Privacy Policy

1. Introduction

shell999 ("shell999", "we", "us", "the Company") is committed to protecting the privacy and personal data of all individuals who interact with our online gaming platform at shell999.net. This Privacy Policy ("Policy") explains what personal data we collect, the purposes for which we use it, with whom we share it, and the rights available to you as a data subject.

This Policy applies to all Players registered on the shell999 platform, as well as visitors who browse shell999.net without registering an account. By registering an account or using any shell999 service, you acknowledge that you have read and understood this Policy. This Policy should be read in conjunction with the shell999 Terms & Conditions.

If you do not agree with the practices described in this Policy, please do not register or use the shell999 platform.

2. Data Controller

For the purposes of applicable data protection legislation, shell999 is the data controller in respect of the personal data of its registered Players. shell999 operates the online gaming platform at shell999.net and is responsible for determining the purposes and means of processing Player personal data.

Enquiries relating to the processing of personal data by shell999 should be directed to our Data Protection contact as set out in Section 14 of this Policy.

3. Personal Data We Collect

3.1 Registration Data

When you create a shell999 account, we collect: full legal name; date of birth; email address; Malaysian mobile telephone number; and a username of your choosing. This information is required to create and administer your account.

3.2 Identity Verification (KYC) Data

Before processing your first withdrawal, shell999 is required by international gaming authority obligations to verify your identity. For this purpose we collect: a copy of your Malaysian Identity Card (IC) or passport (front and back); and, where required, a recent proof of address document such as a utility bill or bank statement issued within the preceding 3 months.

3.3 Financial Data

We collect records of deposits and withdrawals processed through your shell999 account, including the payment method type used (e.g. Touch n Go eWallet, Boost, FPX, GrabPay), transaction reference numbers, transaction amounts in MYR, and timestamps. shell999 does not store full payment card numbers or complete eWallet account credentials — these are handled by our PCI-DSS compliant payment processing partners.

3.4 Gaming Activity Data

We collect records of your gaming activity on the platform including: games played; bet amounts and outcomes; session start and end times; responsible gaming settings applied to your account; and bonus and promotion usage. This data is used for account management, regulatory reporting, dispute resolution, and responsible gaming monitoring.

3.5 Technical & Device Data

When you access shell999.net, our servers automatically collect: IP address; device type and operating system; browser type and version; session duration; pages visited; and referring URL. This data is collected via server logs and first-party cookies and is used for platform security, fraud prevention, and performance optimisation.

3.6 Communications Data

If you contact shell999 customer support via live chat or email, we retain records of those communications including the content of messages, the channel used, timestamps, and the resolution outcome. These records are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

4. How We Use Your Personal Data

shell999 uses the personal data we collect for the following purposes:

• Account creation and management: To register your account, authenticate your identity at login, and administer your account throughout its active life.
• Identity verification (KYC): To verify your identity and age (21+) before processing withdrawal requests, in compliance with international gaming authority requirements.
• Payment processing: To process deposits and withdrawal requests in MYR through your chosen payment method and to maintain accurate transaction records.
• Game delivery and support: To provide access to the shell999 game catalogue, resolve technical issues, and respond to your customer support enquiries.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, identity theft, multiple account abuse, and other prohibited conduct.
• Responsible gaming monitoring: To monitor gaming patterns for indicators of problem gambling and to enforce responsible gaming tools set on your account, including deposit limits and self-exclusion.
• Regulatory compliance: To meet obligations under applicable gaming, anti-money laundering (AML), and data protection legislation, including reporting requirements to relevant gaming authorities.
• Marketing communications: To send you promotional offers, newsletters, and personalised game recommendations where you have consented to receive such communications. You may opt out at any time.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, security, and user experience of the shell999 platform.

5. Legal Bases for Processing

shell999 processes your personal data on the following legal bases:

• Contractual necessity: Processing necessary to create your account, provide gaming services, and process transactions is carried out on the basis that it is necessary to perform the contract between you and shell999 (the Terms & Conditions).
• Legal obligation: KYC verification, AML transaction monitoring, and regulatory reporting are carried out to comply with our legal obligations under applicable gaming authority requirements.
• Legitimate interests: Fraud prevention, platform security, responsible gaming monitoring, and analytics are carried out on the basis of shell999's legitimate interests in operating a secure and compliant gaming platform, provided that these interests do not override your fundamental rights and freedoms.
• Consent: Marketing communications (email, SMS) are sent only where you have given explicit consent. You may withdraw this consent at any time by updating your account notification preferences or contacting customer support.

6. Data Sharing and Disclosure

6.1 Service Providers

shell999 shares personal data with carefully selected third-party service providers who process data on our behalf and are contractually bound to process it only for the purposes specified by shell999 and in compliance with applicable data protection law. These include: payment processing providers (for deposit and withdrawal processing); KYC identity verification providers; live dealer game studios operating under independent gaming authority licences; cloud infrastructure and hosting providers; customer support platform providers; and anti-fraud and AML screening services.

