Privacy Policy

This Privacy Policy ("Policy") is published by coy99 ("coy99", "we", "us", "our"), the operator of the online gaming platform accessible at coy99.lat. This Policy applies to all individuals who visit the coy99 website, register an account, use any of our gaming or payment services, or interact with our customer support team ("you", "User", "Player").

coy99 acts as the data controller in respect of personal data collected through the Platform. We are committed to processing personal data lawfully, fairly, and transparently, and to implementing appropriate technical and organisational measures to protect that data against unauthorised access, loss, or misuse.

By accessing and using the coy99 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and may request deletion of your account and associated data.

For the purposes of this Privacy Policy, the following definitions apply:

coy99 collects Personal Data across several categories depending on the nature of your interaction with the Platform:

3.1 Account Registration Data

• Full legal name as it appears on your identification document;
• Date of birth (used to verify the 21+ age requirement);
• Email address and mobile phone number;
• Chosen username and encrypted password;
• Country and city of residence (e.g., Kuala Lumpur, Johor Bahru, Penang).

3.2 Identity Verification (KYC) Data

• Scanned or photographed copy of a valid Malaysian identity document (MyKad, Passport, or Driver's Licence);
• Proof of residential address — such as a utility bill, bank statement, or government letter issued within the past three months;
• Selfie image holding the identity document adjacent to your face;
• Bank account details or payment method information for withdrawal verification purposes.

3.3 Financial Transaction Data

• Deposit and withdrawal amounts and timestamps;
• Payment method identifiers (e.g., partial Touch 'n Go eWallet account reference, Maybank account ending digits, CIMB reference, FPX transaction ID);
• Account balance history and bonus credit/debit records.

3.4 Gaming Activity Data

• Game session history, bet amounts, game outcomes, and wager records;
• Responsible gambling tool settings and usage (deposit limits, session alerts, self-exclusion status);
• Bonus claim history and wagering progress records.

3.5 Technical and Device Data

• IP address and geolocation data (country and city-level, used for access control and fraud prevention);
• Device type, operating system, and browser version;
• Session duration, pages visited, and navigation patterns within the Platform;
• Cookie identifiers and similar tracking technologies.

3.6 Communications Data

• Content of live chat conversations with our support team;
• Email correspondence sent to or received from [email protected];
• Records of any complaints, disputes, or formal requests submitted to coy99.

We collect Personal Data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion;
• Automatically through the Platform: Via cookies, server logs, and analytics tools that record your device and session data as you navigate the Platform;
• From payment service providers: When you initiate a transaction using services such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong Bank, relevant transaction identifiers are passed to us by the payment gateway;
• From identity verification partners: Where we engage licensed KYC compliance partners to assist with document verification, those partners may return verification status data and risk signals to coy99;
• From fraud and security tools: Automated systems that assess login patterns, device fingerprints, and betting behaviour for fraud detection and AML compliance purposes.

coy99 processes your Personal Data for the following purposes:

coy99 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms and Conditions — including account management, payment processing, and game provision — is necessary for the performance of our contract with you;
• Legal Obligation: KYC verification, AML monitoring, and certain record-keeping activities are required by applicable gaming, financial crime, and data protection regulations;
• Legitimate Interests: Fraud detection, platform security, and aggregated analytics activities are conducted based on our legitimate interest in operating a safe and effective gaming platform, where those interests are not overridden by your privacy rights;
• Consent: Marketing communications and non-essential cookies are processed only where you have provided clear, affirmative consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

coy99 does not sell, rent, or otherwise commercially transfer your Personal Data to third parties. We may share your data with carefully selected third parties only where necessary and under strict contractual safeguards:

7.1 Payment Service Providers

Transaction data is shared with our licensed payment processing partners — including the providers behind Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the relevant Malaysian banking institutions (Maybank, CIMB, Public Bank, Hong Leong) — solely to process your deposit and withdrawal requests. These providers handle your financial data under their own regulatory obligations and data protection commitments.

