Privacy Policy

This Privacy Policy ("Policy") describes how Cempaka99 ("we", "us", "our", or the "Company") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "User", or "Player") who access or use the Cempaka99 platform, available at https://cempaka99.cam, including all associated web pages, account portals, game lobbies, and customer support channels.

We are committed to handling your personal data with the highest standards of care, transparency, and security. This Policy is designed to give you a clear and honest picture of our data practices so that you can make informed decisions about how you interact with our platform.

By registering an account with Cempaka99, depositing funds, or otherwise accessing any part of our platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern the overall relationship between you and Cempaka99.

If you have any questions about this Policy or about how we handle your personal data, please contact us at [email protected] before registering. We are happy to clarify any aspect of our data practices prior to your signing up.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — i.e., information that can be used, directly or indirectly, to identify you as an individual, such as your name, email address, date of birth, payment details, or device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means Cempaka99, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Cempaka99 under a written data processing agreement and in accordance with our documented instructions.
• "Consent" means freely given, specific, informed, and unambiguous agreement to the processing of your personal data for a stated purpose, which you can withdraw at any time.
• "KYC Data" means identity verification documents and information collected during the Know Your Customer process, including government-issued identification, proof of address, and proof of payment method ownership.
• "Cookie" means a small text file placed on your device by a web server for the purpose of session management, preference storage, or analytics tracking.

Cempaka99 collects personal data in several categories, depending on the nature of your interaction with the platform. The table below describes the categories of personal data we collect, with examples and the primary reason for collection:

We collect personal data through the following channels and mechanisms:

4.1 Directly From You

The majority of the personal data we hold about you is provided directly by you when you:

• Complete the account registration form on the Cempaka99 platform.
• Submit identity and address documents during the KYC verification process.
• Make a deposit or request a withdrawal via any of our supported payment methods, including Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, or FPX.
• Contact our customer support team via live chat or email.
• Update your account profile or notification preferences.
• Participate in surveys, promotions, or other voluntary activities on the platform.

4.2 Automatically Through Platform Use

Certain technical data is collected automatically when you access the Cempaka99 website or use our gaming services. This includes your IP address, device fingerprint, browser characteristics, pages visited, click-stream data, session duration, and gaming activity. This automated collection is necessary for platform security, fraud detection, and the delivery of a stable gaming experience.

4.3 From Third-Party Sources

In limited circumstances, we may receive personal data about you from third parties, including:

• Payment processors and e-wallet providers, who confirm transaction statuses and may share account verification data for fraud prevention purposes.
• Identity verification service providers engaged to support our KYC programme.
• Fraud detection and AML screening services that cross-reference account data against watchlists or known fraudulent activity databases.

Cempaka99 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is required to fulfil our contractual obligations to you as set out in our Terms and Conditions — including account management, transaction processing, game delivery, and customer support. Without this processing, we would be unable to provide our services.
• Legal Obligation: Processing that is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, identity verification mandates, and data retention rules imposed by our licensing framework.
• Legitimate Interests: Processing conducted for the legitimate interests of Cempaka99 or third parties, where those interests are not overridden by your privacy rights — including fraud prevention, platform security monitoring, business analytics, and network infrastructure management.
• Consent: Processing based on your explicit consent, which you have the right to withdraw at any time without affecting the lawfulness of processing carried out prior to withdrawal. This applies primarily to marketing communications and non-essential cookies.

Your personal data is processed by Cempaka99 for the following specific and documented purposes:

• Account Creation and Management: Registering your account, authenticating your identity at login, maintaining your account profile, and managing account preferences and settings.
• Identity Verification (KYC): Verifying your age (21+), identity, and residential address in accordance with our KYC obligations prior to processing withdrawals or upon account review.
• Payment Processing: Processing deposits and withdrawals via Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and supported cryptocurrency networks.
• Service Delivery: Providing access to casino games, sports betting markets, live dealer tables, and all other features available on the Cempaka99 platform.
• Customer Support: Responding to your queries, complaints, and support requests submitted via live chat, email, or other channels.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, multiple account registrations, bonus abuse, and other prohibited activities.
• Anti-Money Laundering Compliance: Monitoring transactions and account activity for patterns consistent with money laundering, terrorist financing, or other financial crimes, and fulfilling reporting obligations where required by law.
• Responsible Gambling Monitoring: Tracking gaming activity to identify signs of problem gambling and to fulfil our obligations under our responsible gambling programme, including administering self-exclusion and deposit limit requests.
• Marketing and Promotions: Sending you promotional communications about bonuses, offers, and new games where you have provided consent or where we have a legitimate interest in notifying existing customers about relevant offers. You may opt out at any time.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, user experience, and payment processes.
• Legal and Regulatory Compliance: Fulfilling our obligations under applicable laws and our licensing framework, responding to lawful requests from courts or regulators, and maintaining records as required by law.

Cempaka99 does not sell your personal data. We do not disclose your personal data to third parties for their own commercial or marketing purposes. Your data may be shared in the following limited and controlled circumstances only:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf, strictly under our instructions and pursuant to written data processing agreements. These include:

• Payment processors and e-wallet gateway providers (including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX transactions).
• Identity verification and KYC service providers.
• Fraud detection and AML screening platforms.
• Cloud infrastructure and secure data hosting providers.
• Customer support platform providers (live chat and ticketing systems).
• Email delivery service providers (for transactional and marketing communications).

7.2 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other governmental bodies where we are required to do so by applicable law, pursuant to a valid court order, or in connection with the investigation or prosecution of a criminal offence — including but not limited to money laundering, fraud, or identity theft involving your account.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving Cempaka99, your personal data may be transferred to the acquiring or successor entity as part of the transaction. You will be notified of any such transfer and your rights in relation to your data will be preserved.

