Does GTR99 sell my personal data to third parties?

No, absolutely not. GTR99 never sells, rents, or transfers members' personal data to any third party for marketing or commercial purposes. Your data is shared only with a limited set of parties — such as payment processors (DuitNow, Touch 'n Go eWallet, GrabPay, FPX) — strictly as required to carry out your financial transactions, and only to the extent necessary for that purpose. All GTR99 partners are bound by strict data protection agreements.

How does GTR99 protect my payment information, such as e-wallets and bank account details?

GTR99 protects your payment information with multiple layers of security. First, all communication between your device and GTR99's servers is secured with 256-bit SSL encryption, on par with online banking standards. Second, sensitive financial information stored in our systems is encrypted using industry-standard encryption algorithms. Third, GTR99 does not directly store full bank account numbers or payment card details — we work through certified payment processors that handle sensitive financial data in compliance with PCI-DSS standards. Any unauthorised access attempts on GTR99's systems are monitored and detected in real time.

Can I request GTR99 to delete all my personal data?

You may request the deletion of your personal data, though certain limitations apply. GTR99 is required under Malaysian law — including financial record-keeping and anti-money laundering obligations — to retain transaction records and certain identity information for a minimum of 7 years even after account closure. During this period, legally mandated data cannot be fully deleted. However, data not required by law can be deleted upon your request. To submit a data deletion request, please contact us at support@gtr99.xyz with the subject line "Data Deletion Request" and we will inform you which data can be deleted and which must be retained in accordance with the law.

What does GTR99 do in the event of a data security breach?

GTR99 has a comprehensive security incident response plan in place. In the event of a data breach involving members' personal data, GTR99 will: (1) Immediately identify and contain the breach. (2) Assess the scope and impact of the breach on affected members' data. (3) Notify affected members via email or account notification within 72 hours of confirming the breach — in accordance with Malaysia's PDPA notification requirements. (4) Report the incident to the relevant authorities as required by law. (5) Take remedial steps to prevent a similar breach from occurring in future. The security of GTR99 members' data is always our absolute top priority.

gtr99 | Privacy Policy and Personal Data Protection

1

Introduction – GTR99 Privacy Policy

GTR99 ("we", "the Company") operates an online casino and Sports Betting platform at gtr99.xyz. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use GTR99's services — covering account registration, casino and Sports Betting activity, deposits and withdrawals, and all your interactions with our platform.

The GTR99 Privacy Policy is drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA), the primary legislation governing personal data protection in Malaysia's commercial sector. We are committed to upholding all data protection principles enshrined in the PDPA and will update this Privacy Policy as necessary to reflect changes in our practices or applicable law.

By registering an account or using any GTR99 service, you consent to the collection and use of your personal data as described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the GTR99 platform and contact our support team to close your account.

2

Types of Personal Data Collected by GTR99

GTR99 collects various types of personal data depending on how you interact with the platform. Below is a breakdown of the data we collect and the purposes for which it is collected:

Data Type	Example	Primary Purpose
Identity Data	Full name, identity card number (MyKad), date of birth, gender	Identity verification, KYC compliance and anti-money laundering law compliance
Contact Data	Malaysian phone number, email address, residential address	Account communications, OTP verification, transaction and betting notifications
Financial Data	E-wallet information (Touch 'n Go, GrabPay, DuitNow), FPX account details, transaction records	Deposit and withdrawal processing, financial fraud prevention
Platform Activity Data	Betting records, casino game history, session duration, games played	Bet settlement, customer support, responsible gaming programme
Technical Data	IP address, device type, operating system, web browser, access logs	Account security, fraud detection, platform improvement
Communication Data	Live chat records, support emails, user feedback	Complaint resolution and support service quality improvement

GTR99 does not collect sensitive data such as health information, religious beliefs, political views, or biometric data unless specifically required for legally mandated identity verification purposes.

3

How GTR99 Uses Your Personal Data

GTR99 uses collected personal data exclusively for legitimate purposes directly relevant to the services we offer. The following are the primary purposes for which GTR99 members' personal data is used:

Account Management: Creating and managing your GTR99 account, verifying your identity at login, and processing account-related requests such as password changes and personal information updates.
Financial Transaction Processing: Processing deposits via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX, and handling winnings withdrawals to your verified payment method.
Bet Settlement & Gaming: Recording and settling all sports bets — including football, badminton, cricket and e-sports — as well as casino gaming, slots and lottery activity on GTR99.
Security & Fraud Prevention: To detect and prevent fraud, money laundering, duplicate account creation, and any activity that violates GTR99's Terms & Conditions.
Customer Support: To provide effective assistance when you contact the GTR99 support team via live chat or WhatsApp — including resolving complaints and enquiries related to your account and bets.
Responsible Gaming Programme: To monitor gaming activity patterns in order to identify members who may need responsible gambling support, and to enforce limits set by members themselves.
Legal Compliance: To fulfil the reporting and disclosure obligations required under Malaysian law, including the PDPA, the Anti-Money Laundering Act, and relevant regulatory requirements.
Platform Improvements: To analyse aggregated, anonymised usage patterns in order to improve the user experience, refine our interface, and develop more useful new features for GTR99 members.

GTR99 does not use your personal data for automated profiling that produces decisions with legal effects on you without meaningful human involvement. Any decision affecting your account rights is reviewed by qualified GTR99 staff.

4

Data Sharing With Third Parties

GTR99 does not sell, rent, or transfer members' personal data to third parties for marketing or commercial purposes. However, in the course of operating our platform, there are specific situations where personal data may need to be shared with a limited and accountable set of parties:

Payment Service Providers: Transaction information required is shared with payment service providers such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and FPX partner banks (Maybank, CIMB) solely for the purpose of processing your deposits and withdrawals.
Game Software Providers: Gaming session information that must be shared with the casino game software providers supplying slots, Live Casino and table games to the GTR99 platform. This sharing is kept to the minimum data necessary to operate the games.
Malaysian Legal Authorities: GTR99 will disclose personal data to competent authorities such as the Royal Malaysia Police (PDRM) or the Companies Commission of Malaysia (SSM) when required by a valid court order or applicable Malaysian law.
Security Service Providers: Certain technical information may be shared with cybersecurity service providers that assist GTR99 with fraud detection and system protection — subject to strict confidentiality agreements.

All third parties receiving data from GTR99 are bound by data protection agreements requiring them to maintain confidentiality, use data only for authorised purposes, and protect it to a standard equivalent to or higher than GTR99's own.

GTR99's Guarantee: We will never share your personal data with marketing companies, advertisers, social media platforms, or any third party for marketing purposes without your explicit prior consent.

5

GTR99's Data Security Measures

GTR99 invests seriously in security infrastructure to ensure members' personal data is protected at every stage — from data transmission through to long-term storage. The key security measures we employ include:

256-bit SSL Encryption: All communications between your browser or app and GTR99's servers are protected by 256-bit SSL/TLS encryption, equivalent to the standards used by Malaysian online banking.
Stored Data Encryption: Sensitive data stored in GTR99's databases — including financial and identity information — is encrypted using industry-standard encryption algorithms to prevent unauthorised access, even in a data breach scenario.
Multi-Layer Access Control: Only GTR99 staff with the access privileges required to carry out their duties may access members' personal data. Every access is automatically logged and monitored.
Two-Factor Authentication (2FA): GTR99's internal systems require two-factor authentication for all staff access to systems that store members' personal data.
Real-Time Threat Monitoring: GTR99's security monitoring system operates 24 hours a day to detect and promptly respond to any unusual activity, unauthorised access attempts, or cybersecurity threats.
Regular Security Audits: GTR99 conducts regular internal and external security audits to identify and address any vulnerabilities in our security infrastructure before they can be exploited.
Incident Response Plan: GTR99 has a tested incident response plan to ensure a swift and effective response in the event of any data security breach.

While GTR99 takes all reasonable steps to protect your data, no security system can be guaranteed to be 100% secure. You are also responsible for keeping your account secure by using a strong password and not sharing your login credentials with others.

6

GTR99 Cookie & Tracking Technology Usage

GTR99 uses cookies and similar tracking technologies to enhance the user experience, maintain platform security, and understand how members interact with our services. The following are the types of cookies used by GTR99:

Essential Cookies: Required for the core functions of the GTR99 platform, including maintaining your login session, saving language preferences and ensuring session security. These cookies cannot be disabled as they are critical to platform operation.
Performance Cookies: We collect aggregated, anonymised information on how members use the GTR99 platform — such as the most frequently visited pages and time spent on the site — to help us improve platform performance and usability.
Functional Cookies: Saving your preferences — such as display settings, frequently accessed games and interface preferences — to give you a more personalised and comfortable experience on GTR99.
Security Cookies: Used by GTR99's security systems to detect suspicious access patterns, verify legitimate sessions, and prevent cyberattacks such as CSRF and session hijacking.

You can manage or delete cookies through your web browser settings at any time. However, disabling essential cookies may affect GTR99 platform functionality, including the ability to log in and carry out financial transactions. GTR99 does not use third-party advertising cookies that track your activity across other websites outside of gtr99.xyz.

7

Personal Data Retention Period

GTR99 retains members' personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy or as required by applicable Malaysian law. The data retention guidelines are as follows:

Active Account Data: For as long as your account remains active at GTR99, your personal data is retained and updated as needed to operate your services.
Data After Account Closure: After your account is closed, GTR99 retains the necessary personal data for a minimum of 7 years to comply with Malaysian legal requirements relating to financial records, auditing, and anti-money laundering obligations.
Financial Transaction Records: All deposit, withdrawal and financial transaction records are retained for a minimum of 7 years from the date of the transaction for audit, dispute resolution and legal compliance purposes.
Support Communication Logs: Communication records between members and the GTR99 support team are retained for 2 years for training, quality improvement, and reference purposes in the event of a dispute.
Technical Data (Logs): Access logs and technical data are retained for 12 months for security and fraud detection purposes before being automatically deleted.

Upon expiry of the stipulated retention period, personal data will be securely deleted or anonymised using approved procedures to ensure that no information can be traced back to any specific individual.

8

Your Rights as a Data Subject at GTR99

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a GTR99 member have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data GTR99 holds about you. GTR99 will provide this information within 21 days of receiving a valid request.

Right of Correction

If the personal data GTR99 holds about you is inaccurate or out of date, you have the right to request a correction. Updates will be made within 14 business days.

Right to Erasure

Under certain circumstances provided for under the PDPA, you may request the deletion of your personal data — subject to data retention obligations mandated by Malaysian law.

Right to Object

You may object to the processing of your personal data for specific purposes, such as direct marketing. GTR99 will honour valid objections in accordance with the provisions of the PDPA.

Right to Data Portability

You have the right to receive the personal data you have provided to GTR99 in a machine-readable format for the purpose of transferring it to another service provider, should you request to do so.

How to Submit a Request

Submit a written request to support@gtr99.xyz or via GTR99 live chat, stating the type of right you wish to exercise. Please provide sufficient information for us to verify your identity.

GTR99 will respond to all valid personal data rights requests within the timeframes set out under Malaysia's PDPA. In cases where we are unable to fully fulfil your request — for example, due to conflicting legal data retention requirements — we will explain our reasons clearly.

9

Children's Privacy & Underage Members

GTR99's services are intended exclusively for individuals aged 18 and above. GTR99 does not knowingly collect personal data from children or individuals under the age of 18.

If we discover that personal data has been collected from an underage individual without proper age verification, we will take immediate steps to delete that data and close the associated account. Parents or guardians who suspect their underage child has registered a GTR99 account are encouraged to contact our support team immediately at support@gtr99.xyz.

GTR99 uses an age verification process during registration and reserves the right to request identity verification documents at any time to ensure all members meet the minimum age requirement of 18.

10

Contact Us Regarding GTR99's Privacy Policy

If you have any questions, concerns, or complaints regarding GTR99's Privacy Policy or how we handle your personal data, please reach out to us through the following channels:

Privacy-Specific Email: support@gtr99.xyz — please state "Data Privacy Enquiry" in your email subject line. Response time within 24 hours on business days.
GTR99 Live Chat: A live chat icon is available in the bottom corner of every page on gtr99.xyz, operating 24 hours a day, 7 days a week, including Malaysian public holidays.
WhatsApp: The GTR99 support team's WhatsApp number is available in your account dashboard after logging in.

If you are not satisfied with how GTR99 handles your privacy-related complaint, you have the right to refer the matter to the Department of Personal Data Protection (JPDP) Malaysia or the relevant data protection authority under PDPA 2010.

GTR99 will update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or member feedback. All changes will be published on this page with a revised update date. We encourage you to review this page periodically.

GTR99's Commitment to You: Your privacy is more than a legal obligation to us — it is a core value we uphold with genuine responsibility. Every data-related decision we make puts your interests and trust first. If you have any concerns, please don't hesitate to reach out to us.

GTR99 Privacy Policy – Malaysia Personal Data Protection