Shell999 Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy") is issued by Shell999 (hereinafter referred to as "Shell999", "we", "us", or "our") and applies to all personal data processed in connection with the Shell999 online sports betting and live casino platform accessible at shell999.cam, including all associated mobile interfaces and services operated under the Shell999 brand.

Shell999 is committed to protecting the privacy and personal data of all users, including players based in Malaysia and internationally. We process personal data in accordance with applicable data protection legislation and international best practices for data security and privacy.

This Policy explains, in clear and accessible terms, what personal data we collect, why we collect it, how we use it, how long we retain it, with whom we share it, and what rights you hold as a data subject. By creating an account on Shell999 or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of this Privacy Policy, the following terms shall carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Data Subject" refers to the natural person whose personal data is being processed — in this context, you, the Player or registered User of Shell999.
• "Data Controller" means Shell999, as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of Shell999 in accordance with Shell999's instructions and under contractual obligations of confidentiality.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, transmission, restriction, erasure, or destruction.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their personal data for a specified purpose.
• "KYC Data" refers to identity verification documentation provided by a Player pursuant to Shell999's Know Your Customer (KYC) obligations, including government-issued identification and proof of address.
• "Payment Data" means financial information related to deposits and withdrawals processed via Malaysian payment methods, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank.

Shell999 collects the following categories of personal data from players and platform users:

Shell999 does not collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless specifically required for regulatory compliance purposes and with appropriate safeguards in place.

Shell999 collects personal data through the following means:

• Direct collection: Data you provide voluntarily during account registration, KYC verification, payment processing, responsible gambling tool configuration, or when contacting our support team.
• Automated technical collection: Data collected automatically as you use the Shell999 platform, including IP addresses, device identifiers, browser information, session duration, pages visited, and in-platform activity logs. This data is collected via cookies, server logs, and similar tracking technologies.
• Third-party payment providers: Transaction confirmation data received from Malaysian payment processors, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks such as Maybank, CIMB, Public Bank, and Hong Leong Bank, to confirm successful deposits and withdrawals.
• Identity verification services: Where Shell999 engages a third-party KYC or identity verification provider to confirm your identity and age, Shell999 may receive verification outcome data from that provider.
• Fraud prevention services: Risk signals and fraud indicators received from industry-standard anti-fraud and anti-money laundering service providers engaged by Shell999.

Shell999 processes your personal data for the following purposes:

1. Account creation and management: To register your account, verify your identity and age eligibility (21+), maintain your account profile, and process account-related requests.
2. Service delivery: To provide access to Shell999's sports betting markets (including EPL, Liga Super Malaysia, UFC, and other events), live casino games, and all associated platform features.
3. Payment processing: To process deposits and withdrawals via your chosen Malaysian payment method, reconcile transactions, and maintain accurate financial records in MYR.
4. KYC and regulatory compliance: To comply with applicable anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and international gaming regulatory standards.
5. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, bonus abuse, money laundering, account takeover attempts, and other prohibited conduct as defined in our Terms & Conditions.
6. Responsible gambling compliance: To administer responsible gambling tools including deposit limits, self-exclusion, cooling-off periods, and session limit settings, and to identify players who may be showing signs of problem gambling.
7. Customer support: To respond to enquiries, resolve disputes, process complaints, and provide technical assistance via live chat and email.
8. Platform improvement and analytics: To analyse usage patterns, improve platform performance, and develop new features that better serve our Malaysian player community.
9. Marketing communications: Where you have consented or where permitted under applicable law, to send you information about Shell999 promotions, bonuses, and new features relevant to your interests. You may opt out of marketing communications at any time.
10. Legal compliance: To comply with applicable laws, regulations, court orders, and requests from competent regulatory or law enforcement authorities.

Shell999 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — including account management, service delivery, and payment processing — is carried out on the basis that it is necessary for the performance of the contract between Shell999 and you as a registered player.
• Legal obligation: Processing carried out to comply with Shell999's legal obligations under applicable AML, KYC, gaming regulatory, and data protection legislation.
• Legitimate interests: Processing for fraud prevention, security, platform analytics, and responsible gambling monitoring, where Shell999's legitimate interests in maintaining a secure and compliant platform are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and optional personalisation features, where your explicit consent has been obtained. You have the right to withdraw this consent at any time without affecting the lawfulness of prior processing.

Shell999 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the following limited circumstances, and only to the extent necessary for the specified purpose:

• Payment service providers: We share transaction data with Malaysian payment processors — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank — to facilitate deposit and withdrawal processing. These providers are bound by their own privacy obligations and contractual data processing agreements with Shell999.
• Identity verification and KYC providers: Where we engage a third-party provider to conduct identity verification, we share the minimum necessary data (typically name, date of birth, and identification document reference) to complete the verification process.
• Fraud prevention and AML services: We may share data with industry-standard fraud detection and anti-money laundering screening services to protect the platform and comply with regulatory obligations.
• Technology and infrastructure providers: We engage third-party cloud hosting, platform infrastructure, and software service providers who process data on our behalf under strict contractual data processing agreements, with no right to use your data for their own purposes.
• Regulatory and law enforcement authorities: We will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the safety and security of the platform and its users.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of Shell999's business, your personal data may be transferred as part of that transaction, subject to the same privacy protections described in this Policy.

Shell999 uses cookies and similar tracking technologies to operate the platform effectively, maintain your session state, understand how players use the platform, and (where you have consented) to deliver relevant promotional content.

The following categories of cookies are used on shell999.cam:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional cookies: Used to remember your preferences, such as language settings, bet slip state, and selected payment method, to improve your experience across sessions.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate and use the Shell999 platform. This data is used internally to identify areas for improvement and does not identify you personally.
• Marketing cookies: Used, where you have provided consent, to track promotional campaign performance and deliver relevant Shell999 promotions. These cookies do not share your data with unrelated third parties.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the Shell999 platform and your ability to place wagers or access your account.

Shell999 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status and for a minimum of five (5) years following account closure, to comply with AML and gaming regulatory record-keeping obligations.
• KYC and identity verification data: Retained for a minimum of five (5) years from the date of account closure or from the date the verification was conducted, in accordance with AML compliance requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial record-keeping regulations.
• Customer support communications: Retained for a period of three (3) years from the date of the interaction, unless a longer retention period is required by an ongoing dispute or regulatory investigation.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following consent withdrawal, to demonstrate compliance with marketing consent obligations.
• Technical and log data: Retained for a maximum of twelve (12) months unless specific fraud or security investigations require longer retention.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Shell999's data deletion procedures. Anonymised or aggregated data that cannot be used to identify you personally may be retained for longer periods for analytical purposes.

Shell999 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and shell999.cam;
• Encryption of sensitive data at rest, including financial records and identity verification documents;
• Access controls limiting internal access to personal data to authorised personnel with a demonstrated need to access that data in the performance of their duties;
• Regular security assessments and penetration testing of the Shell999 platform infrastructure;
• Multi-factor authentication requirements for administrative access to systems containing personal data;
• Contractual data security obligations imposed on all third-party processors who handle personal data on Shell999's behalf.

While Shell999 takes all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying Shell999 of any suspected unauthorised access to your account.

Subject to applicable data protection legislation and Shell999's legal obligations (including AML and KYC retention requirements), you hold the following rights in respect of your personal data:

• Right of Access: You have the right to request a copy of the personal data Shell999 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data Shell999 holds about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to Shell999's legal retention obligations.
• Right to Restriction of Processing: You have the right to request that Shell999 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of Shell999's legitimate interests, including direct marketing. Shell999 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Shell999 operates as an internationally licensed gaming platform, and certain personal data processing activities may involve the transfer of data to servers or service providers located outside of Malaysia. Where such international transfers occur, Shell999 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to or exceeding the protections required under applicable Malaysian and international data protection law.

Safeguards applied to international data transfers include contractual obligations (standard contractual clauses or equivalent data transfer agreements) imposed on all third-party recipients of personal data outside of Malaysia, requiring those recipients to maintain equivalent privacy and security standards.

Shell999 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, seeking your consent.

Shell999 is strictly an adult gaming platform. Our services are exclusively available to persons aged 21 years and above. Shell999 does not knowingly collect, process, or store personal data from persons under the age of 21.

If Shell999 becomes aware, through KYC verification, account review, or any other means, that personal data has been submitted by or on behalf of a person under the age of 21, Shell999 will immediately close the relevant account, delete or anonymise the collected personal data to the extent permitted by our legal obligations, and return any deposited funds to the original payment source.

Shell999 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we provide. The most current version of this Policy will always be published on this page at shell999.cam/privacy-policy with an updated effective date.

Where a material change to this Policy is made that significantly affects how we process your personal data, Shell999 will use reasonable efforts to notify active account holders via the registered email address associated with their Shell999 account, or by displaying a prominent notice on the platform, prior to the change taking effect.

Your continued use of the Shell999 platform after any amendment to this Privacy Policy constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically to stay informed about how Shell999 protects your data.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact Shell999 using the following details:

For data subject requests, please include your full name, the email address associated with your Shell999 account, and a clear description of the right you wish to exercise or the specific enquiry you have. Shell999 may require verification of your identity before processing your request.