Privacy Policy

This Privacy Policy ("Policy") is issued by panda95.cam ("panda95", "we", "us", "our") and describes how we collect, process, store, share, and protect personal data provided by or generated by users ("you", "Player") of the panda95 platform, accessible at panda95.cam.

panda95 is committed to handling personal data responsibly and in accordance with applicable data protection laws. By registering an account or using any service on the panda95 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. Where this Policy conflicts with those documents in respect of data matters, this Policy shall prevail.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means panda95.cam, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third-party entity that processes personal data on behalf of panda95 under a contractual arrangement and our instruction.
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification procedures required before withdrawal processing or as otherwise mandated by our compliance obligations.
• "Cookies" means small text files placed on your device by the panda95 platform to store session information, preferences, and analytical data.
• "Platform" means the panda95 website and all associated services accessible at panda95.cam.

panda95 collects the following categories of personal data, depending on the services you use and the stage of your relationship with us:

panda95 collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing identity verification, making deposits or withdrawal requests, contacting customer support, or responding to surveys or promotions;
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and analytics tools as you navigate the Platform;
• Third-party sources: Data received from payment processors (DuitNow, FPX, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, and others) during transaction processing; identity verification services used to fulfil KYC requirements; and fraud prevention providers;
• Public sources: In limited circumstances, publicly available records may be consulted as part of our anti-money laundering (AML) or sanctions screening procedures.

panda95 processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions — including account management, payment processing, game delivery, KYC verification, and withdrawal processing;
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) regulations, gaming licence conditions, and tax reporting obligations;
• Legitimate interests: Processing carried out for our legitimate business interests, where those interests are not overridden by your rights — including fraud detection, platform security, responsible gambling monitoring, and business analytics;
• Consent: Processing based on your explicit consent, such as sending promotional communications or marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.

panda95 uses your data to deliver and improve our gaming services, process financial transactions in MYR and crypto assets, personalise your experience, enforce our Terms & Conditions, detect and prevent fraudulent or prohibited activity, and comply with our legal and regulatory obligations.

panda95 does not sell, rent, or trade your personal data. We may share personal data with third parties in the following limited circumstances:

• Payment service providers: Data necessary to process deposits and withdrawals is shared with authorised payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, Visa, Mastercard, and crypto payment networks. These providers are contractually prohibited from using your data for any purpose other than payment processing;
• Identity verification services: KYC-related data (identity documents, address verification) is shared with licensed identity verification providers under strict data processing agreements;
• Fraud prevention and AML providers: Technical and identity data may be shared with specialist fraud detection and sanctions screening services to protect the platform and comply with regulatory obligations;
• Gaming licence authority: We are required to disclose certain player data to our licensing authority upon request, in accordance with our licence conditions;
• Legal and regulatory authorities: Where required by law, court order, or lawful request from a competent authority, panda95 will disclose personal data without prior notice to you;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of panda95's business, player data may be transferred as part of that transaction, subject to equivalent data protection obligations.

panda95 retains personal data for as long as necessary to fulfil the purposes described in this Policy, and in any case for no longer than required by applicable law. The following retention periods apply as general guidelines:

• Account data and transaction records: Retained for the duration of your active account relationship, plus a minimum of five (5) years following account closure, to comply with AML and gaming regulatory requirements;
• KYC documentation: Retained for a minimum of five (5) years from the date of the last transaction or account closure, whichever is later;
• Customer support communications: Retained for up to three (3) years from the date of the relevant interaction, for quality assurance and dispute resolution purposes;
• Technical and usage logs: Retained for up to twelve (12) months for security monitoring and platform analytics, unless a longer period is required for an active investigation;
• Marketing preferences and consent records: Retained for the duration of the consent, plus a reasonable period to demonstrate compliance with consent requirements.

When the applicable retention period expires, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

panda95 implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Industry-standard TLS/SSL (256-bit) encryption for all data transmitted between your device and our servers;
• Encrypted storage of sensitive personal and financial data at rest;
• Two-factor authentication (2FA) options available for all player accounts;
• Access controls ensuring that personal data is accessible only to authorised personnel on a strict need-to-know basis;
• Regular security assessments, penetration testing, and vulnerability management;
• Incident response procedures for detecting, reporting, and addressing personal data breaches in a timely manner.

While panda95 takes all reasonable steps to protect your data, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your account credentials. If you suspect that your account has been compromised, please contact our support team immediately at [email protected].

panda95 uses cookies and similar tracking technologies to provide, secure, and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These enable session management, login authentication, and basic navigation. They cannot be disabled without affecting your ability to use the Platform;
• Performance and analytics cookies: Collect anonymous data about how players use the Platform — which pages are visited, how long sessions last, and where errors occur. This information is used to improve Platform performance and user experience;
• Functional cookies: Remember your preferences such as language settings, currency display, and responsible gambling limit configurations, to personalise your experience;
• Session security cookies: Used to detect and prevent fraudulent login attempts, protect against CSRF attacks, and maintain the integrity of authenticated sessions.

panda95 does not use third-party advertising cookies or permit external advertising networks to place cookies on the Platform for the purpose of tracking you across other websites.

Subject to applicable law, you hold the following rights with respect to your personal data held by panda95. Requests to exercise these rights may be submitted to [email protected] and will be handled within a reasonable timeframe:

panda95 operates internationally, and certain personal data may be transferred to, stored in, or processed in jurisdictions outside Malaysia. This may occur when we use cloud infrastructure, engage data processors, or share data with our licensing authority.

Where personal data is transferred internationally, panda95 takes appropriate steps to ensure that such transfers are subject to adequate data protection safeguards — including contractual data processing agreements with data processors, consistent with recognised international data transfer mechanisms.

panda95 will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards as required by applicable law.

The panda95 platform is intended exclusively for persons aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered accounts.

If panda95 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any deposits made to an underage account will be returned.

panda95 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered players via the email address on their account record and/or by publishing a prominent notice on the Platform.

The revised Policy will carry an updated effective date at the top of this page. Your continued use of the Platform following the publication of an amended Policy constitutes acceptance of the changes. If you do not agree with any changes, you should cease using the Platform and may request account closure.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a concern about how panda95 processes your personal data, please contact our support team:

• Email: [email protected] — response within 2 business hours
• Live Chat: Available 24/7 via the chat interface on all Platform pages
• Subject line for data requests: Please use "Data Rights Request — [Your Registered Email]" to help us route your enquiry efficiently

panda95 will respond to data subject access requests within a reasonable period not exceeding 30 days. Where a request is complex or involves a large volume of data, we may extend this period and will notify you accordingly.

If you are not satisfied with our response to a data complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us in the first instance, as we are committed to resolving all data concerns fairly and promptly.