KIS 999 Privacy Policy — Our Commitment to Protecting the Personal Data of Malaysian Members

This Privacy Policy ("Policy") is published by KIS 999 (kis999.best) and applies to all registered members, unregistered users browsing the platform, and any individual who interacts with KIS 999 services in any capacity. This document transparently explains how KIS 999 collects, processes, stores, and protects your personal data.

KIS 999 is the responsible data controller for all personal data collected through our platform. We operate in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and are committed to handling your data in a manner that is fair, lawful, and transparent.

This policy covers all KIS 999 services, including the online casino platform (slots, Live Casino, blackjack, table games, arcade games), the Sports Betting section (Malaysia Super League football, EPL, BWF badminton, MPL Malaysia esports), the payment system, the VIP Rewards programme, and all customer support communication channels.

If you have any questions about this Privacy Policy or how KIS 999 manages your data, please contact our Data Protection Officer at privacy@kis999.best. We are committed to responding to all privacy-related enquiries within 5 business days.

KIS 999 collects personal data through three main channels: information you provide directly, data generated automatically during your use of the platform, and in certain cases, data from third parties required for identity verification.

Data you provide directly:

• Full name as shown on official Malaysian identification documents (MyKad or passport)
• Date of birth for 18+ age verification
• Active email address for account communications
• Malaysian mobile number for two-factor authentication and notifications
• Payment method details — Touch 'n Go e-wallet number, GrabPay ID, DuitNow ID, or bank account details for FPX (Maybank2u, CIMB Clicks) for payment identity verification purposes
• Any documents submitted during the identity verification (KYC) process

Automatically generated data:

• IP address and ISP network information (Unifi, Maxis, Celcom, TIME, etc.)
• Device type, operating system, and browser version used
• Game history including slots played, bets placed, and game outcomes
• Sports betting history, including matches wagered on, bet types, and amounts
• Session timestamps, pages visited, and navigation patterns within the platform
• Deposit and withdrawal transaction records

KIS 999 processes member personal data for the following purposes. Each purpose is lawful and necessary for the delivery of quality services:

• Account management — Creating and maintaining member accounts, processing registrations, and providing secure access to the KIS 999 platform
• Identity verification — Ensures compliance with the 18-year age limit and verifies member identity in accordance with PDPA requirements and KYC (Know Your Customer) procedures
• Payment processing — Processing deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX, as well as withdrawals to the same payment methods
• Gaming service delivery — Maintains game history, processes wins and losses, and ensures the integrity of all slots, Live Casino, blackjack, and Sports Betting games
• VIP Rewards Programme — Manages points, membership tiers, and benefits under the KIS 999 VIP programme based on playing activity
• Security and fraud prevention — Detecting and preventing fraud, money laundering, multi-account abuse, and any activity that violates KIS 999's Terms & Conditions
• Service communications — Sending transaction notifications, account updates, security information, and responses to customer support enquiries
• Platform improvement — Analysing usage patterns on an aggregated, non-identifiable basis for product development and user experience improvement
• Legal compliance — To fulfil legal obligations under Malaysia's PDPA and reporting requirements set by the relevant authorities

KIS 999 does not process your personal data for any purpose not stated above without first obtaining your fresh consent. Should we ever wish to use your data for a new purpose, you will be informed and asked for consent before processing begins.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), KIS 999 must have a valid legal basis for processing your personal data. The bases we rely on for each processing category are as follows:

• Consent — For direct marketing, non-essential cookie processing, and the use of data for product improvement analytics. You may withdraw your consent at any time.
• Contract — For processing necessary to fulfil the service agreement between you and KIS 999, including account management, payment processing, and game delivery.
• Legitimate Interest — For fraud prevention, platform security, and service improvement through anonymised aggregate analytics. KIS 999 conducts legitimate interest assessments to ensure our interests do not override your privacy rights.
• Legal Obligation — For PDPA compliance, KYC/AML (Anti-Money Laundering) requirements, and any reporting obligations to the relevant Malaysian authorities.

