FA99 Privacy Policy

This Privacy Policy ("Policy") is issued by FA99 ("FA99", "we", "us" or "our"), the operator of the online casino and sports betting platform accessible at fa99.casa (the "Platform"). This Policy describes how FA99 collects, uses, stores, shares and protects the personal data of individuals ("you", "your" or "User") who access or use the Platform, whether as a registered member or an anonymous visitor.

FA99 is committed to handling personal data responsibly and in accordance with applicable data protection principles. We treat privacy not as a compliance checkbox but as a foundational element of the trust relationship between FA99 and the hundreds of thousands of Malaysian players — from Kuala Lumpur and Petaling Jaya to Penang, Johor Bahru and Shah Alam — who rely on our platform for their gaming and betting activity.

By accessing the Platform, creating an account, or otherwise interacting with FA99's services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you should discontinue use of the Platform.

This Policy should be read in conjunction with FA99's Terms & Conditions, which govern the overall use of the Platform and are incorporated herein by reference.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, deletion and destruction.
• "Data Controller" — FA99, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — any third-party entity that processes personal data on behalf of FA99, including payment gateway providers, KYC verification services and cloud infrastructure partners.
• "Member" or "User" — any individual who has registered an account on the FA99 Platform or who accesses the Platform as a visitor.
• "KYC" — Know Your Customer; the identity verification process required for account compliance, conducted in accordance with applicable anti-money laundering standards.
• "Cookies" — small text files placed on your device by the Platform or third-party services to store information about your browsing session, preferences and activity.
• "Consent" — a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a defined purpose.

FA99 collects personal data across several categories, depending on your level of interaction with the Platform. The categories of data we collect include:

FA99 does not knowingly collect sensitive personal data (such as racial origin, religious beliefs, health data or biometric data) unless specifically required by law or expressly consented to by the Member for a defined purpose.

FA99 collects personal data through the following means:

• Direct interactions: Data you provide voluntarily when creating an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or responding to surveys and promotions.
• Automated technologies: Technical and behavioural data collected automatically when you access the Platform, including via cookies, web beacons, server logs and session tracking tools. See Section 10 for more detail on cookies.
• Third-party sources: Identity verification services, payment processors (Maybank, CIMB, Public Bank, Hong Leong, RHB, DuitNow, FPX), fraud prevention partners and public databases consulted in connection with KYC obligations or fraud risk assessment.
• Referral programmes: If you were referred to FA99 by an existing member, limited data about the referral event may be received from the referring member as part of the promotion mechanism.

FA99 processes your personal data only for defined, legitimate purposes. The primary purposes for which your data is processed include:

• Account management: To create, maintain and administer your FA99 account, including authentication, profile management and account security.
• Service delivery: To provide access to games, sports betting, promotions, live casino and all other Platform features that form the core of the FA99 service.
• Payment processing: To facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, Maybank, CIMB, Public Bank, Hong Leong and RHB, and to maintain accurate financial records.
• KYC and identity verification: To verify your identity and age in compliance with responsible gambling and anti-money laundering obligations.
• Fraud prevention and security: To detect, investigate and prevent fraudulent transactions, collusion, account takeovers and other prohibited conduct as described in our Terms & Conditions.
• Customer support: To respond to your enquiries, resolve disputes and process complaints through our live chat and email support channels.
• Responsible gambling: To monitor gameplay patterns for signs of problem gambling behaviour, administer deposit limits, cooling-off periods and self-exclusion requests, and to fulfil our duty of care to members.
• Marketing and promotions: To notify you of relevant bonuses, seasonal promotions (including Hari Raya offers) and platform updates, where you have consented to receive such communications.
• Platform improvement: To analyse aggregated usage patterns and performance data to improve the functionality, stability and content of the FA99 Platform.
• Legal compliance: To fulfil record-keeping, reporting and disclosure obligations under applicable laws and regulations.

FA99 processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the account agreement with you, including service delivery, payment processing and account management.
• Legal obligation: Processing required to comply with applicable laws, including KYC requirements, anti-money laundering regulations and record-retention obligations.
• Legitimate interests: Processing conducted for FA99's legitimate business interests — including fraud prevention, platform security and service improvement — where such interests are not overridden by your rights and freedoms.
• Consent: Processing for purposes to which you have provided explicit, informed consent, most notably direct marketing communications. You retain the right to withdraw this consent at any time.

