Privacy Policy

1Introduction

This Privacy Policy (hereinafter referred to as "Policy") issued by Papilo99 (hereinafter referred to as "Papilo99", "We", "Us", or "the Platform") and governs the collection, processing, storage, and disclosure of personal data relating to registered users and visitors ("Player", "User", "You") of the Papilo99 online gaming platform, accessible atpapilo99.cam.

Papilo99 is committed to handling your personal data with care, transparency, and respect. This Policy is intended to give you a clear and complete understanding of your data rights and our data practices. By registering an account or using any feature of the Platform, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

2Definitions

For the purposes of this Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, payment details, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means Papilo99, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third-party entity that processes Personal Data on behalf of Papilo99 under a written agreement and subject to Papilo99's instructions.
• "KYC" means Know Your Customer — the identity verification process required to validate account ownership and process withdrawal transactions.
• "Cookies" means small text files placed on your device by the Platform to recognise your browser, store session data, and support analytics functions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a specified purpose.

3Data We Collect

Papilo99 collects Personal Data across several categories, each of which serves a specific and necessary operational purpose. The categories of data we collect are set out in the table below:

4How We Collect Data

Papilo99 collects Personal Data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, or contacting customer support;
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, server logs, and similar technologies when you interact with the Platform;
• Third-party sources: Identity and fraud-check data received from KYC service providers, payment processors (e.g., FPX network participants, eWallet operators), and fraud-prevention services, solely for verification and security purposes;
• Inferred data: Preferences and behavioural patterns inferred from your activity on the Platform to support personalisation and responsible gambling monitoring.

5Data Processing & Use

Papilo99 processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and administering your Papilo99 account, including authentication and security;
• Payment Processing: Facilitating deposits and withdrawals via Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, Visa/Mastercard, and cryptocurrencies;
• KYC & Compliance: Verifying your identity, age (21+), and source of funds as required under international gaming licence obligations and anti-money laundering standards;
• Customer Support: Responding to enquiries, complaints, and dispute resolution requests;
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications (you may opt out at any time);
• Responsible Gambling: Monitoring gameplay patterns to identify potentially problematic behaviour and to administer player-protection tools such as deposit limits, session reminders, and self-exclusion;
• Fraud Prevention & Security: Detecting and preventing unauthorised access, fraudulent transactions, bonus abuse, and other security threats;
• Platform Improvement: Analysing aggregated usage data to improve the performance, reliability, and features of the Platform.

6Legal Basis for Processing

Papilo99 processes your Personal Data on the following legal grounds, as applicable to each processing activity:

• Contractual necessity: Processing required to perform our contractual obligations to you as a registered player — including account operations, payment processing, and customer support;
• Legal obligation: Processing necessary to comply with applicable legal requirements, including KYC, anti-money laundering, and licence conditions imposed by Papilo99's international regulatory authority;
• Legitimate interests: Processing carried out in pursuit of Papilo99's legitimate business interests — including fraud prevention, platform security, and responsible gambling monitoring — where these interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing based on your explicit consent, particularly in relation to direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7Data Sharing

7.1 Third-Party Processors

Papilo99 may share your Personal Data with carefully selected third-party service providers who process data on our behalf, strictly in accordance with our instructions and under written data processing agreements. These include:

• KYC and identity verification providers;
• Payment processing partners (including FPX network participants, eWallet operators, and cryptocurrency processing services);
• Fraud detection and anti-money laundering service providers;
• Customer support platform providers;
• Cloud hosting and data storage infrastructure providers.

7.2 Regulatory Disclosure

Papilo99 may be required to disclose your Personal Data to competent regulatory, law enforcement, or governmental authorities where required to do so by applicable law, court order, or the terms of our international gaming licence.

8Data Retention

Papilo99 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. In practice:

• Account data is retained for the duration of your active account and for a minimum period of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements;
• Transaction records are retained for a minimum of five (5) years from the date of the transaction;
• KYC documentation is retained for the period required by Papilo99's applicable licensing authority, typically no less than five (5) years;
• Marketing preference data is retained until you withdraw consent or request deletion;
• Technical and usage logs are typically retained for up to twelve (12) months for security and fraud-prevention purposes.

9Cookies & Tracking Technologies

Papilo99 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device by your web browser when you visit the Platform.

You may manage or delete cookies at any time through your browser settings. Please note that disabling essential cookies may prevent the Platform from functioning correctly.

10Data Security

Papilo99 employs a comprehensive range of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• AES-256 encryption for Personal Data stored at rest in our database systems;
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific function;
• Regular security audits, penetration testing, and vulnerability assessments;
• Two-factor authentication (2FA) available to all registered players;
• Automated intrusion detection and 24/7 security monitoring.

11User Rights

Subject to applicable law and any overiding legal obligations (such as regulatory record-keeping requirements), you hold the following rights in relation to your Personal Data:

• Right of Access: You may request a copy of the Personal Data Papilo99 holds about you;
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data;
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to applicable retention obligations;
• Right to Restriction: You may request that Papilo99 restricts the processing of your data in certain circumstances;
• Right to Data Portability: You may request a structured, machine-readable export of Personal Data you have provided to Papilo99;
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes, with immediate effect for the latter;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without penalty.

To exercise any of the above rights, please contact our support team via live chat on the platform or at email address provided in Section 15. We will respond to verified requests within a reasonable timeframe and in accordance with applicable data protection standards.

12Minors & Age Restriction

Papilo99 strictly prohibits access by persons under the age of 21. The Platform does not knowingly collect Personal Data from individuals under 21 years of age. If Papilo99 discovers or is notified that Personal Data has been collected from a person under 21, such data will be deleted immediately and the associated account will be closed.

Where a player's age cannot be verified during the KYC process, the account will be suspended pending satisfactory verification. For players aged 21 and above only.

13Cross-Border Data Transfers

Papilo99 operates under an international licensing framework, and certain elements of the Platform's infrastructure and third-party services may be located outside Malaysia. Where your Personal Data is transferred to, or processed in, a country outside your jurisdiction, Papilo99 will ensure that appropriate safeguards are in place to protect your data, including contractual data processing agreements with relevant third-party processors that meet internationally recognised data protection standards.

14Policy Updates

Papilo99 reserves the right to update or amend this Privacy Policy at any time. The most recent revision date will be displayed prominently at the top of this page. Material changes to this Policy will be communicated to registered players via email or an in-platform notification prior to the changes taking effect.

Your continued use of the Platform following any amendment to this Policy constitutes your acceptance of the updated terms. If you do not agree with any amended terms, you should cease using the Platform and contact our support team to close your account.

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, or the way Papilo99 handles your Personal Data, please do not hesitate to reach our Data Support team. Our support staff are available 24 hours a day, 7 days a week via live chat directly on the platform.

For written privacy requests — including subject access requests, data deletion requests, or consent withdrawal — you may also contact us at our designated support email address:

For responsible gambling concerns or player-protection queries, please also visit our dedicated Responsible Gambling page. For players aged 21 and above only.