KIS 999 does not sell, rent, or share members' personal data with any third party for their own marketing or commercial purposes. This is an absolute commitment. However, there are limited circumstances in which KIS 999 needs to share data with certain parties in the context of service delivery:

• Game providers — Evolution Gaming, Pragmatic Play, PG Soft, Spribe, and other providers receive only the minimum technical data required to maintain game sessions (e.g., anonymised member IDs with no real names). These providers are bound by strict data processing agreements.
• Payment gateway — Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX providers receive the payment information required to process transactions. They are independent data controllers subject to Malaysian financial regulations.
• Technology infrastructure services — Hosting, cybersecurity, and analytics service providers that assist KIS 999 in operating the platform securely. All are bound by strict confidentiality agreements and may only use data for purposes specified by KIS 999.
• Legal authorities — Where required by Malaysian law, a valid court order, or a request from Malaysian law enforcement authorities.
• Preventing financial crime — Mandatory reporting to the relevant authorities in Malaysia for anti-money laundering (AML) and counter-terrorism financing (CTF) purposes, in compliance with the Anti-Money Laundering Act 2001.

In all of the above cases, KIS 999 ensures that only the minimum necessary data is shared, and that recipients are held to data protection obligations equivalent to our own standards.

KIS 999 continually invests in security infrastructure to ensure member personal data is always protected to the highest standard. The technical and organisational security measures we implement include:

• Encryption in transit — All communications between your device and KIS 999 servers are encrypted using TLS 1.3 protocol with 256-bit SSL certificates. This ensures your data cannot be intercepted in transit.
• Encryption at rest — Sensitive data stored in KIS 999's databases — including identity information and financial records — is encrypted using AES-256 algorithms.
• Tiered access control — A role-based access control (RBAC) system ensures each KIS 999 staff member can only access the data necessary for their specific job responsibilities.
• Two-factor authentication (2FA) — Available and encouraged for all member accounts. Mandatory for KIS 999 internal administrative operations.
• 24/7 security monitoring — A SIEM (Security Information and Event Management) system continuously monitors for suspicious activity and sends immediate alerts to the KIS 999 security team.
• Regular penetration testing — KIS 999 conducts regular security testing and independent audits to identify and address vulnerabilities before they can be exploited.
• Secure data backup — Data is regularly backed up to a separate, encrypted location to ensure recovery in the event of an incident.

KIS 999 retains your personal data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by Malaysian law. Our specific retention practices are as follows:

• Active account data — Retained for as long as your KIS 999 account remains active. If your account is closed at your request, personal data not required for legal or complaint purposes will be deleted within 90 days.
• Financial transaction records — Retained for 7 years after the transaction, in line with Malaysian legal requirements on financial records and AML/CTF compliance.
• Identity verification documents (KYC) — Retained for the duration of the active account and 5 years after account closure, in accordance with the Anti-Money Laundering Act 2001.
• Game and Sports Betting logs — Retained for 3 years for dispute resolution and internal audit purposes.
• Customer support communication logs — Retained for 2 years for service reference and quality improvement purposes.
• Cookie and analytics data — Session cookies expire automatically when the session ends. Functional cookies are retained for up to 12 months. Aggregate analytics data with no individual identifiers is retained indefinitely.

Once the retention period expires, data will be securely deleted or permanently anonymised so that it can no longer be linked to any specific individual. The deletion process follows industry-recognised secure deletion standards.

The KIS 999 platform uses cookies and similar tracking technologies to keep the platform running smoothly, enhance user experience, and understand how the platform is being used. Below is a table of the cookie types we use:

Essential cookies cannot be disabled as they are required for core platform functions such as secure login and security protection. Functional and analytics cookies can be controlled through your browser settings. Disabling all cookies may cause some KIS 999 platform features to not work properly.