Cempaka99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligation. The following retention periods apply as general guidelines:

• Account and Identity Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, to comply with AML and licensing record-keeping requirements.
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with anti-money laundering regulations applicable to our licensing jurisdiction.
• KYC Documents: Retained for a minimum of five (5) years following account closure or the completion of the business relationship to which the documents relate.
• Customer Support Records: Retained for a minimum of two (2) years from the date of each interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained from the date of consent until you withdraw consent, plus a short additional period to evidence the historical basis of our marketing activities.
• Technical and Log Data: Retained for a rolling period of twelve (12) months, after which it is anonymised or permanently deleted.

Where retention beyond these periods is required by a court order, regulatory instruction, or ongoing investigation, data will be retained until the relevant matter is resolved.

The Cempaka99 platform uses cookies and similar web technologies to deliver and improve our services. A cookie is a small data file stored on your device by your web browser when you visit our site. We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable session management, maintain your login state, and ensure the security of your account. These cookies cannot be disabled without affecting core functionality.
• Performance and Analytics Cookies: These cookies collect anonymised information about how visitors use the platform — which pages are visited most frequently, where errors occur, and how long sessions last. This data helps us improve the platform experience. These cookies are only placed with your consent.
• Functional Cookies: These cookies remember your preferences, such as your chosen language settings, displayed currency, and notification preferences, to personalise your experience on return visits.
• Marketing Cookies: Where you have provided consent, we may use cookies to track interactions with promotional content and to tailor future communications to your demonstrated interests. You can withdraw this consent at any time.

9.1 Managing Cookies

You can manage and delete cookies at any time through your browser's settings. Please note that disabling strictly necessary cookies will prevent you from using core platform features including account login. Most modern browsers provide detailed cookie management controls — consult your browser's help documentation for guidance specific to your browser.

Cempaka99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and our servers is encrypted using256-bit TLS encryption, ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Password Security: Account passwords are stored as cryptographic hashes — never in plain text. We use industry-standard hashing algorithms with salting to protect password data even in the event of a server compromise.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. Administrative and staff access to production systems requires mandatory multi-factor authentication.
• Access Controls: Personal data is accessible only to staff members whose roles require access. We operate a principle of least privilege — employees are granted only the minimum access rights necessary to perform their specific job functions.
• Regular Security Audits: Our platform undergoes periodic security reviews, penetration testing, and vulnerability assessments conducted by qualified security professionals.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach likely to result in risk to your rights and freedoms, we will notify you and the relevant regulatory authorities within the timeframe required by applicable law.

Subject to applicable law and the limitations described below, you have the following rights in relation to your personal data held by Cempaka99:

11.1 Exercising Your Rights

To exercise any of the rights listed above, please submit a written request to our Customer Support team via live chat or email at [email protected]. Include your registered email address and a clear description of the right you wish to exercise and the data to which your request relates. We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days, or notify you if an extension is required.

11.2 Limitations on Rights

Your rights are not absolute. Where we are required by law to retain your data (such as for AML compliance or pursuant to a court order), your right to erasure or restriction may be limited accordingly. We will always explain the specific reason if we are unable to fulfil a data rights request.

As an internationally operated platform, Cempaka99 may transfer personal data to servers and service providers located outside of Malaysia. Wherever personal data is transferred internationally, we ensure that adequate protections are in place, including:

• Transfers only to jurisdictions that provide a recognised adequate level of data protection, or
• Implementation of appropriate safeguards such as standard contractual clauses or equivalent mechanisms as required by applicable data protection law.

All third-party data processors receiving international transfers of your personal data are contractually bound to process that data only for the purposes and in the manner specified by Cempaka99, and to maintain security standards at least equivalent to those we apply internally.

The Cempaka99 platform is strictly intended for adults aged21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Registration by minors is prohibited and constitutes a material breach of our Terms and Conditions.

If we discover or are informed that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to permanently delete that data and close the relevant account. Any winings or balances associated with an underage account will be forfeited.

If you are a parent or guardian and believe that your child may have registered an account on the Cempaka99 platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

Where you have provided explicit consent during registration or subsequently opted in through your account settings, Cempaka99 may send you promotional communications about bonuses, new games, seasonal offers, and platform updates by email or in-platform notification.

We will never send unsolicited marketing communications to individuals who have not opted in. Each marketing email we send will include a clearly visible and functional unsubscribe mechanism. You may also withdraw your marketing consent at any time by updating your notification preferences in your account settings or by contacting our support team.

Withdrawal of marketing consent does not affect your ability to use the platform or to receive transactional communications related to your account, such as deposit confirmations, withdrawal processing notices, and KYC verification requests — these are sent on the basis of contractual necessity and cannot be opted out of while your account remains active.

Cempaka99 reserves the right to update or amend this Privacy Policy at any time. We will publish the revised Policy on this page with an updated "Last Updated" date. Where changes are material — such as a new purpose for processing, a new category of data being collected, or a change in data sharing practices — we will notify registered players via email or in-platform notification before the changes take effect.

Your continued use of the Cempaka99 platform following the effective date of any revised Privacy Policy constitutes your acceptance of those changes. We encourage you to review this Policy periodically to remain informed about how we protect your personal data. The current version will always be accessible at https://cempaka99.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Cempaka99 processes your personal data, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the in-platform chat widget. This is the fastest route for general queries.
• Email: [email protected] — formal written correspondence, data subject requests, and document submissions. Please allow up to 48 hours for an initial response to email enquiries, and up to 30 days for the substantive handling of formal data rights requests.

When submitting a data rights request, please include your registered email address, a clear description of the request and the data it relates to, and — where we need to verify your identity before acting — a copy of suitable identification. We will confirm receipt of your request within five (5) business days.