rojak99 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") applies to the rojak99 platform, accessible at rojak99.one, and all associated services offered by rojak99 ("we", "us", "our", "the Company"). It governs the collection, use, storage, disclosure, and protection of personal data relating to all registered members, prospective members, and visitors to the rojak99 platform ("you", "your", "Data Subject").

rojak99 takes its obligations under applicable data protection legislation seriously. By accessing the rojak99 website or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with the terms of this Policy, please refrain from using the rojak99 platform.

This Policy should be read in conjunction with rojak99's Terms and Conditions, which govern the broader contractual relationship between you and the Company. Any capitalised terms not defined in this Policy carry the same meaning assigned to them in the Terms and Conditions.

2. Data Controller

rojak99 operates as the data controller in respect of personal data collected from members and platform visitors. As data controller, rojak99 determines the purposes and means by which personal data is processed. Where rojak99 engages third-party processors — such as payment service providers or gaming software suppliers — those parties act as data processors and are contractually bound to process your data only on rojak99's documented instructions and in compliance with applicable data protection law.

3. Categories of Personal Data We Collect

rojak99 collects the following categories of personal data, the scope of which varies depending on your level of interaction with the platform:

3.1 Identity Data

• Full legal name as it appears on official identification documents
• Date of birth (used to verify the 21+ age requirement)
• Gender (where provided voluntarily)
• Copies of government-issued identity documents (e.g., MyKad, passport) where requested for account verification purposes

3.2 Contact Data

• Registered mobile number
• Email address
• Residential or mailing address

3.3 Account Data

• Username and encrypted password credentials
• Account registration date and login history
• Account preferences and notification settings

3.4 Financial Data

• Bank account details used for FPX transfers (account holder name, bank, account number — as required for payment processing and withdrawal verification)
• E-wallet identifiers for Touch 'n Go eWallet and Boost transactions
• Deposit and withdrawal transaction records
• DuitNow QR identifiers where applicable

3.5 Gaming Activity Data

• Betting history across sportsbook, live casino, slots, and 4D lottery
• Game session durations and frequency data
• Responsible gaming tool usage (deposit limits, cool-off periods, self-exclusion)
• Bonus and promotion participation records

3.6 Technical Data

• IP address and approximate geographic location at time of login
• Device type, operating system, and browser version
• Session identifiers and cookie data
• Platform interaction logs for fraud prevention and security monitoring

4. How We Collect Personal Data

rojak99 collects personal data through the following channels:

• Direct interaction: Data you provide when registering an account, completing KYC (Know Your Customer) verification, submitting a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated collection: Technical and behavioural data collected automatically through cookies, tracking pixels, and server logs as you navigate the rojak99 platform.
• Third-party sources: Identity verification data from licensed KYC providers; payment confirmation data from banks, FPX intermediaries, and e-wallet operators; and fraud risk signals from third-party fraud detection services.

5. Purposes of Processing

rojak99 processes personal data for the following purposes:

• Account registration, identity verification, and ongoing account management
• Processing deposits and withdrawals through FPX, DuitNow, Touch 'n Go eWallet, Boost, and bank transfer channels
• Providing access to gaming services including sportsbook, live casino, slots, and 4D lottery
• Administering bonuses, promotions, and loyalty programmes
• Communicating with you regarding your account, transactions, and platform updates
• Monitoring gaming activity for responsible gaming compliance, including enforcing deposit limits, cool-off periods, and self-exclusion orders
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activities
• Meeting regulatory and licensing obligations, including record-keeping and reporting requirements
• Improving platform performance and user experience through aggregated, anonymised analytics
• Sending personalised marketing communications where you have provided consent or where we have a legitimate interest in doing so

6. Legal Basis for Processing

rojak99 processes personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between rojak99 and the member, including account management and payment processing.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering obligations, age verification requirements, and licensing conditions.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and the responsible gaming programme, where those interests are not overridden by your data protection rights.
• Consent: Marketing communications and non-essential cookies, where your explicit consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

rojak99 does not sell, rent, or otherwise commercially exploit your personal data to third parties. We share personal data only in the following circumstances:

• Payment processors: Banks, FPX clearing intermediaries, DuitNow operators, Touch 'n Go eWallet, and Boost, solely to process your financial transactions.
• Gaming software suppliers: Certified game studios and live casino operators (e.g., Evolution, Pragmatic Play, PG Soft) who process limited session data to deliver their games.
• KYC and fraud prevention providers: Identity verification and fraud detection services operating under strict data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory authority instruction.
• Corporate transactions: In the event of a merger, acquisition, or business restructuring, personal data may be transferred to the relevant successor entity subject to equivalent data protection obligations.

All third-party processors engaged by rojak99 are required to implement appropriate technical and organisational security measures and are prohibited from using your personal data for any purpose beyond the specific services they provide to rojak99.

8. International Data Transfers

Some of rojak99's third-party processors — particularly gaming software providers and fraud prevention services — may be located outside Malaysia. Where personal data is transferred internationally, rojak99 takes appropriate steps to ensure that such transfers are protected by adequate safeguards, including standard contractual clauses or equivalent mechanisms recognised under applicable data protection law. Your data will not be transferred to jurisdictions that do not offer an adequate level of data protection without your explicit consent or unless legally required.

9. Data Retention

rojak99 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data: Retained for the duration of the active account relationship and for a minimum of 5 years following account closure, in accordance with anti-money laundering and licensing record-keeping obligations.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction.
• KYC and identity verification documents: Retained for a minimum of 5 years following the end of the business relationship.
• Technical and session logs: Retained for up to 12 months for fraud prevention and security purposes, unless a longer retention period is required in connection with an active investigation or legal proceeding.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter to evidence the original consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

10. Your Data Subject Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by rojak99:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data in certain circumstances, subject to our legal and regulatory obligations to retain records.
• Right to restriction: You may request that processing of your data be restricted in certain circumstances.
• Right to data portability: You may request a copy of personal data you have provided to us in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our data protection contact via live chat or by emailing [email protected]. We aim to respond to all rights requests within 30 calendar days. We may need to verify your identity before actioning your request.

11. Cookies and Tracking Technologies

rojak99 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session, and analyse platform usage. We use the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These cannot be disabled as they enable core functionality such as authentication and session management.
• Performance cookies: Collect anonymised data on how visitors use the platform (pages visited, time on site, error messages). Used to improve platform performance.
• Functional cookies: Remember your preferences (such as language and display settings) to provide a more personalised experience.
• Marketing and analytics cookies: Used to deliver relevant content and measure the effectiveness of marketing communications. These are only placed with your consent.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to use the rojak99 platform.

12. Children's Privacy

rojak99 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process. If rojak99 discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account terminated. If you believe a minor has registered on the rojak99 platform, please notify us immediately via live chat or email so we can take appropriate action.

13. Security Measures

rojak99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the rojak99 platform
• Encrypted storage of sensitive account credentials
• Firewalls, intrusion detection systems, and real-time security monitoring
• Access controls restricting staff access to personal data on a need-to-know basis
• Regular security assessments and penetration testing
• Two-factor authentication options for member accounts

Despite these measures, no system is entirely immune to security risks. rojak99 will notify you and relevant authorities without undue delay in the event of a personal data breach that poses a risk to your rights and freedoms, in accordance with applicable notification obligations.

14. Changes to This Privacy Policy

rojak99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Where changes are material, we will notify registered members via a platform notice or to your registered contact details. Your continued use of the rojak99 platform following the publication of an updated Policy constitutes your acceptance of the revised terms. We recommend reviewing this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or rojak99's data processing practices, please contact us via:

• 24/7 Live Chat: Available directly on the rojak99 platform at all times.
• Email: [email protected] — please note this is displayed as plain text only.

For formal data subject rights requests, please include your full name, registered email address or mobile number, and a clear description of your request. We will acknowledge receipt within 5 business days and respond within the timeframes required by applicable law.