Privacy Policy Toke99 — Malaysia Player Data Protection

This Privacy Policy describes the data processing practices of toke99 in relation to personal information collected from users who register, browse, and use our platform services. It applies to all toke99 platform users regardless of access method — whether via web browser, Android mobile app, or any other supported device.

Toke99 operates as a data controller and is responsible for ensuring that all personal data collected is processed lawfully, fairly, and transparently in accordance with applicable data protection legislation. We are committed to not using your data beyond the scope of the purposes stated in this policy without your explicit consent.

Toke99 collects various categories of personal data depending on how you interact with our platform. The following table summarises the types of data collected and the purposes for which they are collected:

Personal data collected by toke99 is used solely for legitimate purposes necessary to keep the platform functioning properly and securely. The following are the primary purposes for which your data is used:

• Account management and verification: Verifying your identity during registration and the KYC process, managing access to your account, and processing requests to update account information.
• Financial transaction processing: Processing deposits and withdrawals securely, verifying your banking details, and issuing transaction statements to you when required.
• Gaming service delivery: Providing access to all available games, processing wagers and paying out wins, and maintaining your game history records.
• Customer support: Handling your inquiries, complaints, and assistance requests via live chat and written communications.
• Legal compliance and fraud prevention: Meeting legal obligations including anti-money laundering (AML) compliance, monitoring suspicious activity, and reporting to authorities where required by law.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and reaching out to players who may need support.
• Marketing communications: Sending promotional information, bonuses, and special offers — only if you have given consent to receive such communications.
• Platform enhancement: Analyzing usage patterns in aggregate (not individually) to improve platform performance, interface, and overall user experience.

Toke99 processes your personal data on the basis of one or more of the following valid legal grounds:

• Contract performance: Processing required to fulfill the service contract between you and toke99 — including transaction processing and account management.
• Legal obligation: Processing required to meet our legal obligations, such as KYC requirements and anti-money laundering compliance.
• Legitimate interest: Processing for platform security purposes, fraud prevention, and service improvement, provided it does not override your fundamental rights and freedoms.
• Consent: For marketing communications and other optional purposes, we rely on your explicit consent, which may be withdrawn at any time.

Toke99 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, there are limited situations where we need to share your data with certain parties for platform operational purposes:

• Payment service providers: Licensed payment processors that help us securely process your deposits and withdrawals. They are bound by strict confidentiality agreements and may only use your data for specified purposes.
• Game providers: Licensed gaming software providers that supply game content on the toke99 platform. Data shared is limited to the game session information required for game functionality.
• Technology service providers: Cloud infrastructure providers, email delivery services, and analytics tools that help us operate the platform efficiently and securely.
• Regulatory and law enforcement authorities: Toke99 will disclose required information to the relevant authorities where mandated by law or court order.

All third parties that receive data from toke99 are bound by comprehensive data protection agreements and are required to implement appropriate technical and organisational security measures to protect your data.

Toke99 implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction, or accidental disclosure:

• Encryption in transit: All data transmitted between your device and toke99 servers is protected by 256-bit SSL/TLS encryption — the same standard used by major banking institutions.
• Encryption at rest: Sensitive data stored in our databases — including passwords and financial details — is encrypted using robust encryption algorithms.
• Internal access control: Access to user data among toke99 staff is governed by the principle of least privilege — only staff who genuinely need access to specific data for their duties are permitted to do so.
• Security monitoring: Continuous monitoring systems detect and alert on any suspicious activity or intrusion attempts in real time.
• Two-factor authentication (2FA): An additional authentication layer is available for all player accounts and is mandatory for all staff access to internal systems.

Toke99 retains your personal data only for as long as necessary for the specified purposes or as required by applicable law:

• Active account data: Retained for the duration your account remains active and used to provide you with uninterrupted service.
• Data after account closure: After account closure, toke99 retains certain data (including transaction records and KYC documents) for a minimum period of five (5) years to fulfil legal obligations related to anti-money laundering and taxation.
• Technical log data: Access logs and technical activity records are retained for a period of 90 days to 12 months depending on the log type.
• Marketing data: Retained until you withdraw consent or close your account, whichever comes first.

Once the retention period expires, data will be permanently deleted or anonymised so that it can no longer be linked to any specific individual.

The toke99 platform uses cookies and similar tracking technologies to enhance your user experience and ensure account security. The cookies we use fall into several categories:

• Essential cookies: Cookies required for basic platform functions such as login authentication and session security. These cookies cannot be disabled.
• Preference cookies: Saving your preferences such as interface language and game settings for convenience on future visits.
• Analytics cookies: Helping us understand how users interact with the platform so we can make meaningful improvements. Analytics data is collected in aggregate and does not identify individuals.
• Security cookies: Used to detect fraudulent activity and protect your account from unauthorized access.

You can manage your cookie settings through your browser settings at any time. Please note that disabling essential cookies may affect the functionality of the toke99 platform.

As a toke99 user, you have certain rights regarding the personal data we process. Below is a summary of those rights:

Toke99 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or new platform features. Any material changes will be communicated to you via a notice on the platform or by email at least 14 days before the changes take effect.

We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this document indicates when the Privacy Policy was last revised.

If you have any questions, concerns, or wish to exercise your privacy rights regarding personal data processed by toke99, please contact our support team via:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon on the toke99 platform
• Email: [email protected] (displayed as plain text in the footer)

We are committed to responding to all privacy-related enquiries within 5 business days. For requests requiring more in-depth investigation, the maximum response period is 30 calendar days.