PM89 Privacy Policy — Personal Data Protection for Malaysian Players

This Privacy Policy is published by PM89, an online Sports Betting and casino platform operating under the domain pm89.my. This document details how PM89 collects, uses, stores, discloses, and protects the personal information you provide to us when registering and using PM89's services.

PM89's Privacy Policy is formulated in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA), the principal legislation governing the processing of personal data in the context of commercial transactions in Malaysia. PM89 operates as a "data controller" under the PDPA and is responsible for ensuring that all processing of player personal data is carried out in accordance with the principles set out in the Act.

This policy applies to all individuals who use or access the PM89 platform, including registered players, website visitors, and anyone who interacts with PM89 through customer support channels. By registering an account or continuing to use the PM89 platform, you confirm that you have read and agreed to the terms of this Privacy Policy.

PM89 collects various categories of personal data depending on your level of interaction with our platform. Below is a detailed breakdown of each data category we collect:

PM89 does not collect sensitive data categories such as health information, political affiliations, or religious beliefs, unless voluntarily submitted by a player in the context of a responsible gambling self-exclusion application. Such data is handled with additional safeguards and used solely for the explicitly stated purpose.

PM89 collects player personal data through several different channels and methods:

• Account Registration: When you complete PM89's registration form, basic information such as your name, email address, phone number, and date of birth is collected directly.
• KYC Verification: To meet compliance requirements, PM89 may request identity verification documents such as a copy of your MyKad or proof of address during the Know Your Customer (KYC) process.
• Financial Transactions: Data related to deposits and withdrawals is collected automatically each time you make a transaction via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, or FPX.
• Platform Usage: Your activity on the PM89 platform — bets placed, games played, and access times — is automatically collected by our systems.
• Cookies & Tracking Technologies: PM89 uses cookies and similar technologies to enhance the user experience and analyze platform usage patterns.
• Support Communications: When you contact PM89's support team via live chat or email, the information you provide during that interaction is retained for the purposes of issue resolution and service improvement.

PM89 uses the personal data it collects for legitimate, clearly stated purposes. Every use of data has a sound legal basis, whether grounded in your consent, contractual necessity, legal obligation, or PM89's legitimate interests:

• Create and manage your PM89 account and verify your identity during login
• Processing deposits and withdrawals securely and accurately to the registered payment method
• Ensuring compliance with legal and regulatory requirements, including PDPA and Anti-Money Laundering (AML) procedures
• Identifying and preventing fraud, money laundering, and other unlawful activities on the PM89 platform
• Provide effective customer support and resolve complaints promptly
• Sending account-related communications such as transaction confirmations, security notifications, and important service updates
• Personalising your PM89 platform experience based on your preferences and usage patterns
• Conducting aggregate data analysis to improve PM89's products and services (in a form that cannot identify any individual)
• Sending relevant promotional information and bonuses to players who have given consent to receive marketing communications

PM89 will not use your data for any purpose beyond those stated above without first obtaining your fresh consent, unless required or permitted by applicable Malaysian law.

PM89 does not sell player personal data to any third party for commercial purposes. However, in the course of operating the platform, PM89 may share personal data with a limited set of recipients for specific purposes:

• Payment Processors: Transaction information is shared with PM89's supported payment service providers, including DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and the FPX network, to enable secure transaction processing.
• IT Service Providers: Technical infrastructure and cloud service providers that support PM89's operations, subject to strict data protection agreements.
• Legal Authorities: PM89 will disclose personal data to Malaysian authorities when required by law or a valid court order, or for the purpose of preventing financial crime.
• Verification Service Providers: Limited data sharing with identity verification (KYC) service providers and blacklist screening services to meet AML compliance requirements.

All third parties that receive PM89 players' personal data are bound by data protection agreements requiring them to maintain the confidentiality and security of that data to a standard no less stringent than PM89's own. PM89 is not responsible for the privacy practices of third parties operating outside our control.

PM89 implements comprehensive technical and organizational security measures to protect player personal data from unauthorized access, disclosure, alteration, or accidental destruction:

• 256-bit SSL encryption for all data in transit between players' devices and PM89's servers
• Encryption of sensitive data at rest using industry-recognized cryptographic algorithms
• Role-based access control ensures that only authorized personnel can access player data
• Regular data access auditing and real-time monitoring of suspicious activity
• Penetration testing and security audits conducted regularly by independent third parties
• Secure data backup systems to ensure service continuity and data recoverability

PM89 retains players' personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Generally, active account records are kept for the duration the account remains active, plus 7 years after account closure to meet financial and legal compliance requirements. Data that has reached its maximum retention period will be securely deleted or anonymised.

