1. Introduction
This Privacy Policy ("Policy") is published by shell99 ("shell99", "we", "us", "our") and governs the collection, processing, storage and disclosure of personal data in connection with the shell99 platform available at https://shell99.cam and all associated services, tools and features (collectively, the "Platform").
shell99 operates as an English-language online casino entertainment and sports betting information platform primarily serving users in Malaysia, including those located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other parts of the country. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.
We are committed to handling personal data responsibly, limiting collection to what is genuinely necessary, and maintaining appropriate safeguards to protect information entrusted to us. This Policy should be read in conjunction with the shell99 Terms & Conditions.
Age restriction: The shell99 Platform is intended exclusively for users aged 21 years and above. We do not knowingly collect personal data from individuals below this age. If you believe we have inadvertently collected data from a minor, please contact us immediately using the details in Section 15.
2. Definitions
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, email address, device identifiers and transaction records. |
| "Processing" | Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure or deletion. |
| "Data Subject" | The identified or identifiable natural person whose personal data is being processed — in this context, you as a shell99 Platform user. |
| "Controller" | The entity that determines the purposes and means of processing personal data — in this context, shell99. |
| "Processor" | A third party that processes personal data on behalf of shell99 under a contractual arrangement. |
| "Cookies" | Small text files or similar tracking technologies placed on your device when you access the Platform. |
| "KYC" | Know Your Customer — the identity verification process through which we confirm a user's identity, age and payment method ownership. |
| "Consent" | A freely given, specific, informed and unambiguous indication of agreement to the processing of personal data for a stated purpose. |
3. Data We Collect
shell99 collects personal data only to the extent necessary for the purposes described in this Policy. The categories of data we may collect include the following:
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, national identity card number or passport number | Account registration and KYC |
| Contact Data | Email address, phone number, residential address | Registration, KYC and support requests |
| Account Data | Username, password hash, account settings, session logs | Account creation and ongoing use |
| Financial Data | Payment method details (e-wallet identifiers, bank account numbers), transaction history, deposit and withdrawal records in MYR | Deposit and withdrawal processing |
| KYC Documents | Copies of government-issued photo ID, proof-of-address documents, payment ownership evidence | Identity verification requests |
| Technical Data | IP address, browser type, device identifiers, operating system, referring URLs | Automatically upon Platform access |
| Usage Data | Pages viewed, features accessed, time spent, search queries within the Platform | Automatically during sessions |
| Communications Data | Support ticket content, live-chat transcripts, email correspondence content | When you contact shell99 support |
We do not collect sensitive categories of personal data — such as racial or ethnic origin, political opinions, religious beliefs, genetic data or biometric data — unless required by applicable law or explicitly provided by you in a support context.
4. How We Collect Data
shell99 collects personal data through the following means:
- Direct submission: Data you provide when registering an account, completing KYC, submitting support requests, responding to surveys or opting into promotional communications.
- Automated collection: Technical and usage data collected automatically through cookies, server logs and similar technologies when you access and navigate the Platform.
- Payment processing: Financial data collected when you initiate deposits via supported Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow or FPX — or via cryptocurrency channels.
- Third-party providers: In certain circumstances, shell99 may receive data from third-party identity verification, fraud-prevention or payment processing providers engaged to support Platform operations.
- Publicly available sources: Where permitted by applicable law, shell99 may supplement account data with information from publicly available regulatory lists (such as sanctions or self-exclusion registries) for compliance purposes.
5. Data Processing & Purpose
shell99 processes personal data for the following purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining and managing your shell99 Account, including authentication and session management. |
| Identity Verification | Carrying out KYC checks to verify your identity, age and payment method ownership as required by compliance obligations. |
| Payment Processing | Facilitating deposits and withdrawals through Malaysian payment channels including e-wallets, bank transfers and cryptocurrency methods. |
| Service Delivery | Providing access to Platform features, content, games, betting markets and customer support. |
| Security & Fraud Prevention | Monitoring for unauthorised access, account takeover, bonus abuse, money laundering and other fraudulent or prohibited activity. |
| Legal Compliance | Meeting obligations under applicable anti-money laundering, data-protection, licensing and reporting requirements. |
| Responsible Gambling | Monitoring account activity to identify signs of problematic gambling and administering limit-setting, cooling-off and self-exclusion requests. |
| Platform Improvement | Analysing usage data to understand how the Platform is used and to improve content, features and user experience. |
| Communications | Sending transactional messages (deposit confirmations, withdrawal notifications), support responses and, where consent has been given, promotional communications. |
shell99 will not use your personal data for purposes incompatible with those stated above without first notifying you and, where required, obtaining your consent.
