Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how lembu99 ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects the personal data of individuals ("you", "your", "the Player") who access or use the services provided via https://lembu99.cam and any associated mobile interfaces.

lembu99 operates as an online casino and sports betting platform serving Malaysian players and others in permitted jurisdictions. The processing of personal data is an inherent and necessary part of providing account-based financial services of this nature, and is required by our regulatory obligations — including Know Your Customer (KYC), Anti-Money Laundering (AML), and responsible gambling compliance requirements.

This Policy has been prepared in plain English to ensure that Malaysian players and all users of the Platform can clearly understand how their personal data is handled. It should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the complete framework of your legal relationship with lembu99.

2 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including name, identification number, contact details, financial information, and online identifiers such as IP addresses.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, lembu99 is the Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under contractual arrangements.
• "KYC" — Know Your Customer; the regulatory process of verifying the identity and eligibility of a player prior to providing financial services.
• "Cookies" — small text files placed on your device by the Platform for purposes including session management, security, analytics, and personalisation.
• "Sensitive Personal Data" — a subset of personal data attracting heightened protection under applicable law, including identity document details, financial account information, and health-related information relevant to responsible gambling assessments.

3 Data Controller Information

lembu99 is the Data Controller in respect of all personal data collected from players via the Platform. As Data Controller, we are responsible for ensuring that personal data is processed lawfully, fairly, and in a transparent manner in accordance with applicable data protection legislation.

For all data protection enquiries, subject access requests, or complaints relating to the handling of your personal data, you may contact us using the details set out in Section 16 of this Policy.

4 Data We Collect

The categories of personal data we collect from players are set out below. We collect only what is necessary for the stated purpose and do not engage in excessive or speculative data collection.

4.1 Registration Data

• Full legal name
• Date of birth (for age verification — players must be 21 or above)
• Residential address (including postcode and state, e.g., Kuala Lumpur, Selangor, Penang, Johor)
• Email address
• Mobile phone number
• Username and password (stored in encrypted hashed form — we cannot access your raw password)

4.2 Identity Verification (KYC) Data

• Copy of government-issued identity document — Malaysian MyKad, Driver's Licence, or Passport
• Proof of address documentation — utility bill, bank statement, or tenancy agreement
• Selfie photograph or liveness verification image

4.3 Financial Data

• Payment method identifiers — e-wallet account numbers (Touch 'n Go eWallet, Boost, GrabPay), bank account details (Maybank, CIMB, Public Bank, Hong Leong), or cryptocurrency wallet addresses (BTC/USDT)
• Transaction history — deposit amounts, withdrawal amounts, dates, and reference numbers
• Gaming activity and wagering history for AML and responsible gambling monitoring purposes

4.4 Technical & Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session duration, pages visited, and interaction data
• Cookies and similar tracking technologies (see Section 9)

4.5 Communications Data

• Records of live chat conversations, email correspondence, and support tickets
• Voluntary feedback and survey responses

5 How We Collect Your Data

We collect personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in surveys or promotions.
• Automatically: When you use the Platform, technical data including your IP address, device identifiers, and session activity is collected automatically via cookies and server logs.
• From third-party service providers: KYC and identity verification providers may supply additional data points to supplement verification outcomes. Payment processors confirm transaction status and supply payment method identifiers.
• From publicly available sources: In the course of AML checks, we may reference publicly available information including sanctions lists and adverse media to verify that your account does not pose a compliance risk.

6 Purpose & Legal Basis for Processing

The table below sets out the purposes for which we process your personal data and the legal basis we rely upon for each purpose.

7 Data Sharing & Third Parties

lembu99 does not sell your personal data to any third party for commercial gain. We may, however, share your personal data with the following categories of recipient where necessary and proportionate to the purpose:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These include:

• Payment processors: Entities facilitating transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking network, and cryptocurrency platforms. These providers receive only the data necessary to process the specific transaction.
• KYC and identity verification providers: Specialist firms that process identity documents and perform automated or manual verification of player identity and age.
• IT infrastructure and hosting providers: Cloud infrastructure providers maintaining the servers on which the Platform operates.
• Customer support platforms: Providers of live chat and ticketing software used by our support team.
• Analytics providers: Services that help us understand how the Platform is used, using aggregated or pseudonymised data where possible.

7.2 Regulatory and Law Enforcement Authorities

We may be required by applicable law, court order, or regulatory direction to disclose personal data to governmental authorities, law enforcement agencies, or gaming regulators. We will comply with such obligations and will notify you where legally permissible to do so.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the lembu99 business, your personal data may be transferred to the acquiring entity as part of the transaction. We will provide notice of any such transfer before it occurs where legally required.

8 Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and in compliance with our legal and regulatory retention obligations. The following retention periods apply as a general guide:

• Account and registration data: Retained for the duration of the account and for a minimum of five (5) years following account closure, in compliance with AML record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, as required by applicable KYC regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications: Retained for a period of three (3) years from the date of the final communication in the relevant support thread.
• Technical and device data (logs): Retained for a maximum of twelve (12) months unless a longer period is required for an ongoing security investigation.
• Marketing consent records: Retained until you withdraw consent, plus a further one (1) year for audit purposes.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

9 Cookies & Tracking Technologies

lembu99 uses cookies and similar technologies on the Platform. A cookie is a small data file stored on your device by your web browser. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to understand how players navigate and use the Platform, including page load times and error rates. This data is aggregated and does not identify individual users.
• Functional Cookies: Retain your platform preferences, such as language setting and account display options, between sessions.
• Fraud Prevention Cookies: Used to identify unusual or suspicious access patterns as part of our security and fraud prevention systems.

We do not use advertising or behavioural tracking cookies that track your activity across unrelated third-party websites.

10 Security Measures

lembu99 implements a comprehensive range of technical and organisational security measures designed to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption at rest: All personal data stored on our servers is encrypted using AES-256 encryption.
• Encryption in transit: All data transmitted between your device and our servers is protected using TLS 1.3 or higher (256-bit SSL).
• Access controls: Access to personal data is restricted by role-based access controls. Employees may only access data that is necessary for their specific job function.
• Two-factor authentication: Internal systems containing personal data require multi-factor authentication for all staff access.
• Security monitoring: Our platform is monitored continuously for suspicious activity, intrusion attempts, and data anomalies.
• Staff training: All personnel with access to personal data undergo mandatory data protection training upon appointment and annually thereafter.
• Penetration testing: We conduct regular third-party security assessments and penetration tests to identify and remediate vulnerabilities.

Notwithstanding these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected players and the relevant regulatory authority within the timeframes required by applicable law.

11 Your Rights

Subject to applicable law and certain exceptions, you have the following rights in respect of your personal data held by lembu99. All requests should be submitted using the contact details in Section 16.