PM89 uses cookies and similar tracking technologies to enhance the functionality and user experience of our platform. Cookies are small text files stored on your device when you visit the PM89 website. The following are the types of cookies we use:

• Essential Cookies: Required for the platform's core functions, such as login session authentication and security. These cookies cannot be disabled without affecting the functionality of the PM89 platform.
• Preference Cookies: Saves your preferences — such as language, display settings, and interface options — so you don't have to reconfigure them every time you log in to PM89.
• Analytics Cookies: Enabling PM89 to understand aggregate platform usage patterns in order to identify technical issues and improve performance. Analytics data is not linked to the identity of any individual player.
• Security Cookies: Used to detect suspicious login attempts, track active sessions, and prevent unauthorized access to your PM89 account.

You can manage and control cookie settings through your web browser. However, disabling certain cookies may affect the functionality of the PM89 platform and your overall user experience. Continued use of the PM89 platform after the cookie notice is displayed will be considered your consent to the use of cookies as described in this policy.

Under Malaysia's PDPA and PM89's privacy policy, you as a player hold several important rights regarding your personal data. All data rights requests are processed within 14 business days:

PM89 reserves the right to decline requests that are unreasonable, repetitive, or contrary to our legal obligations. If a request is refused, we will notify you of the reason within 14 business days. You also have the right to lodge a complaint with the Department of Personal Data Protection Malaysia if you are dissatisfied with PM89's response to your data rights request.

PM89 does not provide services to individuals under the age of 18. We do not knowingly collect personal data from underage children or minors. The PM89 platform is designed and intended solely for adults who meet the minimum age requirement.

If PM89 discovers that personal data belonging to an individual under the age of 18 has been inadvertently collected — for example, through account registration using false information — we will take the following actions immediately:

• Suspending the account in question immediately while an investigation is conducted
• Delete all personal data associated with the account
• Returning any deposited funds to the original payment source
• Permanently closing the account and blacklisting the associated information

If you believe that a child under your care has registered a PM89 account without authorisation, please contact the PM89 support team immediately at support@pm89.my so we can take the appropriate action without delay.

PM89 players' personal data is primarily stored and processed on servers located in Malaysia or in Asian regions with equivalent data protection standards. In specific cases where data may be transferred outside Malaysia — for example, for data backup purposes or the use of global cloud services — PM89 ensures such transfers are carried out in accordance with the guidelines set by Malaysia's PDPA.

Any cross-border data transfer is carried out under the following conditions:

• The recipient country or region maintains a level of data protection equivalent to or exceeding Malaysia's standards
• An appropriate data transfer agreement has been established between PM89 and the data recipient
• The transfer is necessary for a legitimate and clearly defined purpose related to the provision of PM89's services
• Players are informed of the possibility of cross-border transfers through this policy

PM89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data handling practices, new legal requirements, or updates to PM89's business operations. Any amendments will take effect as soon as the updated version is published on the PM89 website.

For material amendments that significantly affect how PM89 handles players' personal data, we will endeavour to notify registered players via their registered email address or through an in-account notification on PM89 at least 14 days before the amendment takes effect, unless the amendment is required by law and demands immediate implementation.

For any enquiries, requests, or complaints regarding PM89's Privacy Policy or the handling of your personal data, please contact us through the following channels:

• Privacy Email: support@pm89.my — use the subject line "Privacy Enquiry" or "Data Request" to expedite your response. Response time is within 2 hours on business days.
• Live Chat: Available 24/7 on the PM89 platform — click the chat icon in the bottom right corner to speak with our support team in Bahasa Melayu.
• Frequently Asked Questions: Visit our Frequently Asked Questions page for answers to the most frequently asked privacy questions.

PM89 is committed to handling all privacy enquiries and complaints with seriousness and professionalism. If you are not satisfied with PM89's response, you have the right to file a formal complaint with the Department of Personal Data Protection (JPDP) Malaysia, the statutory regulatory body established under PDPA 2010.