Privacy Policy — Shell96 Platform

1 Introduction

Shell96 ("Shell96", "we", "us", "our") operates the online casino and sports betting platform accessible at shell96.cam. As a data controller, Shell96 is responsible for the personal data of registered players and platform visitors collected through the Shell96 website, mobile applications, and related digital services.

This Privacy Policy ("Policy") describes how Shell96 collects, uses, stores, shares, and protects personal data in connection with the provision of its platform and services. It also describes the rights available to individuals whose personal data we process, including users based in Malaysia and other jurisdictions.

This Policy applies to all registered Shell96 players, prospective players who visit the Platform without registering, and any other individuals whose personal data we receive in the course of our operations. It should be read together with our Terms & Conditions and Responsible Gambling Policy.

By accessing or using the Shell96 Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices as described herein, you should not access the Platform or provide us with any personal information.

2 Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, Shell96.
• "Data Processor" means any third party that processes Personal Data on behalf of Shell96 under a written data processing agreement.
• "KYC" means Know Your Customer — the regulatory identity and address verification process applicable to all registered players.
• "Cookies" means small text files placed on your device by the Platform to facilitate functionality, analytics, and personalisation.
• "Player" means any natural person who has registered a Shell96 account and uses the Platform.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data of Malaysian individuals in commercial transactions.

3 Personal Data We Collect

3.1 Registration Data

When you create a Shell96 account, we collect the following information:

• Full legal name;
• Date of birth (to verify you are aged 21 or above);
• Residential address (including city, postcode, and country);
• Email address;
• Mobile phone number;
• Username and password (passwords are stored in hashed form — we do not store your plaintext password);
• Preferred currency (Malaysian Ringgit / MYR for Malaysian players).

3.2 Identity Verification (KYC) Data

To comply with our international licensing obligations, we collect KYC documentation including:

• Government-issued photo identification (Malaysian MyKad / NRIC, Passport, or Driver's License);
• Proof of address documents (utility bills, bank statements from institutions such as Maybank, CIMB, or Public Bank, dated within three months);
• Verification selfie photographs;
• Source of funds documentation where required by our compliance procedures.

3.3 Financial Transaction Data

When you make deposits or withdrawals, we collect:

• Payment method details (e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; bank account details for Maybank, CIMB, Public Bank, Hong Leong Bank; card details for Visa and Mastercard transactions; cryptocurrency wallet addresses for BTC and USDT);
• Transaction amounts in MYR or applicable currency;
• Transaction timestamps and reference numbers;
• Payment processor responses and confirmation data.

3.4 Platform Usage Data

We collect data about how you interact with the Shell96 Platform, including:

• Game session records (games played, wager amounts, outcomes, session durations);
• Sports betting activity (markets wagered on, odds accepted, bet amounts, outcomes);
• Bonus and promotion interactions;
• Customer support conversation records;
• Login timestamps and session metadata.

3.5 Technical and Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser information;
• Cookie identifiers and session tokens;
• Platform performance logs and error reports.

4 How We Collect Personal Data

Shell96 collects personal data through the following channels:

• Directly from you — information you provide when registering, completing KYC, making transactions, or contacting our support team;
• Automatically via the Platform — technical and usage data collected through cookies, web beacons, and server logs during your interaction with the Platform;
• From third-party payment processors — transaction confirmation data provided by payment service providers including FPX, DuitNow, and card networks upon processing of your deposit or withdrawal;
• From identity verification service providers — confirmation data from KYC verification partners engaged by Shell96 to validate identity documents;
• From fraud prevention services — risk signals and fraud indicators from third-party fraud detection partners to protect the integrity of the Platform.

5 Data Processing & Purpose

The following table sets out the primary purposes for which Shell96 processes personal data and the corresponding data categories used for each purpose:

6 Legal Basis for Processing

Shell96 processes personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between Shell96 and the Player — including account management, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable laws and licensing obligations, including KYC, anti-money laundering (AML), and age verification requirements;
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such processing does not override the Player's fundamental rights and freedoms;
• Consent: Processing for direct marketing communications and non-essential cookies, where you have provided explicit, freely given, and withdrawable consent.

