Privacy Policy SpinCity99 –
Data Protection Personal
You are in Malaysia

SpinCity99 collects personal information from our Malaysian members through various means — primarily during the account registration process, platform usage and interactions with our support team. Our core principle is that we only collect data that is genuinely necessary to deliver our services effectively and securely. We do not collect excessive or irrelevant data beyond the scope of SpinCity99's services.

1.1 Data Collected During Registration

• Full name as it appears on your Malaysian Identity Card (MyKad)
• Malaysian mobile phone number that is active for account verification and communication purposes
• Email address valid and active
• Date of birth for verification of the minimum age requirement of 18 years
• Password stored in encrypted format (SpinCity99 cannot view your password in its original form)
• Bank account number or digital wallet details for processing deposits and withdrawals via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, or FPX

1.2 Automatically Collected Data

When you use the spincity99 platform, our systems automatically record certain technical information required to keep the platform running correctly and securely. This includes:

• Your device's IP address
• Web browser type and version used
• Your device's operating system
• Pages you visit on the SpinCity99 platform and the time of your visits
• Gaming activity including the types of games played, wager amounts and outcomes
• Financial transaction data including deposits and withdrawals
• Communication logs with the customer support team

1.3 Identity Verification Data (KYC)

To meet legal requirements under anti-money laundering laws and identity verification regulations, spincity99 may request additional documents from members in certain situations. These may include a copy of your Malaysian Identity Card, a recent bank statement or digital wallet statement, and other relevant supporting documents. All such documents are processed and stored with the highest level of security.

SpinCity99 uses the personal data we collect solely for legitimate and transparent purposes. We do not use your data for any purpose beyond those stated below without first obtaining your additional consent. Every use of data is based on one of the valid legal grounds under Malaysia's PDPA 2010.

2.1 Direct Marketing

SpinCity99 will only use your contact information to send marketing communications — such as information about new bonuses, special promotions or the latest games — if you have given explicit consent during registration or through your account settings. You may withdraw your marketing consent at any time without any impact on your SpinCity99 account or other services.

SpinCity99 does not sell, rent, or trade members' personal data to any third party for marketing or commercial purposes. However, there are limited situations where we need to share certain information with other parties to enable SpinCity99's services to operate effectively and securely. All such data sharing is strictly controlled, and the third parties involved are required to uphold the same privacy standards as SpinCity99.

3.1 Third-Party Service Providers

SpinCity99 works with selected service providers who assist us in operating the platform. These include game providers such as Evolution Gaming and Pragmatic Play (which receive the game data necessary for gaming licence management), payment processors that handle Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX transactions, as well as technology infrastructure and cybersecurity service providers. Each of these service providers is bound by strict confidentiality and data protection agreements.

3.2 Legally Required Disclosures

SpinCity99 may be required to disclose members' personal information to competent authorities such as the police, courts, regulatory bodies or Malaysian government agencies upon receipt of a valid court order, a directive from an authorised regulatory body, or where we have reasonable grounds to believe that disclosure is necessary to prevent serious crime or protect the public interest. In such circumstances, SpinCity99 will notify you of the disclosure where permitted by law.

SpinCity99 continually invests in the latest security technologies and procedures to protect all members' personal data from unauthorised access, alteration, disclosure or destruction. Our approach to data security is holistic — covering technical, physical and organisational aspects.

4.1 Technical Security Measures

• Data Encryption in Transit: All communications between your browser and the SpinCity99 platform are encrypted using TLS 1.3 with a 256-bit SSL certificate verified by a recognised certificate authority.
• Data Encryption at Rest: Sensitive data including payment details and identity verification information is stored in encrypted format on SpinCity99's servers.
• Tiered Access Control: Access to members' personal data within spincity99's systems is restricted to staff with a legitimate operational need, and every instance of access is logged for audit purposes.
• Two-Factor Authentication: SpinCity99 offers members the option to enable two-factor authentication (2FA) to enhance account security, and we encourage all members to activate it.
• Continuous Threat Monitoring: spincity99's systems are monitored around the clock by our cybersecurity team using both automated and manual threat detection tools to identify and address any suspicious activity promptly.

4.2 Your Security Responsibilities as a Member

While spincity99 takes all reasonable steps to protect your data on our end, the security of your account also depends on your own actions. spincity99 recommends using a strong and unique password for your spincity99 account, not sharing your login credentials with anyone, logging out after each session especially on shared devices, and contacting the spincity99 support team immediately if you suspect unauthorised access to your account.

SpinCity99 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by applicable laws and regulations. Once the data is no longer needed, we will securely delete or anonymise it.

Once the retention period has ended, or after an account is closed and all legal obligations have been fulfilled, SpinCity99 will securely delete your personal data from our systems. Any data that cannot be fully deleted for technical reasons will be anonymised so that it can no longer be used to identify you as an individual.

The SpinCity99 platform uses cookies and similar tracking technologies to enhance the user experience, maintain the security of login sessions and collect anonymised analytics data to help us understand how members use the platform. This section explains the types of cookies we use and how you can manage them.

6.1 Types of Cookies Used by spincity99

6.2 Cookie Management

You can manage or disable cookies through your web browser settings. Please note that disabling essential cookies may affect the core functionality of the spincity99 platform, including the ability to log in. Disabling performance or marketing cookies will not affect your ability to use spincity99's services in full.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a data subject hold certain rights regarding the personal data spincity99 holds about you. spincity99 fully respects these rights and has clear procedures in place to help you exercise them with ease.

• Right of Access: You have the right to request a copy of the personal data spincity99 holds about you. spincity99 will process all data access requests within 21 working days.
• Right to Rectification: If you find that any personal data SpinCity99 holds about you is inaccurate or incomplete, you have the right to request a correction. You may also update basic information directly through your SpinCity99 account settings.
• Right to Withdraw Consent: For data processing based on your consent (primarily marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing carried out prior to the withdrawal.
• Right to Object to Direct Marketing: You may object to the use of your data for direct marketing purposes at any time by contacting our support team or using the unsubscribe link in any SpinCity99 marketing communication.
• Right to Complain: If you believe that SpinCity99 has failed to comply with the PDPA 2010 in processing your data, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

SpinCity99 takes all privacy and data protection enquiries, concerns and complaints seriously. If you have any questions about this Privacy Policy, how we process your data, or wish to exercise any of your privacy rights, please contact us through the following channels:

• Privacy Email: support@spincity99.click (please include "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24 hours a day, 7 days a week through the SpinCity99 platform

SpinCity99 is committed to handling every privacy inquiry seriously and within a reasonable timeframe. For general inquiries, we aim to respond within 3 business days. For more complex data access or correction requests, the processing period is up to 21 business days.

This Privacy Policy is subject to amendment from time to time in line with changes to legislation, technology or SpinCity99's business operations. Any material amendments will be communicated to members via their registered email or in-platform notification at least 14 days before taking effect. The current version of this Privacy Policy takes effect from 1 January 2026.