shell99 Privacy Policy

1. Who We Are

Shell99 is an online gaming platform operating at shell99.win, providing sports betting, live casino, slot games, lottery, and fisher game products to adult players in jurisdictions where such activities are permitted. Shell99 is the data controller for all personal data collected through the Platform.

For all privacy-related enquiries, you may contact shell99 via the 24/7 live chat function on the Platform, or via email at [email protected]. Shell99 aims to respond to all written privacy requests within five (5) business days.

2. Data We Collect

2.1 Information You Provide Directly

When you register for a shell99 account, deposit funds, request a withdrawal, contact support, or respond to a promotion, you may provide us with the following categories of personal data:

• Identity data: full legal name, date of birth, nationality, government-issued identification number (e.g., Malaysian IC number or passport number).
• Contact data: Malaysian mobile phone number, email address, and residential or correspondence address.
• Financial data: payment method details (e.g., Touch n Go eWallet account reference, Boost account reference, bank account name and number for Maybank or CIMB transfers), deposit history, and withdrawal records.
• Account credentials: username and password (passwords are stored only as salted cryptographic hashes — never in plain text).
• Communications data: records of your interactions with shell99 customer support, including live chat transcripts and email correspondence.

2.2 Information Collected Automatically

When you access and use the shell99 Platform, we automatically collect certain technical data, including:

• IP address and geolocation data (country and city level).
• Device type, operating system, and browser type and version.
• Session data: login timestamps, session duration, pages visited, and games played.
• Betting and wagering history, including stake amounts, game outcomes, and net win/loss data.
• Cookie identifiers and similar tracking technology data (see Section 6).

2.3 Identity Verification Data

Shell99 is required by applicable gaming regulations to verify the identity of account holders. As part of this process, we may request and collect copies of identity documents (such as your Malaysian NRIC or passport), proof of address, and payment method verification documents. This data is collected, processed, and stored in compliance with our anti-money laundering obligations.

3. How We Use Your Data

Shell99 uses the personal data we collect for the following purposes:

• To create, maintain, and administer your shell99 account.
• To process deposits and withdrawals, and to verify payment method ownership.
• To verify your identity and age (21+) in compliance with our licensing obligations and anti-money laundering requirements.
• To detect and prevent fraud, money laundering, collusion, and other prohibited conduct as defined in our Terms & Conditions.
• To personalise your experience on the Platform, including game recommendations and promotion eligibility.
• To communicate with you regarding your account, including security alerts, transaction confirmations, and support responses.
• To send you promotional communications and bonus offers, where you have consented to receive such communications.
• To comply with legal and regulatory obligations, including reporting obligations to relevant gaming and financial authorities.
• To enforce our Terms & Conditions and protect the rights, property, and safety of shell99, our users, and third parties.
• To improve the Platform, analyse usage patterns, and develop new features.

4. Legal Basis for Processing

Shell99 processes personal data on the following legal bases:

• Contractual necessity: processing necessary to fulfil our obligations to you under the account registration agreement and Terms & Conditions, including operating your account, processing transactions, and providing customer support.
• Legal obligation: processing required to comply with applicable gaming regulations, anti-money laundering laws, tax obligations, and reporting requirements imposed on shell99 by regulatory authorities.
• Legitimate interests: processing necessary for shell99's legitimate business interests, including fraud prevention, platform security, abuse detection, and product improvement — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Data Sharing & Disclosure

Shell99 does not sell your personal data to third parties. We share personal data only in the following limited circumstances:

5.1 Service Providers

Shell99 engages third-party service providers to assist with platform operations, including payment processing, identity verification, fraud detection, cloud infrastructure, and customer support software. These providers are permitted to process your data only on shell99's documented instructions and are bound by confidentiality and data protection obligations equivalent to those imposed on shell99.

5.2 Game Studio Partners

When you play a game provided by a third-party studio (such as Pragmatic Play, PG Soft, Evolution Gaming, or SA Gaming), certain session data — including your account identifier, bet amounts, and game results — is shared with the studio for game operation and RNG certification purposes. Shell99's agreements with all game studio partners include data protection provisions.

