Privacy Policy

This Privacy Policy ("Policy") describes how Ritz99 ("the Company", "we", "our", "us") collects, uses, stores, and protects personal information provided by users ("you", "the Player") when accessing or using the Ritz99 online gaming and sports betting platform at ritz99.cam (the "Platform").

Ritz99 is committed to maintaining the privacy and security of all personal data entrusted to us by our Malaysian player base and international users. We operate in full awareness of the importance of data protection and take our obligations as a data processor seriously.

This Policy applies to all personal data collected through the Platform, including via account registration, deposits and withdrawals using Malaysian payment methods (such as Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, and Public Bank), customer support interactions, and any marketing communications you opt into.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data — Any information that relates to an identified or identifiable natural person, including name, email address, date of birth, national ID number, device identifiers, and financial account details.
• Data Controller — The entity that determines the purposes and means of processing personal data. For the Ritz99 Platform, this is the Company.
• Data Processor — Any third party that processes personal data on behalf of the Data Controller under contractual obligation and in accordance with this Policy.
• Processing — Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• Consent — A freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data.
• KYC — Know Your Customer. The identity and age verification process required before withdrawals are authorised on the Platform.
• Cookies — Small text files placed on a user's device by a website to retain session information and user preferences.

Ritz99 collects personal data in the following categories. We collect only what is reasonably necessary to deliver our services and meet our regulatory obligations.

Ritz99 collects personal data through the following methods:

4.1 Directly From You

• Account registration form — name, date of birth, contact details, residential address;
• KYC document submission — government-issued photo ID, proof of address, selfie verification;
• Payment transactions — deposit and withdrawal requests via Touch 'n Go eWallet, DuitNow, Maybank, CIMB, Public Bank, and other supported methods;
• Customer support interactions — live chat, email correspondence, and complaint submissions;
• Marketing opt-ins — when you subscribe to promotional communications.

4.2 Automatically via Technical Systems

• Cookies and session tracking technologies that record how you navigate and interact with the Platform;
• Device fingerprinting and IP address logging for security and fraud prevention purposes;
• Game activity and betting history logs generated by your use of Platform services.

4.3 From Third Parties

• Identity verification service providers used to validate KYC documents;
• Payment processors and financial institutions involved in processing your transactions;
• Anti-fraud and anti-money laundering screening providers;
• Publicly available records where required for legal compliance or fraud prevention.

Ritz99 processes your personal data for the following specific purposes:

• Account management — Creating and maintaining your Ritz99 account, including login authentication and account security;
• Age and identity verification — Verifying that you are at least 21 years of age and confirming your identity as required by our operating standards;
• Payment processing — Facilitating deposits and withdrawals via your chosen payment method, including e-wallets and bank transfers;
• Regulatory compliance — Meeting anti-money laundering (AML), Know Your Customer (KYC), and responsible gambling obligations;
• Customer support — Responding to your enquiries, resolving disputes, and processing complaints;
• Fraud prevention and security — Detecting, investigating, and preventing fraudulent activity, account takeovers, and abuse of Platform services;
• Responsible gambling — Monitoring gaming behaviour to identify players who may benefit from intervention, limit-setting, or self-exclusion;
• Platform improvement — Analysing aggregated usage data to improve the Platform's features, performance, and user experience;
• Marketing communications — Sending promotional offers, bonus notifications, and event updates where you have provided valid consent to receive such communications.

Where applicable data protection frameworks require a stated legal basis for processing personal data, Ritz99 relies on the following lawful grounds:

• Contractual necessity — Processing required to fulfil our obligations to you under our Terms & Conditions, including account management, payment processing, and service delivery;
• Legal obligation — Processing necessary to comply with applicable legal requirements, including AML regulations, KYC mandates, and age verification standards;
• Legitimate interests — Processing carried out for our legitimate business interests, including fraud prevention, security monitoring, and Platform analytics, provided such interests do not override your fundamental rights;
• Consent — Processing of personal data for marketing communications and certain non-essential cookies, where you have provided explicit consent. You may withdraw consent at any time.

