ceo99 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how ceo99 ("ceo99", "we", "us", "our"), the operator of the online gaming platform available at ceo99.asia ("the Platform"), collects, uses, stores, shares, and protects personal data relating to users of the Platform ("you", "your", "the Player").

This Policy applies to all personal data processed by ceo99 in connection with your use of the Platform, including data collected during account registration, gameplay, deposit and withdrawal transactions, customer support interactions, and participation in promotions.

By registering an account and using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the Platform.

2. Data Controller Information

For the purposes of applicable data protection legislation, ceo99 is the data controller in respect of personal data collected and processed through the Platform. ceo99 operates under international gaming authority licensing and adheres to the data governance requirements of its licensing jurisdiction.

ceo99's data protection contact for enquiries, complaints, and rights requests is reachable via the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 Registration and Identity Data

When you create a ceo99 account, we collect the information you provide during registration, including:

• Full legal name;
• Date of birth (to verify age eligibility — players must be 21 or older);
• Residential address (including city and postcode);
• Email address;
• Mobile phone number; and
• Username and encrypted password.

3.2 Identity Verification Data

To comply with our licensing obligations and anti-money laundering requirements, ceo99 may request and collect copies of identity documents, including:

• National identity card (MyKad) or passport;
• Proof of address documents (utility bills, bank statements); and
• Source of funds documentation where required by regulatory thresholds.

3.3 Financial and Transaction Data

We collect details of all financial transactions conducted through your ceo99 account, including deposit amounts, withdrawal requests, payment method identifiers (masked account numbers, e-wallet identifiers), and transaction timestamps. Full payment card numbers are never stored by ceo99.

3.4 Gaming and Betting Activity Data

ceo99 records all gaming and betting activity associated with your account, including game sessions, bet histories, outcomes, and bonus utilisation, for operational, regulatory, and responsible gaming purposes.

3.5 Technical and Device Data

When you access the Platform, we automatically collect technical data including your IP address, device type, operating system, browser type and version, session duration, and pages accessed.

3.6 Communications Data

We retain records of communications between you and ceo99 customer support, including live chat transcripts and email correspondence, for quality assurance and dispute resolution purposes.

4. How We Collect Your Data

ceo99 collects personal data through the following means:

• Directly from you — information you provide during registration, account updates, identity verification, customer support contacts, and promotion participation;
• Automatically — technical and usage data collected through cookies, server logs, and similar tracking technologies when you access the Platform; and
• From third parties — identity verification data from third-party KYC providers, fraud screening data from payment processors, and public records for regulatory compliance purposes.

5. Purposes and Legal Basis for Processing

ceo99 processes your personal data for the following purposes, each supported by an identified legal basis:

• Account creation and management — necessary for the performance of our contract with you as a Platform user;
• Transaction processing — necessary for the performance of our contract and compliance with financial regulations;
• Identity verification and KYC — required by our licensing obligations and applicable anti-money laundering law;
• Fraud prevention and security — necessary for our legitimate interests in protecting the Platform and our players;
• Regulatory reporting — required compliance obligation under our international gaming authority licence;
• Responsible gaming monitoring — legitimate interest in protecting player wellbeing and compliance with licensing requirements;
• Customer support — necessary for the performance of our contract and our legitimate interests in service quality; and
• Marketing communications — based on your consent, which may be withdrawn at any time.

6. Data Sharing and Disclosure

ceo99 does not sell, rent, or trade personal data. We share personal data only in the following limited circumstances:

• Payment processors — to facilitate deposit and withdrawal transactions via Touch n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported Malaysian bank portals. These processors act as independent data controllers for transaction data;
• Identity verification and KYC providers — third-party service providers engaged to perform identity and fraud screening on our behalf, acting as data processors under contract;
• Game content providers — live casino studios and slot game providers may receive limited session data necessary to operate their games within the Platform;
• Regulatory authorities — ceo99 may be required to disclose personal data to its licensing authority, financial intelligence units, or law enforcement agencies under applicable legal obligations; and
• Professional advisers — legal, accounting, and auditing firms, subject to confidentiality obligations, where necessary for ceo99's business operations.

All third-party processors engaged by ceo99 are contractually bound to process personal data only on ceo99's documented instructions and to implement appropriate security measures.

7. International Data Transfers

Due to the nature of ceo99's international licensing and the use of globally operating technology and payment infrastructure, your personal data may be transferred to and processed in countries other than Malaysia. Where such transfers occur, ceo99 ensures that appropriate safeguards are in place in accordance with applicable data protection law, including contractual protections with data processors.

By using the Platform, you acknowledge and consent to such international transfers occurring where necessary for the provision of ceo99's services.

8. Data Retention

ceo99 retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to the following minimum retention requirements:

• Account and identity data — retained for the duration of the account relationship and for a minimum of 5 years following account closure, in accordance with anti-money laundering regulatory requirements;
• Transaction records — retained for a minimum of 5 years from the date of transaction;
• Betting and gaming records — retained for a minimum of 3 years;
• Customer support records — retained for 2 years from the date of the final communication; and
• Marketing preferences — retained until consent is withdrawn and for 1 year thereafter for compliance records.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders individual re-identification impossible.

9. Cookies and Tracking Technologies

ceo99 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies — required for basic Platform functionality, session management, and security. These cannot be disabled without impairing Platform functionality;
• Functional cookies — remember your preferences and settings to improve your experience across sessions;
• Analytics cookies — collect anonymised data about how players interact with the Platform to improve performance and usability; and
• Security cookies — assist in detecting and preventing fraudulent activity and unauthorised account access.

ceo99 does not use third-party advertising or retargeting cookies. You may manage non-essential cookie preferences through your browser settings. Note that disabling cookies may affect certain Platform features.

10. Security Measures

ceo99 implements a multi-layered security framework to protect personal data, including:

• 256-bit SSL/TLS encryption for all data in transit;
• Encrypted storage of sensitive data at rest;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Automated anomaly detection for suspicious login and transaction patterns;
• Regular penetration testing and security audits of Platform infrastructure; and
• Incident response procedures including player notification protocols for data breaches meeting applicable notification thresholds.

11. Your Rights

Subject to applicable law and regulatory limitations (including retention requirements under our licensing obligations), you have the following rights in respect of your personal data held by ceo99:

• Right of Access: You may request a copy of the personal data ceo99 holds about you;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to regulatory retention obligations;
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances;
• Right to Data Portability: You may request your data in a machine-readable format where technically feasible; and
• Right to Object: You may object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, contact ceo99 via the details in Section 14. We will respond to verifiable requests within 30 days. We may require identity verification before processing a rights request.

12. Children and Minors

The ceo99 Platform is strictly for individuals aged 21 years and above. ceo99 does not knowingly collect personal data from persons under the age of 21. If ceo99 becomes aware that a person under the age of 21 has registered an account or provided personal data, the account will be immediately suspended, any funds forfeited, and the data deleted in accordance with applicable law.

If you become aware that a minor has used the Platform or provided personal data to ceo99, please contact us immediately via the channels in Section 14.

13. Changes to This Policy

ceo99 reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered players via email to their registered address or by prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Platform following notification of changes constitutes acceptance of the revised Policy.

14. Contact and Data Requests

For privacy-related enquiries, data rights requests, or complaints regarding ceo99's data practices, please contact us through the following channels:

• Live Chat: Available 24/7 via the Platform — the fastest channel for general queries
• Email: [email protected] — for formal data rights requests and written complaints

ceo99 will acknowledge data rights requests within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or ceo99 receives a high volume of requests, we may extend this period by a further 30 days with notification to you.

If you are not satisfied with ceo99's response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.