Privacy Policy

This Privacy Policy (hereinafter the "Policy") is issued by GTR99 (hereinafter "GTR99", "we", "us", or "our") and applies to all personal data collected, processed, and stored in connection with your access to and use of the GTR99 platform, accessible at gtr99.cam (the "Platform"), including all associated services, features, and communications.

GTR99 is committed to protecting the privacy and personal data of all Players registered on the Platform. We process personal data in accordance with applicable data protection and privacy legislation, including but not limited to the Personal Data Protection Act 2010 of Malaysia (PDPA) and such other international data protection standards as may apply to GTR99's operations.

By registering an account on GTR99, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any provision of this Policy, you should refrain from using the Platform.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" — any operation performed on personal data, whether automated or manual, including collection, storage, retrieval, use, disclosure, erasure, and destruction.
• "Data Subject" — the natural person to whom personal data relates; in the context of this Policy, this typically refers to a registered Player or visitor to the Platform.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. GTR99 acts as Data Controller with respect to Player personal data.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller pursuant to a data processing agreement, such as payment service providers and KYC verification partners.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data.
• "Third Party" — any natural or legal person other than the Data Subject, GTR99, or its Data Processors acting under GTR99's instruction.

GTR99 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

GTR99 collects personal data through the following means:

4.1 Direct Collection

You provide personal data directly to GTR99 when you: complete the account registration form; submit KYC verification documents; make a deposit or withdrawal; contact our customer support team via live chat or email; update your account profile or preferences; or respond to any survey or promotional communication.

4.2 Automated Collection

Technical and usage data is collected automatically when you access or use the Platform. This is achieved through standard web technologies including HTTP server logs, browser cookies, web beacons, and session tracking scripts. Please refer to Section 8 (Cookies & Tracking) for further detail.

4.3 Third-Party Sources

In certain circumstances, GTR99 may receive personal data about you from third-party sources, including:

• Identity verification and KYC service providers engaged to validate your identity documents;
• Payment service providers (such as FPX, DuitNow, and e-wallet operators) who confirm transaction status;
• Fraud prevention and anti-money laundering screening services;
• Publicly available sources such as sanctions and politically exposed persons (PEP) databases.

GTR99 processes your personal data only for legitimate, clearly defined purposes. The principal purposes and their corresponding legal bases are set out below:

• Account Registration & Management — Processing is necessary for the performance of a contract between you and GTR99. This includes creating and maintaining your account, authenticating your identity at login, and enabling access to Platform services.
• Payment Processing — Processing is necessary for the performance of a contract. This covers the receipt and disbursement of funds in MYR via Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and accepted cryptocurrencies.
• KYC & AML Compliance — Processing is required to comply with applicable legal obligations, including anti-money laundering regulations and Know Your Customer requirements. This processing cannot be opted out of.
• Fraud Prevention & Security — Processing is based on GTR99's legitimate interests in protecting the Platform, its Players, and financial systems from fraud, abuse, and criminal activity.
• Customer Support — Processing is necessary for the performance of a contract and for GTR99's legitimate interests in resolving Player queries and complaints effectively.
• Responsible Gambling Compliance — Processing is required by legal obligation and in GTR99's legitimate interests in preventing harm to Players. This includes monitoring for problem gambling indicators and enforcing self-exclusion requests.
• Marketing Communications — Processing is based on your consent, which you may withdraw at any time by updating your communication preferences in your account settings or by contacting support.
• Platform Improvement & Analytics — Processing is based on GTR99's legitimate interests in improving the user experience and commercial performance of the Platform, using anonymised or aggregated usage data.

GTR99 does not sell, lease, or trade your personal data to any third party. We may share your data with the following categories of recipients, solely to the extent necessary to fulfil the stated purposes:

6.1 Service Providers and Data Processors

GTR99 engages third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These include: KYC and identity verification providers; payment processors and e-wallet operators; cloud hosting and infrastructure providers; fraud detection and cybersecurity partners; and customer support platform providers. All such processors are required to maintain appropriate technical and organisational security measures.

6.2 Legal and Regulatory Authorities

GTR99 may disclose personal data to competent regulatory, law enforcement, or governmental authorities where required to do so by applicable law, court order, or regulatory instruction. Such disclosures will be made only to the extent strictly required and will be documented internally.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of GTR99's assets, personal data held by GTR99 may be transferred to the relevant successor entity. You will be notified of any such transfer that materially affects the processing of your personal data.

GTR99 processes financial transactions in Malaysian Ringgit (MYR) and accepted cryptocurrencies (BTC, ETH, USDT, BNB). All payment transactions are routed through certified payment service providers. GTR99 does not store full payment card numbers, and sensitive financial credentials (such as online banking passwords) are never transmitted to or stored by GTR99.

When you make a deposit or withdrawal via Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, or GrabPay, your transaction data is handled by the respective payment service provider in accordance with their own privacy policies and applicable financial regulations. GTR99 receives confirmation of transaction status but does not receive your full banking credentials.

