Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is issued by Ole99 (hereinafter referred to as "Ole99", "we", "us", or "the Company"), the operator of the online sportsbook and live casino platform accessible at https://ole99.casa (the "Platform").

This Policy describes in detail how Ole99 collects, uses, processes, stores, shares, and protects your personal data when you register an account, access the Platform, make deposits or withdrawals, interact with our customer support team, or participate in any promotions we offer. It also describes the rights you hold in respect of your personal data and how to exercise them.

Ole99 is committed to handling your personal data in full compliance with applicable data protection legislation. We recognise that Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond trust us with their information, and we take that trust seriously.

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, location data, and online identifiers such as IP address or device ID.
• "Processing" means any operation performed on Personal Data, whether automated or not, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the natural person to whom Personal Data relates — in most cases, you, the registered player.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data. Ole99 acts as Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of Ole99 under a binding data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" means identity verification documents including government-issued ID, proof of address, and payment method verification materials submitted under our Know Your Customer process.
• "Transaction Data" means records of deposits, withdrawals, bets placed, game outcomes, bonus activations, and all other financial activity on your account.

Ole99 is the Data Controller in respect of all Personal Data collected through the Platform. As Data Controller, Ole99 is responsible for ensuring that your Personal Data is processed lawfully, fairly, and transparently, and in accordance with the principles set out in this Policy.

Where Ole99 engages third-party service providers to assist in the operation of the Platform — such as payment processors, fraud detection services, or customer support platforms — those providers act as Data Processors under written contracts that bind them to standards no less protective than those set out in this Policy.

Ole99 collects the following categories of Personal Data depending on how you interact with the Platform:

Ole99 collects only the Personal Data that is necessary for the purposes described in this Policy. We do not collect sensitive categories of Personal Data (such as health data, racial or ethnic origin, or political opinions) except where strictly required for responsible gambling assessments or where you voluntarily provide such information in a support context.

Ole99 processes your Personal Data only where a lawful basis exists. The primary lawful bases upon which we rely are as follows:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to operate your account, process deposits and withdrawals, settle bets, and provide the services you have registered for. Without this processing, we cannot provide the Platform.
• Legal Obligation: Processing is necessary to comply with our legal and regulatory obligations, including anti-money laundering (AML) regulations, KYC requirements, responsible gambling regulations, tax reporting obligations, and responses to lawful law enforcement requests.
• Legitimate Interests: Processing is necessary for the purposes of our legitimate interests — including fraud prevention, security monitoring, platform improvement, and internal business analytics — provided those interests are not overridden by your rights and freedoms. We conduct a balancing assessment for each legitimate interest processing activity.
• Consent: Where processing is based on your consent (for example, sending you marketing communications or deploying non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent does not affect processing based on other lawful bases.

Ole99 uses your Personal Data for the following purposes:

• Account Management: Creating and maintaining your Ole99 account, processing logins, verifying your identity, and communicating account-related notifications.
• Service Delivery: Processing deposits and withdrawals via DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and supported cryptocurrencies; settling bets; crediting bonuses; and operating all Platform features.
• KYC & Compliance: Verifying your identity and age (21+), conducting AML and fraud screening, and complying with all applicable regulatory requirements.
• Responsible Gambling: Monitoring play patterns to identify indicators of potential problem gambling; administering self-exclusion, deposit limits, session limits, and cooling-off periods; and contacting you where our responsible gambling obligations require it.
• Customer Support: Responding to queries, resolving disputes, processing complaints, and maintaining records of our communications with you.
• Security: Detecting and preventing fraud, unauthorised access, account sharing, money laundering, and other prohibited activities described in our Terms & Conditions.
• Platform Improvement: Analysing aggregated behavioural and technical data to improve the performance, design, and functionality of the Platform.
• Marketing (where consented): Sending you promotional offers, personalised bonus notifications, and news about Ole99 products and services via email or on-Platform messaging — only where you have provided consent and not opted out.
• Legal Compliance & Enforcement: Preserving records required by law, responding to court orders or regulatory inquiries, and enforcing our Terms & Conditions.

Ole99 does not sell, rent, or trade your Personal Data to any third party. We may disclose your Personal Data to the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment Service Providers: Financial institutions and payment platforms including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency networks — solely to process transactions you authorise.
• Identity Verification Providers: Third-party KYC and AML screening services engaged by Ole99 under data processing agreements to assist with age and identity verification.
• IT & Security Partners: Cloud hosting, cybersecurity, and fraud detection service providers that process data on our behalf under binding contractual protections.
• Customer Support Platforms: Live chat and ticketing system providers that process support communications on our behalf.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory instruction — including tax authorities, financial intelligence units, or law enforcement agencies in any relevant jurisdiction.
• Professional Advisors: Lawyers, accountants, and auditors engaged by Ole99 under confidentiality obligations.

The operation of an international online gaming platform may require the transfer of your Personal Data to countries outside Malaysia. Where such transfers occur, Ole99 ensures that appropriate safeguards are in place to protect your data to a standard no less protective than that afforded under this Policy.

