Privacy Policy — 96vin

This Privacy Policy ("Policy") is issued by 96vin ("96vin", "we", "us", or "our") and applies to all personal data collected from individuals ("you", "your", or "User") who access, register with, or otherwise interact with the 96vin online gaming platform available at 96vin.cam and any associated mobile applications or sub-domains (collectively, the "Platform").

96vin is committed to protecting the privacy and security of all personal data entrusted to us by our players, the vast majority of whom are based in Malaysia. We process personal data in accordance with applicable data protection principles and the obligations applicable to our operations. This Policy describes our data practices in full — what we collect, why we collect it, how we use it, who we may share it with, how long we keep it, and what rights you have over your own data.

This Policy should be read alongside our Terms & Conditions, which govern the overall agreement between you and 96vin. By creating an account on the Platform or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could reasonably identify a living individual, either alone or in combination with other data. Examples include your full name, MyKad number, email address, phone number, and IP address.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, 96vin acts as the Data Controller in respect of all personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a contractual arrangement and in accordance with the Controller's instructions.
• "Consent" — freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.
• "KYC" (Know Your Customer) — the identity and age verification process required by 96vin to confirm a Player's identity, date of birth, and ownership of the payment methods used on the Platform.
• "Cookies" — small text files placed on your device by the Platform to store information about your session, preferences, and behaviour on the site.

96vin collects personal data in the following categories, depending on how you interact with the Platform:

3.1 Identity & Account Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth — collected to verify that you meet the 21+ minimum age requirement.
• National identification number (MyKad number for Malaysian residents, or passport number for non-resident users).
• Username and encrypted password for Platform login.
• Profile photograph or selfie, where submitted as part of KYC verification.

3.2 Contact Data

• Email address — used for account communications, transaction notifications, and where applicable, marketing communications you have opted into.
• Malaysian mobile phone number — used for two-factor authentication (2FA) and account security alerts.
• City of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam) — collected at registration for market-localisation and responsible gambling purposes.

3.3 Financial & Transaction Data

• Deposit and withdrawal history — transaction amounts in MYR, timestamps, and method used (e.g., FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Visa/Mastercard).
• Payment method ownership details — bank account numbers (last four digits only), e-wallet account identifiers, and card numbers (last four digits only) — used for AML compliance and withdrawal verification.
• Source of funds documentation, where requested for large-value transactions as required by applicable anti-money laundering obligations.

3.4 Gameplay & Behavioural Data

• Game history — titles played, bet amounts, outcomes, session durations, and wagering patterns.
• Bonus activation and wagering progress data.
• Sports betting selections and market preferences (e.g., Liga Super Malaysia, EPL, UFC).
• Responsible gambling tool settings — deposit limits, session timers, self-exclusion status.

3.5 Technical & Device Data

• IP address, device type, operating system, browser type and version.
• Device identifiers and mobile advertising identifiers (where applicable).
• Platform access logs — login timestamps, session durations, page navigation paths.
• Geolocation data at the city/region level — used to detect access from Restricted Jurisdictions, not to track precise physical location.

96vin collects personal data through the following channels and methods:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey or promotion.
• Automatically during Platform use — through cookies, web beacons, server logs, and session tracking technologies that record your interaction with the Platform.
• From payment processors — transaction confirmation data is received from payment networks including FPX, DuitNow, and e-wallet providers when you make a deposit or receive a withdrawal.
• From identity verification services — where 96vin engages third-party KYC and AML screening providers, data may be cross-referenced against public identity databases to verify the accuracy of the information you provide.
• From fraud prevention services — device fingerprinting, IP reputation, and behavioural analytics providers may provide data signals to help us detect fraudulent account activity.

We process your personal data for the following specific purposes. Where we rely on your consent as our legal basis, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

96vin processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contract Performance: Processing is necessary to perform our contractual obligations to you — including maintaining your account, processing your transactions, and delivering gaming services you have requested.
• Legal Obligation: Processing is required for us to comply with applicable legal requirements, including KYC identity verification, anti-money laundering (AML) obligations, and responsible gambling legislation.
• Legitimate Interest: Processing is necessary for our legitimate business interests — such as fraud detection, platform security, service improvement, and responsible gambling monitoring — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: For processing activities such as sending marketing emails, push notifications, or promotional SMS communications, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time through your account settings or by contacting support.

96vin does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the extent necessary for each purpose:

• Payment processors and financial institutions: Transaction data is shared with Malaysian payment networks (FPX, DuitNow, Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay) and card networks (Visa, Mastercard) solely to process your deposits and withdrawals.
• KYC and identity verification providers: Identity documents and personal details may be shared with accredited third-party KYC service providers to verify your identity and comply with legal obligations. These providers are contractually bound to process data only for verification purposes.
• Fraud prevention and AML screening services: Technical and financial data may be shared with specialist fraud detection providers to protect the Platform and its users from fraudulent activity and money laundering.
• Game content providers: Anonymised or pseudonymised gameplay data (not directly identifying personal data) may be shared with game studios for analytical and product improvement purposes.
• Legal and regulatory authorities: We may disclose personal data to competent law enforcement agencies, regulators, courts, or other public authorities where required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosure where legally permitted to do so.
• Group entities and successors: In the event of a corporate restructuring, merger, or acquisition, your personal data may be transferred to the successor entity, subject to equivalent data protection commitments.