5.3 Regulatory & Law Enforcement Authorities

Shell99 may disclose personal data to gaming regulatory authorities, financial intelligence units, law enforcement agencies, or courts where required by applicable law, or where such disclosure is necessary to prevent, detect, or prosecute fraud, money laundering, or other criminal activity.

5.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of shell99's assets, your personal data may be transferred as part of that transaction. Shell99 will provide notice of any such transfer that materially affects the processing of your personal data.

6. Cookies & Tracking Technologies

Shell99 uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly necessary cookies: Essential for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without affecting Platform functionality.
• Performance cookies: Used to collect anonymised data about how users interact with the Platform, enabling us to identify and fix performance issues and improve usability.
• Functional cookies: Used to remember your preferences, such as language settings, last-visited game categories, and responsible gaming limit configurations.
• Marketing cookies: Only set with your prior consent. Used to deliver relevant promotional content and measure the effectiveness of marketing communications.

You may manage non-essential cookies through your browser settings. Disabling performance or functional cookies may limit certain features of the shell99 Platform but will not prevent you from accessing core services.

7. Data Retention

Shell99 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods imposed by applicable law and regulatory requirements:

• Account data and transaction records: minimum five (5) years from account closure, as required by applicable anti-money laundering regulations.
• Identity verification documents: minimum five (5) years from the date of verification.
• Customer support communications: minimum two (2) years from the date of the communication.
• Betting and gaming history: minimum three (3) years for regulatory compliance and dispute resolution purposes.

Upon expiry of the applicable retention period, shell99 will securely delete or anonymise your personal data. Where data is anonymised rather than deleted, the resulting anonymised dataset can no longer be used to identify you and is therefore no longer subject to this Privacy Policy.

8. Security Measures

Shell99 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between your device and the shell99 Platform.
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment method details.
• Salted bcrypt hashing for all account passwords — shell99 staff cannot read your password.
• Access controls limiting internal access to personal data to authorised personnel on a need-to-know basis.
• Regular security assessments and penetration testing conducted by independent third parties.
• Rate limiting, anomaly detection, and automated alerting on suspicious account access patterns.

9. Your Privacy Rights

Subject to applicable law, you may have the following rights in relation to your personal data held by shell99:

• Right of access: request a copy of the personal data shell99 holds about you.
• Right of rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your personal data, subject to our legal retention obligations.
• Right to restrict processing: request that we limit the way we use your data in certain circumstances.
• Right to data portability: request a machine-readable copy of your personal data for transfer to another provider where technically feasible.
• Right to withdraw consent: withdraw any consent you have previously given to the processing of your data for marketing purposes.
• Right to object: object to processing based on legitimate interests, including profiling for marketing purposes.

To exercise any of the above rights, please contact shell99 via live chat or by email at [email protected] with "Privacy Request" in the subject line. We will respond within five (5) business days. We may require verification of your identity before processing a rights request.

10. Children's Privacy

The shell99 Platform is strictly restricted to individuals aged 21 years and above. Shell99 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an individual who does not meet our minimum age requirement, we will immediately close the account, return any remaining balance to the original funding source, and securely delete all associated personal data.

If you have reason to believe that a minor has created a shell99 account, please contact us immediately at [email protected] so that we can take appropriate action.

11. International Data Transfers

Shell99's primary server infrastructure is hosted in data centres in Asia. Where personal data is transferred outside of Malaysia — for example, to game studio partners or cloud infrastructure providers operating in other jurisdictions — shell99 ensures that such transfers are made subject to appropriate safeguards, including contractual data protection clauses that provide protections equivalent to those applied within Malaysia.

Shell99 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate technical and contractual safeguards.

12. Updates to This Privacy Policy

Shell99 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where changes are material, we will notify registered users via the email address on record or through an in-platform notification. The "last updated" date at the top of this page reflects the date of the most recent revision.

We encourage you to review this Privacy Policy periodically. Your continued use of the shell99 Platform following notification of any update constitutes your acknowledgement of the revised policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or shell99's handling of your personal data, please contact us through the following channels:

• 24/7 Live Chat: Available directly on shell99.win — average response under 2 minutes.
• Email: [email protected] — please include "Privacy Request" in the subject line for prioritised routing.

Shell99 takes all privacy queries seriously and commits to responding to written requests within five (5) business days.