Privacy Policy — cub99

1 Introduction

cub99 ("we", "us", "cub99") is committed to protecting the privacy and personal data of all individuals who interact with the cub99 platform. This Privacy Policy describes the categories of personal data cub99 collects, the purposes for which that data is used, the parties with whom it may be shared, and the rights available to individuals regarding their personal data.

cub99's data practices are designed to be consistent with the Personal Data Protection Act 2010 (Malaysia) ("PDPA"), applicable international gaming regulatory data requirements, and international data protection best practices. Where the PDPA or other applicable law provides stronger protections than the minimum required, cub99 applies the stronger standard.

This policy uses the term "Member" to refer to individuals who have registered a cub99 account, and "Visitor" to refer to any individual who accesses the cub99 website without completing registration. Both Members and Visitors are subject to applicable provisions of this policy.

2 Personal Data We Collect

2.1 Registration Data

When you register a cub99 account, we collect the following personal data that you provide directly:

• Full legal name
• Date of birth (for age verification — 21+ requirement)
• Residential address (including postcode and state within Malaysia)
• Email address
• Mobile telephone number (Malaysian number required for SMS verification)
• Username selected by you

2.2 Identity Verification (KYC) Data

To comply with anti-money-laundering (AML) obligations and to verify your identity and age before processing withdrawals, cub99 may collect:

• Government-issued photo identification (Malaysian identity card / MyKad, passport, or other accepted document)
• Proof of residential address (utility bill, bank statement, or equivalent document dated within 3 months)
• Payment method verification documentation (screenshot or statement confirming ownership of the payment method used)
• Selfie or facial verification image for identity matching purposes

2.3 Transaction Data

cub99 automatically records all financial transactions associated with your account, including deposit amounts, payment method identifiers, withdrawal requests, bet placements, winnings, bonus credits, and adjustments. This data is retained for AML compliance, dispute resolution, and audit purposes.

2.4 Usage and Technical Data

When you access the cub99 platform, we automatically collect technical data including IP address, device type and operating system, browser type and version, session timestamps, pages visited, games played, bet history, and referral source. This data is used for platform security, fraud detection, and service improvement.

2.5 Communications Data

cub99 retains records of all communications between you and the cub99 support team, including live chat transcripts, support ticket records, and email correspondence. This data is used for service quality monitoring, dispute resolution, and compliance purposes.

3 How We Use Your Personal Data

cub99 uses the personal data collected for the following specific purposes:

• Account Management: Creating and maintaining your cub99 account, processing logins, and delivering platform services you have requested.
• Age and Identity Verification: Confirming that you meet the 21+ age requirement and verifying your identity as required by AML regulations and licensing conditions.
• Payment Processing: Processing deposits and withdrawals via your selected Malaysian payment methods, including Touch n Go eWallet, Boost, and local bank transfers.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, and other illegal activity on the cub99 platform.
• Regulatory Compliance: Meeting obligations under applicable gaming licensing conditions, AML law, tax reporting requirements, and the Malaysia PDPA.
• Customer Support: Responding to support queries, resolving disputes, and maintaining service quality records.
• Responsible Gaming: Monitoring account activity for indicators of problem gambling and administering responsible gaming tools including deposit limits and self-exclusion programmes.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience.
• Marketing Communications: Sending promotional communications to Members who have opted in to receive them, subject to the right to withdraw consent at any time.

4 Legal Basis for Processing

cub99 processes personal data on the following legal bases under applicable data protection law:

• Contractual Necessity: Processing required to perform the contract between cub99 and the Member — including account creation, game access, and payment processing.
• Legal Obligation: Processing required to comply with applicable law — including AML verification, age verification, tax reporting, and gaming regulatory requirements.
• Legitimate Interests: Processing necessary for cub99's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by Member privacy rights.
• Consent: Processing based on the Member's freely given, specific, informed consent — primarily applicable to direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5 Data Sharing and Disclosure

5.1 Service Providers

cub99 shares personal data with third-party service providers who process data on cub99's behalf under binding data processing agreements. These providers include: payment processing infrastructure providers, identity verification and KYC service providers, live game studio providers (including game history data for audit purposes), customer support platform providers, and cloud infrastructure and hosting providers. All service providers are contractually prohibited from using Member data for any purpose other than the specific services they provide to cub99.

5.2 Regulatory and Law Enforcement Disclosure

cub99 may disclose personal data to regulatory authorities, law enforcement agencies, or other governmental bodies where required by applicable law or lawful order, including AML reporting obligations, gaming licence compliance requirements, and responses to valid legal process. cub99 will notify affected Members of such disclosures where legally permitted to do so.

5.3 No Sale of Personal Data

cub99 does not sell, rent, lease, or otherwise transfer personal data to third parties for their independent commercial or marketing purposes. Personal data shared with game studios is limited to session and game history data required for audit and dispute resolution and is governed by data processing agreements.

6 Data Retention

cub99 retains personal data for the following periods, after which data is securely deleted or anonymised:

• Account and Registration Data: Retained for the duration of account activity and for 7 years following account closure, in accordance with AML record-keeping obligations.
• KYC Documentation: Retained for 7 years from the date of collection or the date of the last relevant transaction, whichever is later, as required by AML regulations applicable to gaming operators.
• Transaction Records: Retained for 7 years from the date of each transaction for financial audit and AML purposes.
• Technical and Usage Data: Retained for 24 months for security and fraud analysis purposes, after which it is anonymised for aggregate analytics use.
• Support Communications: Retained for 3 years from the date of the last communication, or longer where the communication relates to an unresolved dispute or regulatory matter.
• Marketing Consent Records: Retained for 3 years from the date consent was given or until withdrawal of consent, whichever occurs first.

7 Cookies and Tracking Technologies

The cub99 platform uses cookies and similar tracking technologies to deliver core platform functionality, maintain session authentication, prevent fraud, and (with consent) to analyse platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for platform operation, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and previously selected game categories.
• Analytics Cookies: Used (with consent) to collect anonymised data about how Members and Visitors interact with the cub99 platform, enabling cub99 to improve service quality and identify technical issues.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to access the cub99 platform. cub99 does not use third-party advertising or tracking cookies for cross-site behavioural advertising purposes.

8 Your Data Protection Rights

Under the Malaysia PDPA and applicable international data protection law, cub99 Members have the following rights with respect to their personal data:

• Right of Access: The right to request a copy of the personal data cub99 holds about you and information about how it is processed.
• Right of Correction: The right to request correction of inaccurate or incomplete personal data held by cub99.
• Right to Withdraw Consent: The right to withdraw consent to data processing based on consent (including marketing communications) at any time, without affecting the lawfulness of prior processing.
• Right to Restrict Processing: The right to request that cub99 restrict the active processing of your personal data pending the resolution of accuracy or lawfulness concerns.
• Right to Data Portability: The right to receive personal data you have provided to cub99 in a structured, commonly used, machine-readable format.
• Right to Erasure: The right to request deletion of your personal data, subject to applicable legal retention obligations and other overriding legitimate processing bases.

To exercise any of these rights, contact the cub99 Data team via the support live chat or by email. cub99 will respond to verified rights requests within 30 calendar days. Identity verification may be required before processing a rights request.

9 Data Security

cub99 implements a layered security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Security measures include AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls limiting staff access to personal data on a need-to-know basis, regular penetration testing and vulnerability assessments, real-time intrusion detection and security monitoring, and annual third-party security audits. While cub99 maintains rigorous security standards, no online system can guarantee absolute security. Members are encouraged to protect their cub99 account by enabling two-factor authentication and maintaining strong, unique passwords.

10 Children's Privacy

The cub99 platform is strictly for individuals aged 21 and above. cub99 does not knowingly collect personal data from individuals under the age of 21. Where cub99 becomes aware that personal data has been collected from an individual under 21 — including through misrepresentation of age during registration — cub99 will immediately close the relevant account, void any associated transactions, and delete all personal data associated with that account to the extent permitted by law. Parents or guardians who believe their child has accessed cub99 should contact the support team immediately.

11 International Data Transfers

cub99's platform infrastructure involves the processing of personal data in data centres and by service providers located in multiple jurisdictions, which may include countries outside Malaysia. Where personal data is transferred outside Malaysia, cub99 ensures that appropriate safeguards are in place in accordance with the PDPA and applicable gaming regulatory requirements. Such safeguards include contractual clauses with data processors that impose data protection obligations equivalent to those applicable in Malaysia, and the use of certified hosting providers operating under internationally recognised security standards.

12 Changes to This Privacy Policy

cub99 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform services. Where material changes are made, cub99 will notify registered Members via email or in-platform notification prior to the changes taking effect. The "Last Updated" date at the top of this policy reflects the date of the most recent revision. Continued use of the cub99 platform following notification of changes constitutes acceptance of the revised policy.

13 Contact and Complaints

For questions, concerns, or to exercise your data protection rights, contact the cub99 Data team via:

• Live chat support (available 24/7 via the in-platform chat widget)
• Email: [email protected] — use the subject line "Privacy / Data Request"

cub99 is committed to resolving privacy concerns promptly and fairly. If you are not satisfied with cub99's response to a privacy complaint, you may escalate the matter to the Personal Data Protection Commissioner (Malaysia) or to the relevant data protection authority in your jurisdiction of residence.