Privacy Policy

This Privacy Policy ("Policy") describes how Kera99 ("kera99", "We", "Us", "Our") collects, processes, stores, and protects the personal data of individuals ("Members", "Users", "You") who register for or use the kera99 online gaming platform accessible at https://kera99.asia ("the Platform").

kera99 takes the privacy of its members seriously. We recognise that when you share personal information with us — whether during registration, while making a deposit through Maybank2u, or when contacting our support team — you are placing trust in us to handle that data responsibly. We honour that trust through the commitments set out in this Policy.

This Policy applies to all personal data we collect through the Platform, our customer support channels, and any other interaction you have with kera99. It should be read alongside our Terms & Conditions and our Responsible Gambling Policy, which together form the complete framework governing your use of kera99.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, identification number, location data, email address, IP address, or any factor specific to the physical, economic, or social identity of that person.
• "Processing" — Any operation performed on personal data, including collection, storage, retrieval, consultation, use, disclosure, erasure, or destruction, whether by automated means or otherwise.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. kera99 is the Data Controller in respect of all personal data collected through the Platform.
• "Data Processor" — A third party that processes personal data on behalf of kera99 under a written contract and according to kera99's instructions.
• "Consent" — A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data.
• "KYC" — Know Your Customer: the identity and address verification process required by kera99 to comply with anti-money laundering obligations and to confirm a Member's eligibility to use the Platform.
• "Cookies" — Small text files placed on a Member's device by the Platform to enable functionality, store preferences, and gather analytical data about platform usage.

kera99 is the Data Controller responsible for the personal data collected through the Platform. As Data Controller, kera99 determines the purposes for which your personal data is processed and is accountable for ensuring that such processing complies with applicable data protection principles.

kera99 has designated a data privacy point of contact responsible for overseeing compliance with this Policy and handling all privacy-related enquiries and requests from Members. Contact details for privacy matters are set out in Section 15 of this Policy.

Where kera99 engages third-party Data Processors (for example, payment gateway operators or cloud infrastructure providers), those processors act only on documented instructions from kera99 and are subject to binding contractual obligations regarding data protection and confidentiality.

kera99 collects personal data from Members through several channels, including account registration, platform usage, financial transactions, KYC submissions, and customer support interactions. The categories of data we collect are described in the table below:

kera99 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes for which we process Member data are as follows:

kera99 processes personal data only where a valid legal basis exists for doing so. The legal bases applicable to our processing activities are as follows:

• Contractual Necessity: Processing required to fulfil the Terms & Conditions agreement between kera99 and the Member — including account management, transaction processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, licensing requirements, and lawful requests from regulatory authorities.
• Legitimate Interests: Processing necessary for kera99's legitimate business interests — including fraud prevention, security monitoring, and platform improvement — where such interests are not overridden by the Member's privacy rights.
• Consent: Processing based on the Member's explicit, freely given consent, particularly for direct marketing communications and, where applicable, non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

kera99 does not sell your personal data. We may share your personal data with third parties only in the following controlled circumstances:

kera99 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and deliver a personalised experience. Cookies are small data files stored on your device when you visit the Platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cookies cannot be disabled without rendering core Platform features inoperable.
• Functional Cookies: Used to remember your preferences such as display language, time zone, and last-used payment method. Disabling these cookies may affect the personalisation of your experience.
• Analytical Cookies: Used to collect aggregated data about how Members use the Platform — including pages viewed, session duration, and navigation patterns — to help us improve performance. This data is processed in anonymised or pseudonymised form.
• Marketing Cookies: Used to track the effectiveness of promotional campaigns and to present relevant offers to Members who have opted in to marketing communications. These cookies are only placed with your consent.

You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to use the Platform.

kera99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical analysis and Platform improvement purposes.

kera99 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:

• 256-bit TLS/SSL encryption for all data transmitted between your device and the Platform;
• AES-256 encryption for personal data stored in our databases at rest;
• Multi-factor authentication requirements for account access and administrative systems;
• Regular penetration testing and vulnerability assessments conducted by independent security professionals;
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific function;
• 24/7 real-time security monitoring and automated threat detection systems;
• Incident response procedures governing detection, containment, and notification of data breaches.

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of affected Members, kera99 will notify affected individuals without undue delay and will take all reasonable steps to mitigate the impact of the breach.

As a kera99 Member, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to our privacy contact address set out in Section 15. We will acknowledge your request within five business days and provide a substantive response within 30 calendar days.

The kera99 Platform is strictly intended for use by individuals aged 21 years and above only. kera99 does not knowingly collect personal data from individuals under the age of 21.

During the registration process, kera99 collects date of birth information and applies age verification checks. Where we identify or have reasonable grounds to believe that an account has been opened by a person under the age of 21, we will immediately suspend that account, delete the associated personal data to the extent legally permissible, and report the matter in accordance with applicable regulatory requirements.

If you are a parent or guardian and believe that a minor in your care has registered an account on kera99 without your knowledge, please contact our support team immediately at the address provided in Section 15. We will investigate and take appropriate action, including account closure and deletion of the minor's personal data, as a matter of priority.

kera99 operates within a global technology environment. As a result, certain personal data may be transferred to, stored in, or processed by service providers located outside Malaysia. Such transfers may occur in connection with cloud infrastructure services, game studio platforms, or identity verification systems.

Where personal data is transferred outside Malaysia, kera99 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable Malaysian data protection principles. These safeguards include:

• Contractual data processing agreements with receiving parties imposing equivalent data protection obligations;
• Transfer to jurisdictions that have been assessed to provide adequate levels of data protection;
• Additional technical safeguards such as end-to-end encryption where cross-border transfers involve sensitive personal data.

Members may request information regarding the specific safeguards applied to cross-border transfers of their personal data by contacting the privacy team at the address in Section 15.

kera99 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, applicable law, or operational requirements. The revised Policy will be published on this page with an updated effective date.

For material changes to this Policy — particularly those that affect how we process personal data in a way that is less protective of Member rights — kera99 will provide advance notice to active Members via email or in-platform notification at least 14 days before the changes take effect. Where the change requires fresh consent, we will seek that consent at the time of the relevant interaction.

Your continued use of the Platform after a revised Policy becomes effective constitutes your acknowledgement of the updated terms. If you do not agree with the updated Policy, you should cease using the Platform and may request account closure in accordance with the procedure described in our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or have a concern about how kera99 handles your personal data, please contact our privacy team through the following channels: