Mco99 Privacy Policy – Your Personal Data Protection

Mco99 collects your personal information in certain situations when you use our platform. Below are the categories of data we collect:

We only collect information that is strictly necessary to operate our services safely and effectively. You may choose not to provide certain information, though this may limit your access to some platform features.

Personal data you provide to mco99 is used for the following purposes only:

• Account management: Create and manage your member account, including the login process and identity verification (KYC).
• Transaction processing: Manage deposits, withdrawals, and all financial transactions securely and accurately.
• Customer support: Respond to your enquiries, complaints, and support requests through various support channels.
• Platform security: Detect and prevent fraud, money laundering, and unauthorised access to your account.
• Service improvement: Analyse usage patterns in aggregate to improve product quality and user experience.
• Marketing communications: Send promotional information, bonuses, and the latest offers — only to members who have given consent.
• Legal compliance: Meet reporting obligations and applicable legal compliance requirements.

Mco99 only processes your personal data on lawful grounds under Malaysia's PDPA 2010:

• Your consent: For marketing communications and optional data processing, we rely on the explicit consent you provide during registration or through your account settings.
• Contract fulfilment: Processing required to deliver the services you use, including account management and payment processing.
• Legal obligations: Situations where we are legally required to process your data, such as anti-money laundering (AML) reporting obligations.
• Legitimate interests: Processing required for legitimate business interests, such as fraud prevention and platform security, provided it does not override your privacy rights.

Mco99 does not sell or disclose your personal data to third parties for their own marketing purposes. However, we may share data in the following limited situations:

• Service providers: Payment processing partners, cloud service providers, and customer support platforms that help us run our operations — all bound by strict data confidentiality agreements.
• Game providers: Licensed game providers offering slot games, Live Casino, and Sports on the mco99 platform. Data sharing is minimal and for technical purposes only.
• Legal Requirements: When required by court order, law enforcement directive, or regulatory reporting obligation.
• Fraud protection: A recognized fraud prevention agency for detecting and preventing illegal activities that may compromise the safety of other members.

Mco99 continuously invests in security infrastructure to ensure your personal data is always protected. Key security measures we implement include:

• 256-bit SSL encryption: All communications between your device and mco99 servers are encrypted using the latest TLS/SSL technology.
• Encryption of stored data: Sensitive data such as financial information and passwords are stored in encrypted format — passwords are stored using a one-way hashing algorithm that cannot be reversed.
• Strict access controls: Only authorized personnel with a legitimate business need may access member personal data, and all access is recorded in an audit log.
• 24/7 monitoring: A real-time threat detection system monitors all unusual activity or unauthorised access attempts.
• Regular security audits: Vulnerability assessments and penetration testing conducted periodically by independent security experts.
• Two-factor authentication (2FA): Members are encouraged to enable 2FA for an additional layer of account security.

While we take all reasonable precautions, no system can guarantee absolute security. In the event of a data breach involving your information, we will notify you within 72 hours in accordance with applicable reporting requirements.

Mco99 retains your personal data for as long as your account is active or as long as necessary to provide our services. The following are our data retention guidelines:

• Active account data: Retained for the duration your account is active, plus 7 years after account closure for legal compliance purposes.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's tax and AML legal requirements.
• Support communication logs: Retained for 3 years from the date of last interaction.
• Technical log data: Retained for 90 days for troubleshooting and security purposes.
• Marketing data: Retained until you withdraw your marketing consent.

Once the retention period expires, your data will be securely deleted or anonymised in a manner that ensures it can no longer be linked back to you.

Under Malaysia's PDPA 2010, you have the following rights regarding your personal data held by mco99:

To exercise any of the above rights, contact our team by email at [email protected] or via live chat. We will process your request within 30 business days.

Mco99 uses cookies and similar tracking technologies to enhance your experience on our platform. The types of cookies we use are as follows:

• Essential cookies: Required for core platform functions such as login sessions and security. These cookies cannot be disabled.
• Performance cookies: Collect information about how you use our website to help us improve it. All data is collected anonymously.
• Functional cookies: Store your preferences such as language and display settings to deliver a more personalised experience.
• Marketing cookies: Used to display relevant advertisements. You may decline these cookies through your browser settings.

You can control or delete cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of the MCO99 platform.

In the course of platform operations, your personal data may be transferred to and stored on servers located outside Malaysia. This occurs when we use cloud services or international technology partners to support our operations.

Mco99 ensures that any cross-border data transfer only takes place to countries or entities that provide a level of data protection equivalent to Malaysia's standards. We use recognised safeguard mechanisms such as:

• Standard contractual clauses established for international data transfers.
• Data Processing Agreements with all overseas service providers.
• Regular assessments of the security standards of third parties that store or process mco99 member data.

The mco99 platform is exclusively for adults aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we discover that we have collected personal data from a minor without valid parental or guardian consent, we will take immediate steps to delete that information and close the account in question. If you suspect that someone under age has registered on our platform, please notify us immediately at [email protected].

Mco99 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our privacy practices, legal requirements, or new platform features.

When significant changes are made, we will:

• Displaying a clear notice on the home page of our platform.
• Send a notification to your registered email address at least 14 days before the changes take effect.
• Updating the "Last Updated" date at the top of this document.

Continued use of the mco99 platform after a policy change takes effect constitutes your acceptance of the latest version of this Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our Privacy Officer through the following channels:

• Privacy email: [email protected]
• Support email: [email protected]
• Live Chat: Available 24/7 via the chat icon within the mco99 platform or mobile app.
• FAQ: Visit page FAQ us for answers to frequently asked questions about privacy.

We are committed to responding to all privacy-related inquiries within 5 business days. For formal data rights requests, please clearly state the type of request and include a copy of a valid identification document for verification purposes.