Safeguards used for international transfers may include: standard contractual clauses approved by the relevant data protection authority; adequacy decisions; binding corporate rules; or other legally recognised transfer mechanisms applicable in the circumstances.

Ole99 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, and contractual obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following permanent account closure, to satisfy AML and regulatory record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in compliance with anti-money laundering legislation.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Retained for three (3) years from the date of each communication.
• Technical & Log Data: Retained for twelve (12) months from the date of generation.
• Marketing Consent Records: Retained until consent is withdrawn and for twelve (12) months thereafter as an audit trail.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Where anonymised data is retained beyond these periods, it is used only in aggregated analytical form and does not constitute Personal Data.

Ole99 implements a comprehensive set of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data in transit between your browser and our servers is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Encryption at Rest: Sensitive Personal Data stored on our systems — including KYC documents and payment identifiers — is encrypted using AES-256 or equivalent encryption at rest.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. All staff with access to Personal Data are subject to confidentiality obligations and undergo regular privacy training.
• Multi-Factor Authentication (MFA): Internal systems holding Personal Data are protected by MFA requirements for all authorised personnel.
• Security Monitoring: A dedicated security operations function monitors the Platform around the clock for intrusion attempts, anomalous access patterns, and data integrity issues.
• Penetration Testing & Audits: Ole99 conducts periodic third-party security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident Response: In the event of a data breach, Ole99 will notify affected Data Subjects and the relevant regulatory authority within the timeframes required by applicable law.

Ole99 uses cookies and similar tracking technologies to operate the Platform effectively, enhance your user experience, maintain session security, and analyse aggregate usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies manage your login session, maintain your account balance display, and protect against cross-site request forgery. They cannot be disabled without significantly impairing Platform functionality.
• Performance & Analytics Cookies: Collect aggregated, anonymised data about how users navigate the Platform — including page load times, most-visited sections, and error rates. Used solely for Platform performance improvement.
• Functionality Cookies: Remember your Platform preferences, such as display language, currency display, and odds format (decimal vs. fractional).
• Security Cookies: Assist in fraud detection and bot prevention by analysing behavioural patterns during your session.

Ole99 does not currently deploy third-party behavioural advertising cookies. Where this changes in the future, you will be notified and given the opportunity to provide or withhold consent before such cookies are set.

As a Data Subject, you hold the following rights in respect of your Personal Data held by Ole99. These rights are subject to applicable legal exceptions and may be limited in certain circumstances where overriding legal obligations apply.

To exercise any of the above rights, please contact our Data Protection team via live chat or email as set out in Section 17. We will respond to all valid requests within thirty (30) days. In complex cases, we may extend this period by a further two months, in which case we will notify you of the extension and the reasons for it.

The Ole99 Platform is strictly for persons aged 21 years and above. Ole99 does not knowingly collect Personal Data from anyone under the age of 21. Our registration process includes an age declaration requirement, and we conduct age verification as part of the KYC process.

If Ole99 discovers or is notified that a person under 21 has registered an account and submitted Personal Data, we will immediately suspend the account, delete all associated Personal Data to the extent permitted by our legal retention obligations, and return any net deposited funds subject to applicable verification. We will not use any data collected from underage registrations for any purpose other than handling the remediation of the breach.

Ole99 may send you promotional communications — including information about bonuses, new games, seasonal promotions, and platform updates — via email and in-Platform messaging. We will only send you marketing communications where you have:

• Explicitly opted in during registration or subsequently via your account settings; or
• Not opted out of communications in relation to similar Ole99 services that you have previously used, where permitted under applicable law.

You may opt out of marketing communications at any time by contacting our support team via live chat and requesting removal from our marketing list. Removal is processed within five (5) business days.

Please note that opting out of marketing communications does not affect transactional or operational communications that are necessary for the management of your account, including deposit confirmations, withdrawal notifications, KYC requests, security alerts, and responsible gambling tool activations.

The Platform may from time to time contain references to, or links to, third-party websites or services. Ole99 has no control over the privacy practices, content, or security of any third-party site. The inclusion of any such reference or link does not constitute an endorsement by Ole99 of the third-party site or its privacy practices.

This Policy applies solely to Personal Data collected through the Ole99 Platform at https://ole99.casa. If you visit any third-party site, you are encouraged to review that site's privacy policy independently before providing any Personal Data.

Ole99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The current version of the Policy, with the effective date stated at the top, will always be available on this page.

Where amendments are material — that is, where they significantly affect how your Personal Data is used or your rights in relation to it — Ole99 will provide notice via email or in-Platform notification at least fourteen (14) days before the amended Policy takes effect. For non-material amendments (such as typographical corrections or clarifications that do not alter substantive rights), the updated Policy may take effect immediately upon publication.

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of the data rights described in Section 12, please contact Ole99 through the following channels. All privacy-related communications are handled in English, Bahasa Melayu, and Mandarin.

If you are not satisfied with our response to your privacy-related complaint, you have the right to raise a complaint with the relevant data protection supervisory authority in your jurisdiction. We would, however, appreciate the opportunity to address your concern directly before you approach a supervisory authority.