Timur99 Privacy Policy – Personal Data Protection for Malaysian Players

1Personal Data We Collect

Timur99 collects your personal data through several different methods depending on how you interact with our platform. The following are the categories of data we may collect:

We do not collect special category data such as health information, religious beliefs, political views, or biometric data unless specifically required by law and with your explicit consent beforehand. All data collection is carried out transparently and purposefully — timur99 never collects data silently or without the user's knowledge.

2Purposes for Using Personal Data

All data collected by timur99 used solely for lawful and clearly stated purposes. Below is the complete list of how your data is used:

• Account Management: Creates and maintains your account, processes registration, and verifies your identity during login or sensitive transactions.
• Financial Transaction Processing: Processes deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks, and FPX; processes withdrawals to registered accounts.
• Identity Verification (KYC): To fulfil legal requirements relating to customer verification and anti-money laundering.
• Service Provision: Operates live casino games, Sports Betting for the Malaysia Super League and EPL, slots, virtual sports, and all other services within the timur99 platform.
• Customer Support: Helps you resolve account issues, betting enquiries, complaints, and any other service needs.
• Platform Security: Detecting and preventing fraud, multi-account usage, money laundering, and any activity that violates the terms of use.
• Product Improvement: Analyzes aggregated, anonymized usage patterns to improve platform features, performance, and the overall user experience.
• Service Communications: Sending important notifications relating to your account, platform updates, or changes to terms and conditions.
• Legal Compliance: To fulfil any reporting or disclosure obligations required under applicable Malaysian law.

Timur99 will not use your data for any purpose beyond the list above without first obtaining fresh consent from you. If you receive marketing communications from us, it means you have given consent for this during registration or through the communication preference settings in your account.

3Legal Basis for Data Processing

Under Malaysia's PDPA 2010, timur99 processes your personal data on different legal bases depending on the nature of the processing:

• Consent: You provide explicit consent when registering a timur99 account and agreeing to this privacy policy. You may withdraw your consent at any time, though doing so may affect our ability to provide certain services.
• Contractual Necessity: Processing necessary to fulfil the service agreement between you and timur99 — including handling deposits and withdrawals, operating games, and managing your account.
• Legal Obligations: Processing required to comply with applicable Malaysian laws, including KYC requirements and financial reporting obligations.
• Legitimate Interests: Processing for the purposes of fraud prevention, platform security, and product improvement – where these interests are reasonably balanced against your privacy rights.

For each category of data processing we carry out, timur99 has assessed and documented the relevant legal basis. If you would like to know the specific legal basis for any data processing activity, you may request this information through our support channels.

4Data Sharing with Third Parties

Timur99 does not sell or share your personal data for third-party marketing purposes. However, in the course of operating the platform, we may share data with the following limited categories of third parties, and only for the purposes stated:

• Payment Providers: Required transaction information is shared with service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and the FPX network (including Maybank2u and CIMB Clicks) to process your deposits and withdrawals. All payment providers are subject to strict confidentiality agreements.
• Game Providers: Minimum required account information may be shared with live casino game software providers to operate your gaming session. This does not include personal financial data.
• IT Service Providers: Cloud and security infrastructure providers that help us operate the timur99 platform securely and reliably. All such providers have data processing agreements in place that comply with PDPA.
• Legal Authority: Where required by a court order, regulatory authority directive, or applicable Malaysian legal requirement, timur99 may be required to disclose certain data to the relevant authorities.

In all data-sharing cases described above, timur99 ensuring that the receiving party maintains an equivalent or higher standard of data protection. We do not share more data than is necessary for the stated purpose — the "need-to-know" principle is strictly applied.

5Data Retention Period

Timur99 retains your personal data only for as long as necessary for the purposes described in this policy, or as required by Malaysian law. The following is a general guide to our retention periods:

• Active Account Data: Retained for the duration your account is active and for a minimum of 7 years after account closure, in accordance with Malaysian financial record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of transaction, in accordance with Malaysian financial reporting legal requirements.
• Support Communication Logs: Retained for 2 years from the date of communication for reference and dispute resolution purposes.
• Technical Data (Server Logs): Retained for 90 days for security and fraud detection purposes, then deleted or anonymized.
• KYC Records: Retained for 5 years after the business relationship ends, in accordance with anti-money laundering requirements.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to you. The deletion process uses methods that ensure data cannot be recovered. If you wish to request early deletion of your data, please contact the privacy team timur99 – requests will be processed in accordance with the rights set out in section 7 of this document.

6Cookies and Tracking Technologies

Platform timur99 uses cookies and similar tracking technologies to enhance user experience and ensure the platform runs smoothly. Cookies are small text files stored on your device when you visit timur99.

• Essential Cookies: Required for core platform functions such as login, session verification, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects anonymous information about how you use the platform – pages visited, time spent, and errors encountered. This data is used to improve the performance of the timur99 platform.
• Functional Cookies: Remembers your preferences such as language, display settings, and game choices so you do not have to reconfigure them each time you log in.
• Security Cookies: Helps us detect and prevent fraudulent activity, bot usage, and unauthorised access attempts to your timur99 account.

You can manage your cookie settings through your web browser at any time. However, disabling certain cookies may affect the functionality or user experience of the platform timur99. Third-party cookies are not used for marketing purposes without your consent.

7Your Rights Under PDPA 2010

As a user timur99 and individuals protected under Malaysia's PDPA 2010, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any data that is inaccurate or incomplete.
• Right to Erasure: Request deletion of your personal data under certain circumstances ("right to be forgotten").
• Right to Restriction of Processing: Request that we restrict how we process your data in certain circumstances.
• Right to Data Portability: Receive your data in a machine-readable format for transfer to another platform.
• Right to Object: Object to the processing of your data on the basis of legitimate interests in certain circumstances.
• Right to Withdraw Consent: Withdraw any consent you have given at any time, without affecting the validity of processing that took place prior to the withdrawal.

To exercise any of the rights above, please contact the privacy team timur99 via email at support@timur99.best with the subject line "Privacy Rights Request – [Account Number]". We will process your request within 14 business days and provide a written response. In complex cases, this period may be extended to up to 30 business days with prior notice.

8Data Security

Timur99 continuously invests in the latest technology and security practices to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The key security measures we have in place include:

• Data encrypted in transit using 256-bit TLS/SSL for all communications between your device and our servers timur99.
• Sensitive data at rest is encrypted using robust database-level encryption.
• Role-based access control (RBAC) ensuring that only authorised staff can access specific data, in accordance with the need-to-know principle.
• Two-factor authentication (2FA) for all staff access to systems containing user data.
• Regular internal security audits and periodic penetration testing conducted by qualified independent parties.
• Real-time cybersecurity threat monitoring with automated intrusion detection systems.
• Ongoing data security awareness training for all staff timur99.

Despite all these measures, no security system is 100% impenetrable. In the event of any data breach involving your information, timur99 will notify you and the relevant authorities within the timeframe required by law, and take all necessary steps to contain and remediate the situation.

9Minors & Special Protection

Platform timur99 is exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18. If you become aware that someone under 18 has registered a timur99 account or provided us with their personal data, please contact us immediately at support@timur99.best.

Once verified, timur99 will immediately deactivate the account in question, delete all associated personal data, and return any funds remaining in that account in accordance with established procedures. Child protection is an absolute priority and we take every such report with the utmost seriousness.

10Changes to the Privacy Policy

Timur99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or updates to our products and services. Any material changes will be communicated to you via an in-platform notification or an email to your registered address, at least 14 days before the changes take effect.

The "Last Updated" date at the top of this document will always reflect the most current version. We encourage you to review this policy periodically. Your continued use of the timur99 after the changes take effect signifies your acceptance of the latest version of this Privacy Policy. If you disagree with any changes, please stop using the platform and contact us to process the withdrawal of your remaining account balance.