact our Data Protection Officer team:

• Email: [email protected]
• Response time: Within 2 business days for general enquiries; 14 business days for formal data rights requests.
• Language: Bahasa Melayu and English.

We encourage you to contact us directly before filing a complaint with the authorities. In most cases, we can resolve your issue quickly and satisfactorily. However, you also have the right to lodge a complaint with the Malaysia Department of Personal Data Protection if you are not satisfied with our response.