Ritz99 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with the following categories of recipients strictly on a need-to-know basis:

7.1 Service Providers

We work with carefully selected third-party service providers who assist in operating the Platform. These may include payment processors (such as providers facilitating Touch 'n Go eWallet, DuitNow, FPX, and bank transfer transactions), KYC and identity verification providers, cloud infrastructure providers, and customer support platform operators. All service providers are bound by contractual data processing agreements that restrict their use of your data to the specified service only.

7.2 Regulatory and Legal Authorities

Ritz99 may be required by law to disclose personal data to regulatory bodies, law enforcement agencies, or courts in response to a valid legal request, court order, or regulatory investigation. In such cases, disclosure will be limited to what is specifically required by the applicable legal obligation.

7.3 Anti-Fraud and AML Screening

We may share identity and transaction data with licensed anti-fraud and anti-money laundering screening providers as part of our compliance obligations. Such sharing is carried out under strict confidentiality agreements.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the relevant successor entity. We will notify affected users prior to any such transfer and ensure that appropriate data protection safeguards remain in place.

Ritz99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations.

• Account data — Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in line with standard AML record-keeping requirements;
• Transaction records — Retained for a minimum of five (5) years to support financial audit, AML compliance, and dispute resolution requirements;
• KYC documents — Retained for the duration of the account and a minimum of five (5) years post-closure, or longer where required by applicable law;
• Support communications — Retained for two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes;
• Marketing consent records — Retained while consent is active and for one (1) year following withdrawal of consent, as evidence of the consent decision.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

The Ritz99 Platform uses cookies and similar tracking technologies to enhance user experience, maintain session integrity, and support analytics and security monitoring.

9.1 Types of Cookies Used

• Strictly Necessary Cookies — Essential for the Platform to function correctly. These cannot be disabled as they enable login sessions, account security, and transaction processing;
• Functional Cookies — Remember your preferences and settings (such as language, preferred games, and notification settings) to personalise your experience;
• Analytics Cookies — Collect anonymised usage data to help us understand how the Platform is used and identify areas for improvement;
• Security Cookies — Used to detect fraudulent activity and protect your account from unauthorised access.

9.2 Managing Cookies

You may configure your browser settings to block or delete cookies at any time. Please be aware that disabling strictly necessary cookies may impair the functionality of the Platform, including the ability to log in or process transactions. For instructions on managing cookies in your browser, consult your browser's help documentation.

Ritz99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure.

Our security infrastructure includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Ritz99 Platform;
• Encrypted storage for all personal data and financial records at rest;
• Role-based access controls ensuring that employee access to personal data is restricted on a strict need-to-know basis;
• Two-factor authentication options for user accounts to prevent unauthorised access;
• Continuous security monitoring and intrusion detection systems to identify and respond to threats in real time;
• Regular security audits and vulnerability assessments conducted by qualified information security professionals.

While Ritz99 takes all reasonable measures to protect your data, no internet transmission or electronic storage system is completely immune to risk. You are also responsible for protecting your own login credentials and for reporting any suspected unauthorised account activity to our support team immediately.

Subject to applicable data protection law, you have the following rights in relation to your personal data held by Ritz99. To exercise any of these rights, please contact us via the details in Section 14.

We aim to respond to all valid data rights requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for the delay. There is no charge for submitting a data rights request.

The Ritz99 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store personal data from persons under the age of 21.

Age verification is conducted as part of our KYC process for all registered accounts. If we discover that personal data has been collected from a person under 21, we will immediately close the account, delete all associated personal data in accordance with our data disposal procedures, and return any deposited funds to the verified account holder where applicable.

Ritz99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. The effective date displayed at the top of this page will be updated accordingly whenever a new version is published.

Material changes to this Policy — particularly those that affect how we use your personal data or your rights as a data subject — will be communicated to registered users via email notification and/or a prominent notice on the Platform at least 14 days prior to the changes taking effect.

Your continued use of the Ritz99 Platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you must cease using the Platform and contact us to close your account.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have concerns about how your personal data is being handled, please contact the Ritz99 privacy team through the following channels: