Privacy Policy kis91 – Your Data Protection

This Privacy Policy is published by the management of the kis91 platform ("we", "kis91"). This document outlines our commitment to protecting the privacy of all platform users in Malaysia and covers all data processing activities we carry out.

This Policy applies to:

• All registered members and prospective members browsing the kis91 platform
• Individuals who interact with us via customer support, email, or live chat
• Website visitors using certain features such as contact forms or newsletter sign-ups
• Kis91 mobile app users across all platforms

If you are under 18 years of age, you are not permitted to use the kis91 platform and we will not knowingly collect your personal data. If we become aware that personal data of an underage individual has been inadvertently collected, we will take immediate steps to delete it.

Kis91 only collects personal data that is strictly necessary to provide our services safely and efficiently. The following is a comprehensive overview of the data categories we collect:

Your personal data is collected through various channels as you interact with the kis91 platform. We ensure that all data collection is transparent and legally compliant at all times:

• Account registration: When you complete the kis91 registration form, you voluntarily provide basic information such as your name, email, phone number, and date of birth.
• KYC Process: To meet legal compliance requirements, we request copies of identification documents such as your MyKad and bank statements to verify your identity.
• Financial transactions: Every time you make a deposit or withdrawal, transaction details are automatically recorded for financial record-keeping and fraud prevention purposes.
• Platform usage: Gaming activity, preferences, and usage patterns are automatically collected via cookie technology and server logs.
• Direct communication: When you contact our customer support team, conversation content is retained to ensure service continuity and for training purposes.
• Authorised third parties: In certain cases, we may receive information about you from identity verification service providers we use for the KYC process.

Kis91 only uses your personal data for purposes that are lawful, relevant, and not excessive relative to actual needs. The following are the primary purposes for which your data is used:

• Account management: Creating, maintaining, and managing your member account, including secure login and password recovery.
• Transaction processing: Processing deposits, withdrawals, bonuses, and all financial activities related to your account accurately and promptly.
• Identity verification (KYC): Verifying your identity to comply with anti-money laundering (AML) and counter-financing of illegal activities legal requirements.
• Platform security: Detecting and preventing fraud, unauthorised access, account abuse, and other illegal activities that could harm our members.
• Service improvement: Analysing platform usage patterns in aggregate (not individually) to improve the user experience and develop new features.
• Service communication: Sending important account-related notifications, security updates, transaction confirmations, and other critical information you need to know.
• Marketing (with consent): Sending promotional offers, exclusive bonuses, and platform updates — only if you have given consent to receive marketing communications.
• Legal compliance: Fulfilling our obligations under applicable Malaysian law, including court orders or requests from legitimate authorities.

Kis91 does not sell your personal data to any party for commercial purposes. However, in the course of operating our platform, there are limited situations where your data may be shared with trusted third parties:

• Payment service providers: Providers such as DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay receive the transaction information required to process your payments securely.
• KYC service providers: Third-party identity verification companies that assist us in authenticating your identification documents to meet compliance requirements.
• Gaming technology providers: Game software developers integrated with the kis91 platform may receive minimal, anonymised game session data for technical purposes.
• Analytics services: Web analytics tools we use to understand overall platform usage patterns — this data is collected in aggregate form without identifying individuals.
• Legal authorities: We will disclose your data to lawful authorities such as the police, courts, or the Personal Data Protection Department when required by Malaysian law.

All third parties handling kis91 user data are required to comply with strict data protection agreements and to manage your information in accordance with security standards equal to or higher than our own.

The security of your personal data is kis91's top priority. We continuously invest in the latest cybersecurity infrastructure to ensure your data is always protected:

• Data-in-transit encryption: All communications between your device and kis91's servers are protected by TLS 1.3 with 256-bit encryption — the same standard used by Malaysia's leading banking institutions.
• Stored data encryption: Sensitive data in our databases is encrypted using the AES-256 algorithm, ensuring it remains unreadable even in the event of an extraordinary security incident.
• Strict access control: Only staff with a legitimate business need are permitted to access user data, and every access is recorded in detail within audit logs.
• 24/7 Monitoring: Our cybersecurity team continuously monitors the platform to detect any unusual activity, intrusion attempts, or suspicious access patterns.
• Periodic penetration testing: kis91 conducts regular independent security testing, including penetration testing and vulnerability assessments, to identify and address potential risks before they can be exploited.
• Two-factor authentication: Our 2FA system uses OTP codes via SMS or an authenticator app to provide an effective additional layer of account protection.

Under Malaysia's Personal Data Protection Act 2010 and kis91's internal policies, you have the following rights regarding your personal data that we hold:

Kis91 uses cookies and similar tracking technologies to enhance your experience on our platform. Understanding how we use cookies helps you make more informed decisions about your privacy:

• Essential cookies: Required for core platform functions such as login sessions, security, and language preferences. These cookies cannot be disabled without affecting platform usability.
• Performance cookies: Collecting information on how you use the platform (e.g. most frequently visited pages) to help us improve platform performance and responsiveness.
• Functional cookies: Allows the platform to remember your preferences such as language, location, and display settings for a more personalised experience.
• Analytics cookies: Used alongside analytics tools to understand overall traffic and usage patterns. This data is collected in aggregate and anonymised form.

You can manage cookies through your web browser settings at any time. Please note that disabling certain cookies may affect the functionality of some platform features. Major browsers such as Chrome, Firefox, Safari, and Edge provide detailed controls for managing cookies.

Kis91 retains your personal data only for as long as necessary to fulfil the purposes stated in this Policy or to comply with applicable legal requirements. Specific retention periods are as follows:

• Active account data: Retained for as long as your account remains active and for 7 years after account closure for financial and tax law compliance purposes.
• Transaction Records: Retained for a minimum of 7 years in accordance with the requirements of the Companies Act and Malaysian tax legislation.
• KYC Records: Identity verification documents are retained for 5 years after the business relationship ends, in accordance with the Anti-Money Laundering Act 2001.
• Communication logs: Support chat and email records are retained for 2 years for reference and dispute resolution purposes.
• Analytics data: Anonymised platform usage data is retained for up to 3 years for long-term trend analysis.

Once the retention period expires, data will be securely deleted using methods that ensure it cannot be recovered. You may request early deletion of your data (subject to any overriding legal compliance requirements).

Kis91 reserves the right to update or modify this Privacy Policy at any time as needed. Changes may be made to reflect new technological developments, legislative changes, or feedback from our member community.

When a material change occurs, we will:

• Updating the "Last Updated" date at the top of this page
• Sending email notifications to all registered members
• Displaying a prominent notice on the platform upon your next login
• Providing a plain-language summary of key changes

Amendments take effect 14 days after notice is given. Continued use of the kis91 platform after that date constitutes acceptance of the revised terms. If you disagree with any changes, you have the right to close your account before the amendments take effect.

If you have any questions, concerns, or complaints regarding how kis91 handles your personal data, our data protection team is ready to assist you:

• Live Chat: Available 24 hours a day, 7 days a week — the fastest way to get an immediate response
• Privacy Email: [email protected] — for detailed enquiries or data subject rights requests (response time is typically within 24–48 hours)

For complaints that cannot be resolved internally, you have the right to submit a complaint to the Personal Data Protection Commissioner of Malaysia through the official channels of the Department of Personal Data Protection, Ministry of Communications and Digital.