Puma77 Privacy Policy – Personal Data Protection for Malaysian Users

Puma77 collects your personal data through several different methods depending on how you interact with our platform. The following are the main categories of data we collect:

Data You Provide Directly:

• Full name as shown on your Malaysian identity card (MyKad);
• Identity card number (IC number) or passport number for identity verification purposes;
• An active Malaysian phone number for OTP verification and communications;
• Email address for account communications and notifications;
• Date of birth for the purpose of verifying the minimum age requirement of 18 years;
• Residential address in Malaysia;
• Bank account or e-wallet details (account number, bank name, or Touch 'n Go, GrabPay, Boost, or ShopeePay wallet number) used for deposits and withdrawals;
• Copies of identity verification documents (national ID, bank statement, utility bill) requested during the KYC (Know Your Customer) process.

Automatically Collected Data:

• The IP address of the device you use to access the puma77 platform;
• Device type and operating system (Android, iOS, Windows);
• The type and version of web browser used;
• Cookie data and session identifiers;
• General location information (state within Malaysia) based on IP address;
• In-platform activity history – games played, bets placed, session times, and general usage patterns.

Puma77 uses your personal data only for legitimate purposes directly related to the provision of our platform services. We do not use your data for purposes unrelated to platform operations without first obtaining your consent. The following are the primary purposes for which data is used:

• Account Management: Creating, verifying, managing, and securing your Puma77 account from registration through every login session;
• Transaction Processing: Process deposits via Touch 'n Go, GrabPay, DuitNow, FPX, Boost, ShopeePay, and other local payment methods, as well as process your winning withdrawals;
• Identity Verification (KYC): Meet legal requirements relating to customer identity verification and anti-money laundering;
• Fraud Prevention: Identifying and preventing fraudulent activity, system manipulation, duplicate account registrations, and platform abuse;
• Customer Support: Assisting you when you encounter issues with your account, transactions, or any aspect of using the platform by referring to your account history;
• Platform Improvements: Analyzing aggregated usage patterns (not individual behavior) to understand how users interact with the platform and where development resources should be directed;
• Service-Related Communications: Sending important notifications related to your account, such as deposit confirmations, security notices, and terms updates;
• Promotions (with Consent): If you have opted in to receive marketing communications, we may send you information about Puma77 promotions, new bonuses, and special offers that may be relevant to your interests.

Puma77 does not sell, rent, or commercialise your personal data to any third party. This is a fundamental, unchanged principle in our privacy policy. That said, there are limited situations where we need to share your data with certain parties for legitimate platform operations:

• Payment Processors: Required transaction information is shared with payment service providers such as FPX and e-wallet gateways (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) solely for the purpose of processing the deposit and withdrawal transactions you request. These providers are governed by their own privacy policies and Malaysian banking compliance requirements;
• Authorities: Where required by Malaysian law, a court order, or a directive from a qualified regulatory body, Puma77 may be obliged to disclose certain information to the authorities. We will notify you of any such disclosure unless prohibited from doing so by law;
• Technical Service Providers: Companies that assist us in operating the platform's technical infrastructure – such as cloud service providers and security monitoring systems – may have limited access to certain data within the scope of their work. All such providers are bound by strict confidentiality agreements with Puma77;
• Business Transfers: In the hypothetical event of a merger, acquisition, or sale of company assets, user data may be transferred as part of that transaction. Users will be notified in advance in such circumstances.

Your personal data is stored on servers protected to high security standards. Puma77 retains your data for as long as your account remains active and for the required period thereafter, in accordance with applicable legal requirements.

Specifically:

• Core account data (name, IC number, phone number, email) is retained for the duration of the active account plus seven years following account closure, in accordance with Malaysia's financial recordkeeping and legal compliance requirements;
• Financial transaction records (deposits, withdrawals, betting history) are retained for seven years in accordance with tax legislation and anti-money laundering requirements;
• Customer support communication logs are retained for three years for reference and dispute resolution purposes;
• Cookie and session data is retained for the duration specified in our Cookie Policy (section 6);
• Once the specified retention period has lapsed, data will be securely deleted or anonymised so that it can no longer be linked back to any individual.

If you submit an account deletion request, Puma77 will process it within a reasonable timeframe. However, certain data may need to be retained for the periods specified above for legal compliance reasons, even after a deletion request has been received.