FA99 does not sell or trade your personal data. We may share your data with the following categories of recipients, strictly limited to what is necessary for the purposes described in this Policy:

• Payment processors and financial institutions: Maybank, CIMB, Public Bank, Hong Leong, RHB, DuitNow, FPX gateway operators, Touch 'n Go eWallet, GrabPay and Boost — solely for the purpose of processing your transactions.
• Identity verification and KYC service providers: Third-party services engaged to verify member identity documents and perform age verification in accordance with our responsible gambling obligations.
• Fraud prevention and security partners: Specialist providers engaged to detect and prevent fraudulent activity, account takeovers and money laundering.
• Cloud infrastructure and hosting providers: Third-party data centres and cloud service providers that host the FA99 Platform and its associated databases, operating under strict data processing agreements.
• Regulatory and law enforcement authorities: Where FA99 is required to disclose data by applicable law, court order or legitimate regulatory request, we will comply in accordance with the scope of the request and where legally permissible, notify you of the disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of assets involving FA99, personal data may be transferred to the successor entity as part of that transaction, subject to equivalent privacy protections.

FA99 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following retention guidelines:

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where deletion is not technically immediately feasible (e.g., backup storage), data is isolated and protected from further active processing until deletion is completed.

FA99 implements a multi-layered security framework to protect your personal data against unauthorised access, accidental loss, disclosure, destruction or alteration. Key measures include:

• Transport Layer Security: All data transmitted between your device and the FA99 Platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• Data at Rest Encryption: Personal data stored on FA99's servers is encrypted using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to member data are subject to confidentiality obligations and undergo regular data privacy training.
• Two-Factor Authentication (2FA): Available for all member accounts to provide an additional layer of protection against unauthorised login.
• Intrusion Detection and Monitoring: FA99 deploys continuous automated monitoring for unusual access patterns, potential intrusions and data anomalies across all platform infrastructure.
• Vulnerability Management: Regular security assessments and penetration testing are conducted to identify and remediate potential vulnerabilities before they can be exploited.
• Data Breach Response: FA99 maintains a documented incident response plan. In the event of a data breach that poses a risk to your rights, we will notify affected Members promptly in accordance with applicable regulatory requirements.

The FA99 Platform uses cookies and similar tracking technologies to enhance your user experience, maintain session integrity, analyse platform performance and support certain security functions.

The categories of cookies used on the Platform include:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies and security tokens. They cannot be disabled without impacting Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how Members interact with the Platform — including page load times, error events and navigation paths — to help us identify and resolve issues and improve the user experience.
• Functional Cookies: Used to remember your preferences, such as language settings, display options and previously selected game categories, to personalise your experience on return visits.
• Security Cookies: Used to authenticate Members, prevent fraudulent use of login credentials and protect Platform integrity against cross-site request forgery (CSRF) and related attack vectors.

As a data subject whose personal information is processed by FA99, you hold the following rights with respect to your personal data. These rights may be exercised at any time by contacting FA99 through the support channels listed in Section 15:

FA99 will respond to all verified data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for the delay.

FA99 is strictly an adult entertainment platform. The Platform is not directed at, and FA99 does not knowingly collect personal data from, individuals under the age of 21. Persons under the age of 21 are prohibited from registering an account, accessing the Platform or placing any wager.

FA99 employs age verification procedures during registration and KYC review specifically to prevent underage access. Where FA99 becomes aware that personal data of a person under the age of 21 has been collected, we will take immediate steps to delete such data and close the associated account.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on the FA99 Platform without your knowledge, please contact our support team immediately at [email protected] and we will act promptly to address the matter.

FA99's primary operations and data infrastructure are designed to serve Malaysian users. Certain third-party service providers engaged by FA99 — including cloud hosting partners, payment processors and security vendors — may process personal data in jurisdictions outside Malaysia.

Where personal data is transferred internationally, FA99 takes appropriate contractual and technical measures to ensure that such transfers comply with applicable data protection requirements and that your data receives a standard of protection equivalent to that described in this Policy. This includes requiring recipient parties to execute Data Processing Agreements that impose obligations consistent with this Policy.

FA99 reserves the right to update, revise or replace this Privacy Policy at any time. All revisions will be reflected in an updated "Last Updated" date at the top of this page. Where changes are material in nature, FA99 may notify registered Members via email or an in-platform notification, though such notification is provided as a courtesy and does not alter your obligation to review this Policy periodically.

Your continued use of the FA99 Platform following any revision to this Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure by contacting our support team.

If you have any questions, concerns or requests regarding this Privacy Policy or FA99's data handling practices, please contact our support team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget accessible from the FA99 homepage. First response typically within 90 seconds.

For formal data rights requests (access, erasure, portability), please email [email protected] with the subject line "Data Rights Request — [Your Request Type]" and include your registered account email address and a brief description of your request. We will acknowledge receipt within two (2) business days and action your request within 30 calendar days.