For cryptocurrency transactions, GTR99 records the public wallet address used for each transaction. Cryptocurrency transactions are recorded on the relevant public blockchain and are inherently pseudonymous but not anonymous.

GTR99 uses cookies and similar tracking technologies to operate the Platform effectively, maintain session security, and analyse Platform usage patterns.

8.1 Types of Cookies Used

• Strictly Necessary Cookies — Essential for the Platform to function. These include session authentication cookies and security tokens. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies — Store your preferences such as language settings, preferred deposit method, and game display options. These enhance your experience but are not strictly required.
• Analytical Cookies — Used to collect anonymised data on how Players interact with the Platform, including pages visited, session duration, and error events. This data is used solely to improve the Platform.
• Security Cookies — Used to detect and prevent fraudulent activity, bot access, and other security threats to the Platform.

8.2 Cookie Management

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled through cookie settings as they are required for the secure operation of your account.

GTR99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:

• Account and KYC data — Retained for the duration of your active account, and for a minimum of five (5) years following permanent account closure, in compliance with AML and financial record-keeping obligations.
• Transaction records — Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial record-keeping requirements.
• Communications data — Live chat and email records retained for up to three (3) years from the date of communication, or longer if relevant to an active dispute or regulatory inquiry.
• Technical and usage data — Aggregated analytics data retained for up to two (2) years. Session logs retained for up to twelve (12) months for security and fraud investigation purposes.
• Marketing preferences — Retained until you withdraw consent or close your account, whichever is earlier.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with GTR99's internal data lifecycle management procedures.

GTR99 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the GTR99 Platform;
• Encryption of sensitive data at rest using current industry-standard algorithms;
• Strict role-based access controls limiting internal access to personal data to authorised personnel only;
• Two-factor authentication (2FA) available for all Player accounts;
• Daily automated fraud and anomaly detection monitoring across all Platform systems;
• Regular penetration testing and security audits conducted by qualified third-party security specialists;
• Incident response procedures in place to detect, investigate, and respond to data security breaches within required regulatory timeframes.

While GTR99 takes all reasonable and appropriate steps to protect your personal data, no transmission over the internet or electronic storage system is entirely without risk. Players are responsible for maintaining the security of their own account credentials and should report any suspected unauthorised access to GTR99 support immediately.

As a Data Subject, you hold the following rights in respect of your personal data processed by GTR99. You may exercise any of these rights by contacting GTR99 customer support as described in Section 15 below.

GTR99 will respond to all valid data rights requests within thirty (30) calendar days of receipt. In complex cases, the response period may be extended by a further sixty (60) days, with notification provided to you within the initial thirty-day period. There is no charge for exercising your data rights, except where requests are manifestly unfounded or excessive.

GTR99 does not knowingly collect or process personal data of individuals under the age of 21. The Platform is strictly prohibited for use by persons under 21 years of age. Age verification is a mandatory step in the account registration and KYC process.

If GTR99 becomes aware or has reasonable grounds to suspect that an account has been registered by or is being used by a person under 21 years of age, we will immediately suspend the account, conduct an investigation, and delete any personal data collected in connection with that account, subject to any legal obligations requiring retention.

In the course of providing services to Malaysian Players, GTR99 may transfer personal data to service providers and infrastructure partners located outside of Malaysia. Any such international transfers are subject to appropriate safeguards to ensure that your personal data receives an equivalent level of protection to that afforded under Malaysian data protection law.

Safeguards employed for international transfers include contractual data processing agreements incorporating standard data protection clauses, and transfers only to recipients in jurisdictions that have been determined to provide an adequate level of data protection by relevant authorities.

If you wish to obtain further information about the specific safeguards in place for any international transfer of your personal data, please contact GTR99 support using the details in Section 15.

GTR99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the nature of services offered on the Platform. All amendments will be published on this page.

Where changes are material — meaning they significantly affect how we process your personal data or alter your rights — GTR99 will provide advance notice to registered Players via email or a prominent in-platform notification, no fewer than fourteen (14) days before the changes take effect.

Your continued use of the Platform following publication of an updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. The date shown in the "Effective Date" field at the top of this page will be updated to reflect the most recent revision. The current version of this Policy is always available at gtr99.cam/privacy-policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy-related complaint, please contact the GTR99 Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat feature on this Platform. For data-related requests, please state "Data Privacy Request" at the start of your message to ensure the query is routed to the appropriate team.
• Email: Data privacy enquiries may be submitted in writing to the address shown below. Please include your registered account username, a description of your request, and any relevant supporting information. Mark the subject line "Data Privacy Request" for prioritised handling.
  [email protected]

GTR99 will acknowledge receipt of all data privacy requests within five (5) business days and will provide a full response within thirty (30) calendar days as described in Section 11. We take all privacy enquiries seriously and will handle your request with appropriate care and confidentiality.