6. Legal Basis for Processing
shell99 relies on the following legal bases for processing personal data:
- Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you have agreed to, including account management, payment processing and service delivery.
- Legal obligation: Processing required to comply with applicable laws, regulatory requirements, anti-money laundering obligations and lawful requests from competent authorities.
- Legitimate interests: Processing necessary to pursue shell99's legitimate business interests, including fraud prevention, platform security and improving service quality, where such interests are not overridden by your rights and freedoms.
- Consent: Processing for purposes where you have provided specific, informed and freely withdrawable consent — for example, receiving promotional communications. You may withdraw consent at any time by contacting support.
7. Cookies & Tracking Technologies
shell99 uses cookies and similar tracking technologies on the Platform to support session management, security, performance monitoring and analytics. The following cookie categories may be used:
- Strictly necessary cookies: Required for the Platform to function, including authentication, session management and security features. These cannot be disabled without impairing core functionality.
- Performance cookies: Used to collect anonymised usage statistics that help us understand how users navigate the Platform and identify areas for improvement.
- Functional cookies: Store preferences such as language, display settings and responsible-gambling limit reminders to personalise your experience.
- Analytics cookies: Aggregate data about Platform usage to support content and feature development. Data collected is statistical in nature and does not typically identify individuals directly.
You can control or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the availability or functionality of some Platform features. Where consent is required for non-essential cookies, we will present an appropriate notice on your first visit to the Platform.
Most modern browsers allow you to manage cookie preferences through their settings menus. Refer to your browser's help documentation for guidance on how to restrict or clear cookies stored by shell99.
8. Data Sharing & Disclosure
shell99 does not sell personal data to third parties. We may share your personal data with third parties only in the following circumstances and only to the extent necessary for the stated purpose:
- Payment processors: Malaysian e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), bank infrastructure partners (Maybank, CIMB, Hong Leong, Public Bank), DuitNow, FPX and cryptocurrency payment facilitators, to process deposits and withdrawals.
- Identity verification providers: Third-party KYC and anti-money laundering service providers engaged to verify identity documents and conduct compliance screening.
- Fraud prevention networks: Shared negative-database or fraud-ring intelligence services used to detect and prevent account abuse, bonus fraud and financial crime.
- Technology providers: Cloud hosting, content delivery and platform infrastructure providers who process data as our processors under appropriate contractual data-protection obligations.
- Legal and regulatory authorities: Where disclosure is required by law, court order, regulatory authority direction or law enforcement request — including reporting obligations under applicable anti-money laundering frameworks.
- Business transfers: In the event of a merger, acquisition or sale of substantially all of shell99's assets, personal data may be transferred as part of that transaction, subject to equivalent data-protection commitments.
Where we share data with processors, we require them to implement appropriate technical and organisational measures to protect personal data and to process it only on our documented instructions.
9. Data Retention
shell99 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory obligations. Our general retention approach is as follows:
- Active account data: Retained throughout the period your Account remains open and for a minimum period thereafter as required by applicable AML and legal-hold obligations.
- KYC and identity documents: Retained for a minimum of five years following the closure of your Account or the completion of the verified transaction, in line with common anti-money laundering record-keeping standards.
- Transaction records: Retained for the period required by applicable financial record-keeping obligations, which is commonly five to seven years.
- Support communications: Retained for a period of up to three years following resolution, to support dispute resolution and regulatory review.
- Technical and usage data: Anonymised or deleted within a shorter timeframe once the purpose of collection is fulfilled, typically within twenty-four months of last Platform activity.
Following the expiry of applicable retention periods, personal data will be securely deleted or anonymised in accordance with our internal data-disposal procedures. Anonymised data that can no longer reasonably identify an individual is not subject to this Policy and may be retained for statistical purposes.
10. Security Measures
shell99 implements technical and organisational security measures appropriate to the nature and volume of the personal data we process. These measures include:
- Encryption in transit: Platform communications are protected by Transport Layer Security (TLS/SSL) encryption to safeguard data transmitted between your browser and our servers.
- Access controls: Access to personal data is restricted to authorised personnel with a documented business need. Role-based access controls and authentication requirements are applied to internal systems.
