Privacy Policy VA999 — Malaysian Casino Players' Personal Data Protection

This Privacy Policy ("Policy") is published by VA999 ("we", "Company", "Platform") and applies to all users who access or use the VA999 platform at va999-khelo.com and all related services, including the mobile app (if available), email communications, and customer support interactions.

This policy explains in detail:

• What types of personal data we collect from you when you register and use the VA999 platform.
• The purpose and legal basis that authorises us to process that data.
• Who else may access or receive your data besides VA999.
• The technical and organisational measures we use to protect your data.
• Your rights regarding your personal data and how to exercise them.

This Privacy Policy should be read together with VA999 Terms & Conditions which is the overarching agreement governing the relationship between you and the VA999 platform.

VA999 collects several categories of personal data depending on how you interact with our platform. Below is a comprehensive overview of the data we may collect:

Identity Data (collected during registration):

• Full name as it appears on your identification document.
• An active Malaysian mobile phone number.
• A valid and active email address.
• Date of birth (for age verification — players must be 18 years of age or older).
• National identity card number (MyKad) — only requested during the KYC process for identity verification on withdrawals that exceed a specified limit.

Financial Data (collected during transactions):

• The phone number or e-wallet account ID used (Touch 'n Go, GrabPay, Boost, ShopeePay).
• Bank account information for FPX (Maybank2u, CIMB Clicks) — account numbers are stored in encrypted format.
• Deposit and withdrawal transaction history, including amounts, dates, times, and payment methods.
• VA999 does not store credit or debit card numbers directly — all card processing is handled through payment gateways that comply with PCI-DSS standards.

Technical Data (collected automatically):

• Your device's IP address at the time of each login session.
• Device type, model, operating system, and browser version used.
• Cookie data and session identifiers for secure session management.
• Access and activity logs within the platform, including games played, bets placed, and account actions.

VA999 only uses your personal data for legitimate and reasonable purposes. We do not use your data for any purpose you have not consented to. The following is a complete list of how your data is used at VA999:

Primary Purpose (required for the service):

• Creating, verifying, and managing your VA999 player account.
• Processing deposits and withdrawals via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX securely and accurately.
• Verifying your identity during the KYC process to meet legal compliance requirements.
• Detecting and preventing fraud, money laundering, and other suspicious activity.
• Providing effective customer support — our team requires access to your account information in order to resolve your issues.
• Securing your account — detecting logins from unfamiliar devices or suspicious locations.

Secondary Purposes (for service improvement):

• Analysing platform usage patterns in aggregate and anonymised form to identify areas for improvement.
• Sending account-related communications — transaction confirmations, security notifications, and platform updates.
• Sending relevant VA999 promotional offers — only if you have given consent to receive marketing communications.
• Monitoring compliance with the responsible gaming programme — identifying players who may need support.

VA999 does not sell, rent, or share players' personal data with third parties for their own marketing purposes. However, there are limited circumstances in which VA999 needs to share data with certain parties in order for our services to function:

Authorised Service Providers:

• Game Software Providers — Pragmatic Play, PG Soft, Evolution Gaming, and other providers receive only the minimum session data necessary to deliver games to you. They do not receive financial information or personal identification details that are not required.
• Payment Gateway — Payment service providers for Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX receive the transaction information required to process your payments. All of these providers are licensed entities operating in Malaysia and are subject to Bank Negara Malaysia regulations.
• Cloud Service Provider — VA999's server infrastructure is operated through cloud service providers that comply with international security standards. Data stored in the cloud is protected with robust encryption.
• KYC Verification Services — A third-party identity verification service provider that assists in validating the authenticity of identification documents submitted.

Legally Mandated Disclosure:

VA999 may disclose your personal data to Malaysian government authorities or law enforcement bodies if required to do so by court order, legal process, or legal obligations enforceable in Malaysia — including investigations related to money laundering or terrorism financing.