As a KIS 999 member whose data is processed under Malaysia's PDPA, you have the following rights regarding your personal data. KIS 999 is committed to respecting and facilitating the exercise of these rights:

• Right to Access — You have the right to request a copy of the personal data KIS 999 holds about you. Requests will be processed within 21 business days.
• Right to Rectification — If your personal data is inaccurate or out of date, you have the right to request a correction. Changes to basic account information can be made directly in your account settings.
• Right to Erasure — You may request the deletion of your personal data ("right to be forgotten") in certain circumstances, subject to any legal retention obligations we are required to comply with.
• Right to Restrict Processing — In certain circumstances, you may request that KIS 999 restrict how your data is processed while a pending issue is being resolved.
• Right to Object — You have the right to object to data processing based on legitimate interests, including direct marketing. Objections to direct marketing will be processed within 10 business days.
• Data Portability Rights — You have the right to receive your data in a structured, machine-readable format and to transfer it to another data controller should you choose to do so.
• Right to Withdraw Consent — Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the validity of any processing that took place prior to that point.

To exercise any of the rights listed above, please email your request to privacy@kis999.best with the subject line "PRIVACY RIGHTS REQUEST", including your account number and details of the right you wish to exercise. We will verify your identity before processing the request to protect your privacy.

In the context of delivering online casino services, certain data may be processed or stored on servers located outside Malaysia. This occurs primarily in connection with services provided by international game providers such as Evolution Gaming and Pragmatic Play, which operate their Live Casino broadcast studios from various locations around the world.

KIS 999 ensures that all cross-border data transfers are protected by appropriate safeguarding mechanisms:

• Binding data processing agreements with all service providers who receive KIS 999 member data
• Data Protection Impact Assessments (DPIA) for data transfers to countries that may not have data protection standards equivalent to Malaysia's
• Standard contractual clauses ensuring providers comply with data protection standards equivalent to Malaysia's PDPA
• End-to-end encryption for all data transferred across borders

If you would like to know more about cross-border data transfers relating to your account or the safeguards in place, please contact our Data Protection Officer at privacy@kis999.best.

The KIS 999 platform is intended solely for individuals aged 18 and above. KIS 999 does not knowingly collect, process, or store personal data from individuals under the age of 18. Registration by minors is strictly prohibited under the KIS 999 Terms & Conditions.

If we discover or suspect that personal data belonging to an individual under the age of 18 has been collected without valid parental or guardian consent, we will take immediate action to delete that data and close the relevant account. KIS 999 will report such incidents to the relevant authorities where appropriate.

If you are a parent or guardian and believe your underage child has registered an account on KIS 999, please contact us immediately at privacy@kis999.best or via live chat. We will investigate and take appropriate action within 24 hours.

KIS 999 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or service improvements. Material changes will be communicated to members through:

• Email notification sent to the registered address on your account
• In-platform notice at login for a defined period following the effective date of any changes
• A clearly visible updated "Last Updated" date at the top of this page

For minor changes such as correcting typographical errors or clarifications that do not affect how data is processed, an email notification may not be sent, but the update date on this page will be revised accordingly.

We encourage you to revisit this Privacy Policy page periodically. The latest version is always available at kis999.best/privacy-policy. Continued use of the KIS 999 platform following any amendment constitutes acceptance of the updated Privacy Policy.

KIS 999 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with Malaysia's PDPA and handling all privacy-related enquiries and complaints. For any matters concerning this Privacy Policy or the processing of your personal data, please get in touch via:

• Privacy Officer Email: privacy@kis999.best
• General Support Email: support@kis999.best
• Live Chat: Available 24/7 through the KIS 999 platform for urgent privacy enquiries

In your email, please include your KIS 999 account number, a brief description of your enquiry or complaint, and your preferred contact details for our response. All privacy enquiries will be handled in strict confidence and responded to within 5 business days.

For formal complaints that cannot be resolved through KIS 999's internal channels, you have the right to refer the matter to the Department of Personal Data Protection Malaysia (JPDP), which oversees PDPA compliance in Malaysia.