7.2 Identity Verification Partners

KYC documentation may be shared with our licensed identity verification partners for the purpose of confirming your identity and age. These partners are bound by data processing agreements and are prohibited from using your documents for any purpose beyond verification.

7.3 Technology Service Providers

We engage technology providers for cloud hosting, email delivery, analytics, and customer support tooling. These providers act as Data Processors under our instruction and are contractually prohibited from accessing your data for their own purposes.

7.4 Legal and Regulatory Authorities

We may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where we are legally required to do so — for example, in response to a formal legal request, subpoena, court order, or to report suspicious financial activity under AML obligations.

The coy99 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. The following categories of cookies are in use:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impacting Platform functionality.
• Functional Cookies: Store your language preferences, display settings, and last-visited page to provide a consistent experience across sessions.
• Analytics Cookies: Collect anonymised data about how users navigate the Platform — including page views, session duration, and feature usage — to help us improve the coy99 product. Data collected is aggregated and not linked to your personal identity.
• Responsible Gambling Cookies: Track session duration locally to enable real-time session time reminders where you have activated this feature.

You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to access core Platform features, though some personalisation functionality may be limited.

coy99 retains your Personal Data for as long as necessary to fulfil the purposes described in this Policy, subject to applicable legal retention requirements:

• Active Account Data: Retained for the duration of your account and for a period of five (5) years following permanent account closure, in compliance with AML and gaming regulatory record-keeping obligations;
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, as required by applicable financial crime regulations;
• Transaction Records: Deposit, withdrawal, and betting records are retained for seven (7) years in line with standard financial record-keeping obligations;
• Support Communications: Live chat and email records are retained for two (2) years from the date of the interaction for quality assurance and dispute resolution purposes;
• Marketing Opt-In Records: Retained for the duration of your consent and for one (1) year after withdrawal of consent, as evidence of your original consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

coy99 implements a layered approach to data security, incorporating both technical and organisational measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure:

• Transport Encryption: All data transmitted between your device and coy99 servers is encrypted using TLS 1.2 or higher (256-bit SSL). Our site serves exclusively over HTTPS.
• Data at Rest Encryption: Sensitive data fields — including identity document images and financial data — are encrypted at rest within our secure cloud infrastructure.
• Access Controls: Strict role-based access controls ensure that only authorised coy99 personnel with a legitimate operational requirement can access Personal Data. All access is logged and audited.
• Password Security: Account passwords are stored using industry-standard one-way cryptographic hashing. coy99 staff cannot view or retrieve your password in plain text.
• Fraud Detection Systems: Automated systems continuously monitor for suspicious login activity, unusual transaction patterns, and other indicators of unauthorised account access.
• Security Reviews: We conduct periodic internal security reviews and engage third-party security assessments to identify and remediate potential vulnerabilities in our infrastructure.

Subject to applicable law and any legitimate overriding interests (such as regulatory retention obligations or ongoing fraud investigations), you have the following rights in respect of the Personal Data we hold about you:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how and why it is being processed.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: In certain circumstances, you may request that we limit the processing of your Personal Data — for example, while a complaint is under investigation.
• Right to Data Portability: Where processing is based on your consent or a contract with you, you may request that your Personal Data be provided to you in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing activities. Where you object to marketing, we will cease sending communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of the above rights, please contact our support team via live chat or email at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving your request. Identity verification may be required before we can fulfil certain requests.

The coy99 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a minor has created an account or submitted personal information through the Platform, we will take immediate steps to close the account and delete all associated data.

If you are a parent or guardian and have reason to believe that a minor in your care has accessed or registered on coy99, please contact us immediately at [email protected] so that we may investigate and take appropriate action.

coy99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform functionality. When material changes are made, we will notify registered users via email or an in-platform notification, and publish the updated Policy on this page with a revised effective date.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of the Platform following the publication of any update constitutes your acceptance of the revised Policy. If you disagree with any changes, you should discontinue use and may request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact coy99 through the following channels:

When submitting a data-related request, please include your registered account username and a clear description of your request to help us locate your records and respond efficiently.