96vin uses cookies and similar tracking technologies to operate and improve the Platform, remember your preferences, and analyse usage patterns. By using the Platform, you consent to the use of cookies as described in this section.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These enable core features such as session management, account login, and security. They cannot be disabled without affecting Platform functionality.
• Performance & Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, session duration, error events — to help us improve user experience. No personally identifying information is collected.
• Functionality Cookies: Remember your preferences such as language settings, display preferences, and last-visited game categories to personalise your experience on return visits.
• Security Cookies: Used to detect and prevent fraudulent account access, bot activity, and unusual login patterns. These are a critical component of our account protection infrastructure.

8.2 Managing Cookies

You may configure your browser to refuse or delete cookies. Note that disabling certain cookie categories — particularly strictly necessary and security cookies — will impair or prevent your ability to use the Platform. Most modern browsers provide cookie management controls in their settings menus.

96vin retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account's existence on the Platform, plus any mandatory retention period thereafter.
• Transaction and financial records: Retained for a minimum of 7 years from the date of the transaction, in compliance with applicable financial record-keeping obligations.
• KYC verification documents: Retained for a minimum of 5 years following account closure or the termination of the business relationship, as required by applicable AML regulations.
• Support communications: Retained for 3 years from the date of the interaction, to enable resolution of any subsequent queries or disputes.
• Marketing consent records: Retained for the duration of any active marketing relationship, plus 2 years following withdrawal of consent or account closure — to demonstrate compliance with consent requirements.
• Anonymised analytics data: May be retained indefinitely, as it does not constitute personal data once all identifying information has been irreversibly removed.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard methods.

96vin employs a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit AES encryption for all personal data stored at rest across our infrastructure.
• TLS 1.3 encryption for all data transmitted between your device and the Platform — the same standard used by major Malaysian banks for online banking sessions.
• Two-factor authentication (2FA) available to all account holders and mandatory for withdrawal requests above specified thresholds.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists on a scheduled basis.
• Access controls and least-privilege principles limiting internal staff access to personal data strictly to those roles where access is operationally necessary.
• Intrusion detection systems and 24/7 security monitoring to identify and respond to anomalous access patterns or security events in real time.

In the event of a personal data breach that poses a risk to your rights and freedoms, 96vin will notify affected users and relevant authorities in accordance with applicable breach notification obligations, without undue delay.

As a data subject, you hold a number of rights over your personal data. 96vin is committed to facilitating the exercise of these rights in a timely and straightforward manner. You may exercise any of the following rights by contacting our support team via live chat or email at [email protected]:

We aim to respond to all verifiable data rights requests within 30 days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you promptly. We may request proof of identity before processing a data rights request to protect against unauthorised data access.

The 96vin Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Registration by or on behalf of anyone under 21 is absolutely prohibited under our Terms & Conditions and this Privacy Policy.

We take all reasonable steps to verify the age of users during the registration and KYC process. If we become aware that personal data has been collected from a person under 21 — whether through misrepresentation or any other means — we will promptly delete that data, suspend the associated account, and return any deposited funds in accordance with our account closure procedures.

Parents or guardians who believe that a minor may have registered an account on the Platform are encouraged to contact our support team immediately at [email protected].

The Platform may, from time to time, reference or integrate third-party services such as payment gateways, analytics providers, or identity verification services. Where such third-party services are used, they operate under their own privacy policies and terms of service.

96vin is not responsible for the privacy practices of third-party service providers, and we encourage you to review their policies independently. We do, however, conduct due diligence on all third-party processors we engage, and require them to implement appropriate data protection safeguards contractually.

Third-party payment processors — including FPX, DuitNow, Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, and the Visa/Mastercard networks — each operate under their own independently maintained privacy frameworks and are regulated by their respective financial authorities.

96vin reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the introduction of new Platform features. The "Last Updated" date at the top of this page indicates when the most recent revision was published.

Where a change is material — meaning it substantively alters your rights or the way we process your data — we will provide advance notice via the Platform and/or by email to your registered address, at least 7 days before the change takes effect, where operationally practicable. Non-material amendments (such as typographical corrections or clarifications that do not affect substantive rights) take effect immediately upon publication.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and contact our support team to arrange account closure.

If you have any questions, concerns, or complaints about this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 11, please contact the 96vin privacy team through any of the following channels. We take all privacy enquiries seriously and aim to respond promptly.

• Email: [email protected] — please include "Privacy Enquiry" or "Data Rights Request" in your subject line for priority routing to our data protection team.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. For data rights requests via live chat, our agents will escalate your request to the relevant team and confirm receipt in writing within 24 hours.
• Response Commitment: We aim to acknowledge all privacy-related communications within 5 business days and to provide a substantive response within 30 calendar days of receipt.

If you are not satisfied with our response to a privacy enquiry or data rights request, you have the right to escalate your complaint to the relevant data protection or privacy supervisory authority in your jurisdiction.