Baji99 Privacy Policy – Personal Data Protection for Malaysian Members

This Privacy Policy is issued by Baji99 and applies to all individuals who use the baji99.my platform, including registered members, website visitors, and any party who interacts with Baji99's services in any capacity.

Baji99 takes its data protection responsibilities very seriously. We operate in accordance with internationally recognised data protection principles, including:

• Lawfulness, Fairness & Transparency — data is collected and processed lawfully, fairly and in a manner that is transparent to the data subject.
• Purpose Limitation — data is only collected for the stated purposes and is not processed in any manner incompatible with those original purposes.
• Data Minimisation — we only collect data that is strictly necessary for the stated purposes, nothing more.
• Accuracy — we take reasonable steps to ensure that stored data is accurate and kept up to date where necessary.
• Retention Limits — data is not retained for longer than is necessary for the stated purpose.
• Integrity & Confidentiality — data is processed in a manner that ensures appropriate security, integrity, and confidentiality.

This Privacy Policy should be read together with Baji99 Terms & Conditions which together form a comprehensive agreement between you and our platform.

Baji99 collects various categories of data from members and platform users. Below is a full list of the data we may collect:

Data you provide directly to us:

• Full name as shown on your Malaysian identification document
• An active Malaysian mobile number (used for OTP verification and account communications)
• An active email address
• Date of birth (for age verification purposes — you must be 18 years of age or older)
• Account password (stored in hashed format — unreadable by anyone)
• Payment method details — Touch 'n Go account number, DuitNow account, GrabPay account number, Boost, ShopeePay or relevant FPX details
• Identity verification documents when required (e.g., Malaysian MyKad, passport)

Data collected automatically during platform use:

• Your device's IP address
• The type and version of internet browser being used
• Device operating system (e.g. Android, iOS, Windows)
• Pages visited, visit times, and session duration within the Baji99 platform
• Betting activity records, including games played, wager amounts, wins, and losses
• Complete records of all deposit and withdrawal transactions
• Cookie data and device identifiers

Baji99 uses the personal data collected for the following purposes:

• Account Management: To create, verify, and manage your Baji99 account, including identity and age verification as required by platform regulations.
• Payment Processing: To process deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay and FPX, as well as withdrawals to the same payment methods. This involves sharing the necessary data with the relevant payment gateway providers.
• Service Provision: To enable you to access and use all games and features on the Baji99 platform, including live casino, slots, jackpot, roulette, baccarat, and the Sports Betting section.
• Service Communications: To send you important notifications relating to your account, including transaction confirmations, security alerts, and policy updates.
• Fraud Prevention & AML: To detect and prevent fraudulent activity, money laundering and any misuse of the platform that violates regulations or applicable laws.
• Platform Improvements: To analyse platform usage patterns for the purpose of improving Baji99's interface, performance, and overall user experience.
• Legal Compliance: To fulfil legal and compliance obligations, including reporting requirements to relevant authorities where mandated by Malaysian or international law.
• Responsible Gambling: To monitor gameplay patterns in order to identify signs of problem gambling and provide appropriate support to members who may need assistance.

Baji99 does not use your data for any third-party marketing purposes without your explicit prior consent.

Baji99 does not sell, rent, or disclose members' personal data to third parties for commercial or marketing purposes. Data sharing only occurs in the following limited and necessary circumstances:

• Payment Gateway Providers: Transaction details necessary for processing are shared with approved payment service providers — including Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and FPX — solely for the purpose of handling your deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Game Providers: Required session information is shared with licensed game providers such as Evolution Gaming and Pragmatic Play solely for legitimate game operation purposes. No personal identifying information is shared beyond the minimum technical requirements.
• Authorities & Law Enforcement: Baji99 will disclose members' data to the relevant Malaysian or international authorities when required by a court order, lawful directive, or applicable legal compliance obligation.
• Professional Advisors: Lawyers, accountants, or auditors appointed by Baji99, each bound by their respective professional confidentiality obligations.
• Your Explicit Consent: In any other situation involving the sharing of your data with third parties, Baji99 will obtain your explicit consent before any such sharing takes place.

Baji99 implements comprehensive technical and organisational security measures to protect members' personal data against unauthorised access, loss, destruction or accidental disclosure:

• Data Encryption in Transit: All communications between your browser and Baji99's servers are secured with TLS 1.3 protocol and AES-256 encryption — the highest security standard currently available for web applications.
• Data Encryption at Rest: Sensitive data stored in Baji99's databases — including bank account details and transaction records — is encrypted using military-grade encryption methods.
• Password Protection: Member passwords are processed through a one-way cryptographic hashing function, making them unrecoverable — even by Baji99's own IT engineers.
• Staff Access Controls: Access to members' personal data among Baji99 staff is restricted to individuals who require such access to perform their job functions, based strictly on a need-to-know basis.
• Continuous Security Monitoring: Baji99's systems are continuously monitored for suspicious activity and intrusion attempts, with a cybersecurity team on standby to respond 24 hours a day.
• Regular Security Audits: Baji99 undergoes regular security audits and penetration testing by independent parties to ensure data protection systems remain current and effective.

While Baji99 takes all reasonable steps to protect your data, please be aware that no security system is entirely foolproof. You also play an important role in keeping your account safe — use a strong password and never share your login credentials with anyone.

Baji99 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. The following are the types of cookies we use:

• Essential Cookies: Required for core Baji99 platform functions such as login session authentication, form security and transaction processing. These cookies cannot be disabled without affecting essential platform functionality.
• Preference Cookies: To save your preferences — such as display language, preferred table settings, and other interface options — so your future experience on Baji99 is smoother and more personalised.
• Analytics Cookies: Collecting aggregated and anonymised data on how users interact with the Baji99 platform — including the most frequently visited pages and navigation patterns — for internal product improvement purposes.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and protect member accounts from unauthorised access.

You can control and manage cookies through your internet browser settings. However, disabling essential cookies may affect your ability to log in and use key features of the Baji99 platform.

As a globally operating platform with cloud-based services, Baji99 may transfer members' personal data to other countries or regions outside Malaysia. Such transfers occur in the following contexts:

• The cloud server infrastructure used by Baji99 may be located across multiple geographic regions for redundancy and performance purposes.
• Game service providers such as Evolution Gaming and Pragmatic Play operate their servers across various international locations.
• Baji99's customer support operations may involve staff or systems based in various countries.

For all international data transfers, Baji99 ensures that protection equivalent to the standards set out in this Privacy Policy is maintained through appropriate contractual agreements with all parties receiving that data. Your data is never transferred to countries without adequate data protection without the necessary additional safeguards in place.

As a Baji99 member, you have the following rights regarding the personal data we hold about you:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Baji99 will provide this information within 30 days of receiving a valid request.
• Right to Rectification: If the personal data we hold about you is inaccurate or outdated, you have the right to request an immediate correction. Some information can be updated directly through your Baji99 account profile settings.
• Right to Erasure ("Right to be Forgotten"): Under certain circumstances, you have the right to request the deletion of your personal data. Please note that this right is subject to legal data retention obligations, which may prevent the deletion of certain records.
• Right to Restriction of Processing: You may request that Baji99 restrict the processing of your data in certain situations — for example, while a dispute regarding the accuracy of your data is being resolved.
• Right to Data Portability: You have the right to receive the personal data you have provided to Baji99 in a structured, machine-readable format, for transfer to another data controller should you choose to do so.
• Right to Object: You have the right to object to the processing of your personal data for specific purposes, including direct marketing where applicable.

To exercise any of the rights above, please contact the Baji99 support team via live chat or email at support@baji99.my. We will respond to valid requests within the stipulated timeframe.

Baji99 does not retain members' personal data for longer than is necessary for the purposes set out in this Privacy Policy. The following are the general data retention guidelines we observe:

• Active Account Data: Retained for as long as your Baji99 account remains active and for as long as necessary to provide services to you.
• Financial Transaction Records: Retained for a minimum of 7 years after the transaction date, in compliance with applicable legal and accounting requirements in Malaysia — including anti-money laundering (AML) obligations.
• Betting Activity Log: Retained for a minimum of 5 years for compliance and dispute resolution purposes.
• Support Communication Data: Records of interactions with the Baji99 support team are retained for 3 years for quality control and dispute resolution purposes.
• Closed Accounts: When an account is closed at a member's request, data not subject to legal retention obligations will be deleted or anonymised within 90 days after account closure.

Once the relevant retention period has expired, your personal data will be securely deleted or fully anonymised so that it can no longer be linked to you as an individual.

Baji99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or enhancements to our privacy protection measures.

When material changes are made to this Privacy Policy, Baji99 will:

• Updating the "Last Updated" date shown at the top of this page.
• Sending notifications to all registered members via email and/or in-platform notifications at least 14 days before changes take effect — giving you sufficient time to review and understand them.
• For highly material changes that significantly affect how we use your data, Baji99 may seek your consent again before those changes take effect.

Continued use of the Baji99 platform after the effective date of any Privacy Policy changes will be considered acceptance of the updated terms. Members who do not agree with the changes are entitled to close their account and withdraw any real balance before those changes take effect.

If you have any questions, concerns, or complaints regarding how Baji99 handles your personal data, or if you wish to exercise any of the rights set out in this Privacy Policy, please contact us through the following channels:

• 24/7 Live Chat: The fastest method — access via the chat icon available at the bottom corner of the Baji99 platform at any time.
• Email: support@baji99.my — privacy-related requests will be processed within 30 days of the date your email is received.

When submitting a privacy-related enquiry by email, please clearly state "Privacy Policy Enquiry" in the subject line and include your Baji99 account number (if applicable) to help us process your request more efficiently. All privacy-related communications are handled with priority and confidentiality by a team specifically trained to deal with privacy matters.