VA999 implements multiple layers of technical and organisational safeguards to protect players' personal data from unauthorised access, loss, alteration, or disclosure:

• Transmission Encryption: All communications between your browser or app and VA999's servers are protected by TLS 1.3 and 256-bit SSL encryption — the strongest standard commercially available today.
• Storage Encryption: Sensitive data such as financial information and identification documents are stored in encrypted format on VA999 servers using AES-256 encryption.
• Two-Factor Authentication (2FA): VA999 offers and encourages the use of two-factor authentication for login — adding an extra layer of security that protects your account even if your password is compromised.
• Real-Time Monitoring: VA999's threat monitoring system operates 24 hours a day to detect and block any unauthorised access attempts or suspicious activity in real time.
• Internal Access Controls: Access to player data among VA999 staff is restricted to individuals who require it to perform their duties — enforced through role-based access control (RBAC) and reviewed regularly through audits.
• Regular Security Testing: VA999 conducts regular penetration testing and security audits by independent security experts to identify and address any vulnerabilities before they can be exploited.

While VA999 takes all reasonable steps to protect your data, no security system can be guaranteed 100% secure. We encourage players to take their own precautions as well — use a strong, unique password for your VA999 account, enable 2FA, and never share your login credentials with anyone.

VA999 uses cookies and similar tracking technologies to enable platform functionality, enhance the user experience, and understand how the platform is used. The following is an explanation of the types of cookies we use:

Mandatory Cookies (cannot be disabled):

• Session identifier — stores your active login session information to keep you signed in as you navigate the VA999 platform.
• CSRF security token — protects your account against cross-site request forgery attacks.
• Language and country preferences — stores your regional settings so you do not have to reconfigure them every time.

Functional Cookies (enhance your experience):

• Saves your last game preferences and display settings.
• Remembers your favourite games or tables for faster access.
• Saves form information for convenience — such as your username on the login page.

Analytics Cookies (with consent):

• Collects anonymised usage data to help VA999 understand which pages or games are most popular and which areas need improvement.
• Measuring platform performance — including page load times, error rates, and other usage statistics.

As a VA999 player whose personal data we process, you have the following rights, which you may exercise at any time:

VA999 adheres to the principle of data minimisation — we do not retain your personal data for longer than is necessary for the purposes set out in this Policy. The following are retention period guidelines for key data categories:

• Active Account Data: Retained for the full duration of your active membership with VA999.
• Financial Transaction Data: Retained for a minimum of 7 years from the transaction date in line with Malaysian financial legislation requirements for audit and AML compliance purposes.
• KYC Documents: Retained for a minimum of 5 years after account closure or from the date of submission, whichever is later.
• Technical Logs: Security and access logs are retained for 12 months for threat detection and security incident investigation purposes.
• Game Data: Game history is retained for the duration of your active membership and for up to 2 years after account closure for dispute resolution purposes.
• Support Communications: Communication records with the support team are retained for 3 years for reference and service improvement purposes.

Once the relevant retention period has expired, your data will be securely deleted from all VA999 systems using methods that ensure the data cannot be recovered.

The VA999 platform is intended exclusively for adults aged 18 and above. VA999 does not knowingly collect or process personal data from individuals under the age of 18.

VA999 takes several proactive measures to prevent underage access:

• Age verification during the registration process — applicants are required to confirm that they are 18 years of age or older.
• A KYC process requiring photo identification documents for withdrawals above a certain threshold — indirectly verifying age.
• A detection system that monitors usage patterns which may indicate an account is being used by a minor.

VA999 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, applicable law, or developments in our services. Whenever we make material changes to this Policy, we will:

• Updating the "Last updated" date at the top of this document.
• Notifying all active VA999 players via their registered email at least 7 days before any changes take effect.
• Displaying a clear notice within the VA999 platform during your first login session after the changes take effect.

Continued use of the VA999 platform after the effective date of any Privacy Policy change constitutes your acceptance of the updated Policy. If you do not agree with the changes made, you have the right to close your account and request data deletion in accordance with the procedures set out in Sections 7 and 8 above.

Previous versions of the VA999 Privacy Policy are available upon request by emailing our privacy team for reference.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how VA999 handles your personal data, please contact the VA999 Privacy Officer through the following channels:

When contacting us regarding privacy matters, please clearly state:

• Your VA999 account username or registered phone number (for identity verification).
• The nature of your request or complaint (data access, correction, deletion, unauthorised use complaint, etc.).
• Sufficient details about the issue you are experiencing to allow us to investigate effectively.

VA999 is committed to handling all privacy enquiries and complaints seriously, promptly, and in strict confidence. We will not discriminate against or treat you differently because you have exercised your privacy rights.