Privacy Policy m999 — Data Protection Malaysian Players

M999 collects personal information from Malaysian players across the following categories:

M999 does not collect sensitive information such as medical data, religion, political views, or biometric information. We also do not accept direct credit or debit card payments — all transactions are processed through the Malaysian e-wallet and online banking methods stated above.

Information collected automatically (technical and usage data) is gathered through cookies, server logs, and industry-standard tracking technologies. See Section 6 for more details on cookies.

M999 uses collected personal data solely for the following purposes. Each purpose has a clear legal basis under PDPA 2010:

• Account management and service delivery: To process registration, verify identity, enable secure login, and provide access to all m999 games and services.
• Financial transaction processing: To process deposits via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX, Maybank2u and CIMB Clicks, and to process withdrawals to verified accounts.
• Identity verification and fraud prevention: To verify that players are real individuals aged 18 and above, prevent the creation of multiple accounts, and detect suspicious or potentially fraudulent activity.
• Customer support: To resolve complaints, respond to enquiries, and provide technical assistance in Bahasa Malaysia via Live Chat and email.
• Legal compliance: To comply with Malaysian legal obligations, including anti-money laundering (AML) requirements and financial reporting obligations.
• Marketing communications (with consent): To send promotional information, bonus offers and the latest m999 news via SMS or email — only where you have given consent at registration. You may withdraw this consent at any time.
• Platform improvements: To analyse usage data in aggregate — not at an individual level — in order to understand usage patterns and improve the performance and user experience of the m999 platform.
• Responsible gaming: To monitor gameplay patterns and identify players who may need responsible gaming support — based on limits set by the players themselves.

M999 does not use personal data for any purpose beyond those listed above without first obtaining fresh consent from the player.

M999 does not sell, rent or exchange players' personal data to any third party for marketing or commercial purposes. However, to deliver a complete online casino experience to Malaysian players, m999 needs to share certain data with the following categories of third parties:

• Payment platform providers: Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and banks supporting FPX receive the transaction information necessary to process your deposits and withdrawals. These providers operate under their own privacy policies governing how your data is used within their systems.
• Game providers: Companies such as Pragmatic Play, PG Soft, Evolution Gaming, Habanero, and Spadegaming receive the player ID required to grant access to their games within the m999 platform. They do not receive your full name or financial information.
• Technical service providers: Companies providing server infrastructure, cybersecurity systems, and analytics services necessary for the operation of the m999 platform may access technical data in the course of carrying out their duties.
• Government bodies and law enforcement: m999 will disclose personal data to Malaysian authorities where required by court order, official law enforcement requests, or statutory reporting obligations such as AML requirements.

In all data sharing scenarios described above, only the minimum data necessary for that specific purpose is shared — the "data minimisation" principle established under PDPA 2010.

M999 implements a range of technical and organisational security measures to protect players' personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All data in transit between your browser and m999's servers is encrypted to the 256-bit SSL/TLS standard, ensuring sensitive information cannot be intercepted.
• Data encryption at rest: Sensitive data stored in m999's databases — including passwords and financial information — is encrypted using strong hashing algorithms. Even m999 staff are unable to view your original password.
• Two-step verification (2FA): Players are encouraged to enable 2FA via SMS OTP for an additional layer of protection during login and withdrawals.
• Role-based access control: Only m999 staff who require access to specific data to perform their duties are granted access — and every instance of access is recorded in an audit log.
• Continuous security monitoring: m999's automated monitoring system runs 24/7 to detect and block suspicious activity, such as unauthorised login attempts or unusual transaction patterns.
• Regular security audits: m999 conducts regular penetration testing and security audits by independent third parties to identify and address security vulnerabilities.
• Staff training: All m999 staff who handle personal data receive regular training on data security and PDPA responsibilities.

As an m999 player and data subject under PDPA 2010, you have the following rights regarding your personal data. To exercise any of these rights, contact the m999 privacy team at support@m999-play.com.

The m999 platform uses cookies and similar tracking technologies to enhance the user experience and ensure the platform runs smoothly. The following are the types of cookies we use:

• Essential Cookies: Required for the basic operation of the platform — including login authentication, session security, and core user preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information on how players use the m999 platform — including pages visited, time spent and errors encountered — in an aggregated, non-personally identifiable format. Used to improve platform performance.
• Functional Cookies: Saves player preferences such as language selection and display settings to make your experience smoother in future sessions.
• Analytics Cookies: Helps m999 understand overall platform usage patterns for product improvement purposes. Analytics data is processed in a non-personally identifiable format.

M999 retains personal data only for as long as necessary for the stated purpose or as required by Malaysian law. m999's data retention schedule is as follows:

• Financial transaction records: Retained for seven (7) years from the transaction date, in accordance with Malaysian financial and anti-money laundering regulations.
• Login and account activity records: Retained for two (2) years for security and dispute resolution purposes.
• Support communication records: Retained for three (3) years for quality control and dispute resolution purposes.
• Marketing data and preferences: Deleted within 30 days after a player withdraws marketing consent.
• Voluntarily closed account data: Deleted after the minimum required retention period expires, typically within 12 months after account closure, unless financial records require a longer retention period.

Data deletion is carried out securely in accordance with industry standards — data is overwritten multiple times before being erased to ensure it cannot be recovered. Data stored in backup systems is deleted in line with backup retention cycles, which typically do not exceed 90 days from the date of deletion on the primary system.

As an online casino platform, m999 may need to transfer certain personal data to third parties operating outside Malaysia — for example, international game providers such as Evolution Gaming (Sweden) or Pragmatic Play (Malta).

M999 ensures that all cross-border data transfers comply with the requirements of PDPA 2010 — data is only transferred to countries or entities that provide an equivalent or higher level of data protection than Malaysia. Comprehensive data processing agreements are signed with all international providers before any data transfer takes place.

Data transfers are limited to the minimum information required to deliver gaming services — typically a player ID that does not directly identify an individual, with no full name or financial details included.

M999 reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or platform improvements. The "Updated" date at the top of this page indicates when the latest version was published.

For material changes that significantly affect players' privacy rights, m999 will provide notice of at least 14 days before the changes take effect via email to the player's registered address or through an in-platform notice. Continued use of the m999 platform after such notice will be considered acceptance of the updated Privacy Policy.

We encourage players to check this page periodically to stay informed on how m999 protects their personal data. Any questions or concerns regarding changes to the Privacy Policy can be directed to support@m999-play.com.

This Privacy Policy was last updated on January 2026.

If you have any questions, requests, or concerns regarding this Privacy Policy or how m999 handles your personal data, please contact our privacy team through the following channels:

When contacting us regarding a privacy rights request, please include your m999 account number and a clear description of your request to help speed up processing. m999 aims to respond to all privacy-related requests within 14 working days from the date the request is received.