- Password storage: Account passwords are stored in hashed form using appropriate one-way hashing algorithms. We do not store cleartext passwords.
- Fraud monitoring: Automated and manual monitoring systems are used to detect anomalous account activity, suspicious login patterns and indicators of financial crime.
- Vendor due diligence: Third-party processors are assessed for appropriate security standards before engagement and are contractually bound to maintain equivalent safeguards.
Notwithstanding these measures, no method of data transmission or electronic storage is completely secure. shell99 cannot guarantee absolute security and encourages users to protect their own Account credentials, use strong unique passwords and report any suspected unauthorised access without delay.
Your responsibility: Never share your shell99 Account password with any third party. shell99 support staff will never ask for your full password. If you receive a suspicious message requesting your credentials, do not respond and contact support immediately.
11. Your Rights
Depending on the legal framework applicable to your location and the processing activity in question, you may have some or all of the following rights in relation to your personal data held by shell99:
Request confirmation of whether shell99 holds personal data about you and obtain a copy of that data along with relevant processing details.
Request correction of inaccurate or incomplete personal data held about you without undue delay.
Request deletion of personal data where it is no longer necessary, consent is withdrawn or processing is unlawful — subject to overriding retention obligations.
Request that processing of your data be temporarily suspended while a dispute as to its accuracy or lawfulness is resolved.
Receive a copy of your personal data in a structured, machine-readable format where technically feasible and applicable.
Object to processing based on legitimate interests, including direct marketing. Where objection is to marketing, we will cease that processing promptly.
To exercise any of the above rights, please submit a written request to shell99 via the contact details provided in Section 15. We will acknowledge your request within a reasonable period and aim to respond substantively within 30 days. Where a request is complex or extensive, this period may be extended by up to a further 60 days with notification provided.
Note that certain rights are subject to exemptions — for example, erasure requests cannot be fulfilled where data retention is required by law or is necessary to establish or defend a legal claim.
12. Minors & Age Restriction
The shell99 Platform is strictly intended for users aged 21 years and above. shell99 does not knowingly collect, process or retain personal data from individuals below the age of 21. Age verification is conducted as part of the KYC process prior to the activation of transactional features.
Where shell99 becomes aware or has reasonable grounds to believe that personal data has been collected from an individual below the minimum age, we will take prompt steps to delete that data and to close the associated Account without compensation of any balance held.
If you believe a minor has registered on the Platform or submitted personal data to shell99, please contact us immediately at the email address provided in Section 15. We take the protection of minors from gambling-related harm very seriously.
13. Cross-Border Data Transfers
shell99 is an internationally operated platform. Personal data collected from Malaysian users may be transferred to, stored in or processed in jurisdictions outside Malaysia, including the jurisdiction in which shell99's operating entity and primary infrastructure are located.
Where personal data is transferred internationally, shell99 takes steps to ensure that appropriate safeguards are in place, which may include:
- Contractual data-protection clauses binding processors in recipient countries;
- Transfers to jurisdictions that maintain data-protection standards broadly equivalent to those applicable in the originating location;
- Technical and organisational measures designed to protect data to an equivalent standard regardless of processing location.
By using the shell99 Platform and providing your personal data, you acknowledge that your data may be transferred internationally as described in this section. If you have specific concerns about the destination of your personal data, please contact us using the details in Section 15.
14. Policy Amendments
shell99 reserves the right to review, update or amend this Privacy Policy at any time to reflect changes in applicable law, data-processing practices, Platform features or regulatory requirements. The "Last reviewed" date at the top of this page will be updated whenever a material change is made.
It is your responsibility to review this Policy periodically. Where changes are material — for example, where we introduce a new purpose for processing or a new category of data sharing — we will take reasonable steps to bring those changes to your attention through an in-Platform notice or a communication to your registered email address where technically practicable.
Continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you should discontinue use of the Platform and, if applicable, request closure of your Account.
15. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data-subject rights, or wish to raise a data-protection concern, please contact shell99 using the following details:
- Platform: https://shell99.cam
- Email: [email protected]
Please include your registered Account username or email address, a clear description of your request or concern, and any relevant reference information. shell99 will acknowledge all privacy-related correspondence within one business day and aim to provide a substantive response within 30 days of receiving complete information.
For account-related matters, including requests to exercise responsible-gambling controls such as deposit limits or self-exclusion, please visit the Responsible Gambling page, where dedicated guidance and tools are available.