Privacy Policy

This Privacy Policy ("Policy") is published by Tabung999 ("we", "us", "our", "the Platform") and applies to all personal data collected from individuals ("you", "User", "Player") who access or use the Tabung999 website located at tabung999.cam and all associated mobile, desktop, and API-connected services.

Tabung999 is an online gaming and sports betting platform serving players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond. We are committed to handling all personal data we hold responsibly, transparently, and in accordance with internationally recognised data protection principles.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overall agreement between you and Tabung999.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that directly or indirectly identifies a living individual, including name, identification number, contact details, financial data, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — Tabung999, which determines the purposes and means by which personal data is processed.
• "Data Processor" — a third party that processes personal data on behalf of Tabung999, such as a payment gateway provider or KYC verification service.
• "Consent" — freely given, specific, informed, and unambiguous agreement to the processing of personal data for a stated purpose.
• "Sensitive Data" — a subset of personal data including financial information, identification documents, and any data related to a player's health or vulnerability status for responsible gambling purposes.
• "Cookies" — small text files placed on your device by the Platform to facilitate session management, analytics, and user preference retention.

Tabung999 collects personal data across several categories, depending on how you interact with the Platform. The table below summarises the categories of data we may hold about you:

Tabung999 collects personal data through the following channels:

4.1 Directly From You

The majority of personal data we hold is provided directly by you during account registration, KYC submission, deposit and withdrawal requests, customer support interactions, and participation in promotions. You are responsible for ensuring that all information provided to Tabung999 is accurate, current, and complete.

4.2 Automatically Through Platform Use

When you access and use the Platform, technical data is collected automatically, including your IP address, device identifiers, browser fingerprint, and session activity logs. This data is collected through standard server logging technologies and, where applicable, through first-party cookies and analytics tools operated solely by Tabung999.

4.3 From Third-Party Service Providers

In certain circumstances, we receive personal data from authorised third-party data processors, including identity verification agencies engaged to perform KYC checks, payment processors such as FPX operators and e-wallet providers (Touch 'n Go, Boost, GrabPay), and fraud prevention services. All such third parties are bound by data processing agreements requiring them to handle your data in accordance with this Policy.

Tabung999 processes your personal data for the following specific and documented purposes:

• Account Management: Creating, maintaining, verifying, and administering your Tabung999 player account, including password recovery and account security alerts.
• Payment Processing: Facilitating deposits and withdrawals in MYR via supported local payment channels, reconciling transaction records, and resolving payment disputes.
• KYC and AML Compliance: Verifying your identity and age (21+), screening against sanctions and politically exposed persons (PEP) lists, and meeting our anti-money laundering obligations.
• Customer Support: Responding to enquiries, resolving complaints, and maintaining quality assurance records of all support interactions.
• Responsible Gambling: Monitoring player behaviour to identify signs of potential gambling harm, administering self-exclusion requests and deposit limit settings, and contacting players with responsible gambling information where warranted.
• Platform Improvement: Analysing aggregated, pseudonymised usage data to improve platform design, game offering, navigation, and performance across all devices used by Malaysian players.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, multi-accounting, bonus abuse, and other security threats.
• Legal Compliance: Meeting obligations imposed by applicable laws and regulations, including responding to lawful requests from Malaysian authorities or international regulatory bodies.
• Marketing Communications: Sending promotional offers and platform updates to players who have consented to receive such communications. You may withdraw this consent at any time.

Every instance of personal data processing at Tabung999 is conducted under one or more of the following lawful bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to upon registration, including managing your account and processing transactions.
• Legal Obligation: Processing required to comply with applicable law, including KYC, AML, and reporting obligations to regulatory authorities.
• Legitimate Interests: Processing necessary for Tabung999's legitimate business interests, including fraud prevention, platform security, and responsible gambling monitoring, provided those interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given consent, such as receiving marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Tabung999 does not sell or rent your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose:

7.1 Payment Service Providers

To process deposits and withdrawals in MYR, we share necessary financial and identity data with approved payment processors, including DuitNow operators, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong Bank), and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay). These providers act as data processors under binding agreements and are not permitted to use your data for any purpose beyond facilitating your transaction.

7.2 KYC and Identity Verification Providers

For mandatory age and identity verification, we engage licensed third-party KYC service providers. Only the data strictly required to complete verification — typically your identification document and a selfie — is transmitted to these providers. Verified results are returned to Tabung999 and stored on our secure servers.

7.3 Legal and Regulatory Authorities

We may disclose personal data to Malaysian law enforcement agencies, financial intelligence units, or other competent authorities where we are legally obligated to do so, or where disclosure is necessary to prevent, detect, or report criminal activity including fraud or money laundering.

7.4 Internal Group Companies

Personal data may be shared within the Tabung999 group of companies for internal administrative purposes, including consolidated compliance reporting and group-level fraud detection. All intra-group data transfers are governed by internal data protection agreements consistent with this Policy.

Tabung999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. Specific retention periods are as follows:

• Account Data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure to meet regulatory requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with standard financial record-keeping requirements.
• KYC Documents: Retained for the duration of the account relationship plus five (5) years post-closure, or longer if required by applicable law.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, to support dispute resolution and quality assurance.
• Marketing Consent Records: Retained for the duration of the consent period plus three (3) years to evidence the basis on which communications were sent.
• Technical and Usage Logs: Typically retained for twelve (12) months for security and platform performance purposes, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual. Where deletion is not immediately technically feasible, data is isolated and protected from further active processing pending secure destruction.

Tabung999 implements a comprehensive, layered security programme to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Encryption: All personal data at rest is encrypted using AES-256 standard encryption. All data in transit between your device and our servers is protected using TLS 1.3 or equivalent protocols.
• Access Controls: Strict role-based access controls limit internal access to personal data to authorised personnel with a documented need-to-know. All internal access events are logged and subject to periodic audit.
• Two-Factor Authentication: Player accounts are offered two-factor authentication as an additional layer of login security. We strongly encourage all Malaysian players to enable 2FA.
• Penetration Testing: Independent cybersecurity firms conduct quarterly penetration tests on Tabung999 infrastructure. Any identified vulnerabilities are prioritised and remediated according to severity.
• Incident Response: Tabung999 maintains a documented security incident response plan. In the event of a data breach affecting your personal data, we will notify affected players and relevant authorities within the timeframes required by applicable law.
• Vendor Security: All third-party data processors engaged by Tabung999 are subject to security due diligence assessments prior to engagement and are contractually required to maintain security standards consistent with our own.

Tabung999 uses cookies and similar tracking technologies to operate and improve the Platform. We deploy the following categories of cookies:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They include session cookies that maintain your login state, security tokens that protect against cross-site request forgery, and cookies that remember your preferred language and currency settings (MYR).

10.2 Performance and Analytics Cookies

These cookies collect anonymised data about how players interact with the Platform — such as which pages are visited most frequently and where users encounter errors. This data is used solely by Tabung999 to improve platform performance and player experience. We do not share analytics data with third-party advertising networks.

10.3 Functional Cookies

Functional cookies remember preferences you have set, such as your chosen game lobby layout, notification settings, and responsible gambling tool configurations. Disabling these cookies may affect your experience on the Platform but will not prevent access to core services.

10.4 Managing Cookies

You can manage or delete cookies at any time through your browser settings. Most browsers allow you to block all cookies, accept only certain cookies, or receive a notification when a cookie is set. Please note that disabling strictly necessary cookies will prevent you from logging into your Tabung999 account.

Subject to applicable law and our regulatory obligations, you have the following rights in relation to personal data held about you by Tabung999. To exercise any of these rights, contact our support team in writing at [email protected]. We will respond within 30 calendar days of receiving a valid request.

Please note that some rights are not absolute and may be subject to exemptions. For example, we cannot erase data that we are legally required to retain, such as transaction records held for AML compliance purposes. Where a right cannot be fully exercised, we will explain the reason clearly in our response.

Tabung999 strictly prohibits the use of its platform by individuals under the age of 21. We do not knowingly collect personal data from persons under 21 years of age. Our mandatory KYC process is specifically designed to verify the age of every registered player before they are permitted to deposit or withdraw funds.

Parents and guardians who believe a minor has registered a Tabung999 account should contact us immediately at [email protected]. We will investigate and respond within 24 hours.

In the course of providing our services, personal data may be transferred to and processed in countries outside Malaysia. Such transfers occur only where one or more of the following safeguards are in place:

• The recipient country has been assessed as providing an adequate level of data protection.
• The transfer is governed by a binding data processing agreement incorporating standard contractual clauses or equivalent protections.
• The transfer is strictly necessary to fulfil a contract between you and Tabung999 — for example, processing a DuitNow or cryptocurrency withdrawal that involves an intermediary in another jurisdiction.

Tabung999 maintains a register of all cross-border data transfers and reviews the adequacy of safeguards periodically. Where you have questions about international transfers affecting your data, you may contact us directly.

Tabung999 reserves the right to update or amend this Privacy Policy at any time. Where a material change is made — for example, a change to the categories of data we collect or the purposes for which we process it — we will notify registered players by email at least fourteen (14) days before the change takes effect, where practicable.

The most current version of this Policy is always published on this page and is identified by the effective date in the page header. Minor or non-material amendments, such as editorial corrections or clarifications, may be made without prior notice. Your continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data Tabung999 holds about you, please contact us through the following channels. All data-related enquiries are handled by our dedicated compliance and support team.

We aim to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 30 calendar days. For urgent account security matters, please use our live chat function, which is available 24 hours a day, 7 days a week, with an average response time of under 90 seconds.