6.2 Regulatory and Legal Disclosure

shell999 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or legally mandated request. shell999 will, where legally permissible, notify the affected Player of such disclosure prior to or promptly following it.

6.3 No Sale of Personal Data

shell999 does not sell, rent, exchange, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. Data is shared with third parties only as described in this Section 6.

7. Cookies and Tracking Technologies

shell999.net uses first-party cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are as follows:

• Strictly necessary cookies: Required for the Platform to function, including session authentication, load balancing, and security tokens. These cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as language settings, game lobby layout preferences, and responsible gaming tool configurations.
• Analytics cookies: First-party analytics cookies that collect aggregated, anonymised data about how Players navigate and use the Platform. This data is used internally to improve page performance and user experience.
• Security cookies: Used to detect fraudulent activity, bot traffic, and unauthorised access attempts.

shell999 does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in and using the Platform.

8. Data Retention

shell999 retains your personal data for as long as your account remains active and for a period following account closure as required by applicable legal, regulatory, and gaming authority obligations. Specific retention periods are as follows:

• Account and registration data: Retained for the duration of account activity and for a minimum of 5 years following account closure, in compliance with AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years following the completion of the business relationship, in accordance with gaming authority and AML requirements.
• Financial transaction records: Retained for a minimum of 7 years following the transaction date for tax and regulatory audit purposes.
• Gaming activity records: Retained for 5 years for regulatory compliance and responsible gaming monitoring purposes.
• Customer support communications: Retained for 3 years following the resolution of the relevant support interaction.
• Technical and device data (server logs): Retained for 12 months unless required to be retained longer in connection with a security investigation or legal matter.

Where data is no longer required for the purposes described in this Policy and no legal retention obligation applies, shell999 will securely delete or anonymise the data.

9. Data Security

shell999 implements and maintains technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include: 256-bit SSL/TLS encryption for all data in transit; encryption of sensitive data fields at rest; strict access controls ensuring that personal data is accessible only to shell999 personnel who require it to perform their functions; multi-factor authentication requirements for internal system access; regular security vulnerability assessments and penetration testing; and a documented incident response procedure for responding to data security breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, shell999 will notify you as soon as practicable in accordance with applicable data protection law. Notifications will be sent to your registered email address.

10. Your Data Rights

Subject to applicable data protection law, you have the following rights in relation to the personal data shell999 holds about you:

• Right of access: You may request a copy of the personal data shell999 holds about you. We will respond to verified access requests within 30 days.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some data (such as your registered name and date of birth) can only be corrected upon submission of supporting identity documentation.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent is the legal basis). This right is subject to overriding legal retention obligations — in particular, shell999 is required by gaming authority and AML regulations to retain certain data for defined periods even after account closure.
• Right to restriction: You may request that shell999 restrict the processing of your data in certain circumstances, for example while a rectification request is under review.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request that we provide your personal data to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests. shell999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g. marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact shell999 Data Protection via the details in Section 14. We may need to verify your identity before processing your request. We will respond within 30 days; complex or multiple requests may require up to 3 months, in which case we will notify you of the extended timeframe.

11. Children's Privacy

shell999 is strictly an adult platform. Registration and use of shell999 is limited to individuals who are 21 years of age or older. shell999 does not knowingly collect personal data from individuals under the age of 21. Where shell999 discovers or has reason to believe that personal data has been collected from a person under 21, the relevant account will be immediately closed and all associated data deleted, except where retention is required by applicable law for regulatory compliance or investigative purposes.

Parents or guardians who believe that a minor has registered on shell999 should contact our customer support team immediately via live chat.

12. International Data Transfers

shell999's primary platform infrastructure is hosted in data centres located within the Asia-Pacific region. Where personal data is transferred to service providers located outside Malaysia — for example, to KYC verification providers or live dealer game studios operating from other jurisdictions — shell999 ensures that such transfers are made subject to appropriate safeguards, including contractual data processing agreements incorporating standard data protection clauses, and only to recipients that implement security standards equivalent to those described in this Policy.

By registering an account and using the shell999 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions other than Malaysia in accordance with this Section.

13. Changes to This Privacy Policy

shell999 reserves the right to update or amend this Privacy Policy at any time. Where material changes are made that affect how your personal data is used or your rights as a data subject, shell999 will notify registered Players by email to their registered address at least 7 days before the changes take effect. The date of the most recent revision is displayed at the top of this page. We recommend that you review this Policy periodically. Your continued use of the shell999 Platform after the effective date of any revised Policy constitutes your acknowledgement of the changes.

14. Contact & Complaints

If you have questions or concerns about how shell999 processes your personal data, or if you wish to exercise any of your data rights described in Section 10, please contact us via:

• Live Chat: Available 24/7 from your shell999 account dashboard
• Email: [email protected] (plain text — not a clickable link)

Please mark any data rights request correspondence with the subject heading "Data Privacy Request" and include your registered username and email address so we can verify your identity and locate your account.

If you are not satisfied with shell999's response to a data privacy concern, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. For Malaysian players, the relevant authority is the Department of Personal Data Protection Malaysia (PDPD) under the Personal Data Protection Act 2010.