Protecting your personal data is not merely a legal obligation for Puma77 – it is a business priority we invest in seriously. The following are the technical and operational measures we have implemented:

• 256-bit SSL Encryption: All communications between your device and Puma77's servers are encrypted using TLS 1.3 with a 256-bit key length — the highest industry standard currently available;
• Database Encryption: Sensitive data stored in our databases – including payment information and identity documents – is encrypted at rest using AES-256 standards;
• Password Hashing: Passwords are stored using a one-way hashing function (bcrypt) with a random salt – meaning the original password is never stored and cannot be recovered by anyone;
• Two-Factor Authentication (2FA): We offer and encourage the use of 2FA for all accounts, adding an extra layer of protection that requires verification through your phone in addition to your password;
• Real-Time Monitoring: An automated threat detection system operates 24/7 to identify unauthorised login attempts, brute force attacks, and suspicious account activity;
• Internal Access Controls: Only Puma77 staff who require access to user data to carry out their specific authorised duties are permitted to do so — a strict least-privilege principle is enforced;
• Regular Security Audits: Puma77 conducts regular penetration testing and security audits to identify and address any vulnerabilities before they can be exploited.

Puma77 uses cookies – small text files stored on your device – to enhance your experience on our platform. Cookies allow us to remember your preferences, maintain your login session, and keep the platform running smoothly. We use three main types of cookies:

• Required Cookies (Mandatory): These cookies are essential for the platform to function properly. They include your login session token, CSRF security cookie, and language preference cookie. Without them, the platform cannot operate – you will not be able to log in or make transactions. These cookies cannot be disabled;
• Functional Cookies (Optional): These cookies remember your preferences, such as your preferred bet size, table display, and notification settings, to make your experience more comfortable. You can disable these cookies, but some features may not function fully;
• Analytics Cookies (Optional): These cookies help us understand how users interact with the platform in aggregate – which pages receive the most visits, where users encounter difficulties, and so on. This data is used to improve the platform and contains no information that can identify you individually.

You can manage your cookie settings through your web browser's preferences. Most browsers allow you to view, delete, and block cookies from specific websites. Please refer to your browser's documentation for further guidance. Note that blocking required cookies will affect the login functionality and overall platform experience.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have rights that you may exercise in relation to the personal data held by Puma77. Puma77 fully respects these rights:

To exercise any of the above rights, please contact the puma77 support team via 24/7 live chat or email at support@puma77.run. Include your account number and a description of your request. We will verify your identity before processing any data-related requests to ensure the security of your information.

Puma77 is an online gambling platform exclusively for users aged 18 years of age and above. We do not knowingly collect, store, or process any personal data from individuals under the age of 18.

During the registration process, we collect the date of birth and identity card number to verify that the applicant meets the minimum age requirement. If we determine that a registered user is under 18 years of age:

• The account will be closed immediately;
• All transactions associated with the account will be cancelled;
• Any funds remaining in the account will be returned in accordance with the established procedures;
• Any data collected in relation to that minor will be deleted as soon as possible in accordance with applicable legal requirements.

Puma77 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, evolving legal requirements, or technological developments that affect how we handle user data.

When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page;
• Sending notifications to all active users via their registered email address and/or in-platform notifications;
• Providing at least 14 days before the changes take effect, to give users adequate time to review them.

Your continued use of the Puma77 platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to close your account and request data deletion in accordance with the procedure set out in Section 7.

We encourage you to review this page periodically to stay informed about how we handle your personal data. Previous versions of the Privacy Policy are available upon request through our support team.

If you have any questions, concerns, or wish to exercise any of the rights outlined in this Privacy Policy, here is how to reach Puma77's data privacy team:

• Live Chat: Use the live chat function within the Puma77 platform, available 24 hours a day, 7 days a week. This is the fastest way to get a response – typically within under 3 minutes;
• Email: Email us at support@puma77.run with the subject line "Privacy Policy Enquiry" along with your account number for a response within 24 business hours;
• Formal Request: For formal requests relating to data rights (access, correction, deletion), please email us with the subject line "Data Rights Request – [Your Account Number]". Formal requests will be processed within the timeframe prescribed by the Malaysian PDPA.

Effective date of this Privacy Policy: January 2026.