7 Data Sharing & Disclosure

Shell96 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We share personal data only in the following circumstances:

7.1 Service Providers and Data Processors

We engage third-party service providers who process personal data on our behalf under written data processing agreements that bind them to confidentiality and data protection standards no less protective than those in this Policy. These providers include payment processors, KYC verification services, fraud prevention services, IT infrastructure providers, and customer support platform providers.

7.2 Licensing Authority

Shell96 may be required to disclose Player data to its international licensing authority as a condition of continued licensing. Such disclosures are made only to the extent required by the licensing authority's rules and applicable law.

7.3 Legal and Regulatory Requirements

Shell96 will disclose personal data when required to do so by applicable law, court order, regulatory directive, or lawful governmental authority request. We will make reasonable efforts to notify affected Players of such disclosures where legally permitted to do so.

7.4 Anti-Money Laundering Reporting

Where Shell96's compliance procedures identify transactions or account activity that triggers mandatory AML reporting obligations under applicable licensing rules, relevant data may be reported to the appropriate authorities without prior notice to the Player, as required by law.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Shell96's assets, personal data held by Shell96 may be transferred to the acquiring entity. Players will be notified of any such transfer and its implications for their personal data prior to completion of the transfer.

8 International Data Transfers

Shell96 operates under international licensing and uses technology infrastructure and service providers located in multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, Shell96 ensures that appropriate safeguards are in place — including contractual data transfer agreements — to maintain protection standards equivalent to those described in this Policy.

Malaysian players whose data is processed in foreign jurisdictions retain all rights described in Section 12 of this Policy and may exercise those rights by contacting Shell96 support.

9 Data Retention

Shell96 retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal and licensing obligations. The following general retention periods apply:

• Active Account data: Retained for the duration of the account relationship plus a minimum of five (5) years following account closure, in accordance with AML and licensing record-keeping requirements;
• KYC documentation: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction, in accordance with applicable AML obligations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of transaction;
• Customer support records: Retained for three (3) years from the date of the interaction;
• Marketing data: Retained until consent is withdrawn or until the Player opts out of marketing communications, whichever is earlier;
• Technical and analytics data: Retained for up to twenty-four (24) months in identifiable form, after which it is anonymised or deleted.

When data is no longer required, Shell96 ensures it is securely deleted or anonymised in a manner that prevents recovery or re-identification.

10 Data Security

Shell96 implements industry-standard technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Shell96 Platform;
• Encryption of sensitive data fields (including passwords, which are stored as salted cryptographic hashes — never in plaintext) at rest in our databases;
• Strict access controls limiting data access to personnel with a legitimate operational need;
• Two-factor authentication requirements for internal system access by Shell96 staff;
• Regular security audits and vulnerability assessments of the Platform infrastructure;
• Incident response procedures in place to detect, contain, and notify affected parties in the event of a data breach.

While Shell96 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage method is entirely secure. Players are advised to use strong, unique passwords for their Shell96 accounts and to enable two-factor authentication where available.

11 Cookies & Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit the Shell96 Platform. They allow the Platform to recognise your device, remember your preferences, and provide certain features. Shell96 also uses similar technologies such as web beacons, pixel tags, and local storage objects for comparable purposes.

11.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These enable login sessions, security tokens, and language preferences. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Enable enhanced features and personalisation, such as remembering your preferred display currency (MYR) and odds format. Disabling these cookies may limit certain Platform features.
• Analytics Cookies: Collect aggregate, anonymised data about Platform usage to help us understand user behaviour and improve our services. Shell96 uses analytics data strictly for internal product improvement purposes.
• Marketing and Preference Cookies: Used to deliver relevant promotional communications within the Platform. These cookies are only placed with your consent and can be withdrawn at any time.

11.3 Managing Cookies

You may manage cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Note that disabling strictly necessary cookies will impair the functionality of the Shell96 Platform. Instructions for managing cookies are available through your browser's help documentation.

12 Your Data Rights

Subject to applicable law and any overriding legal obligations (including AML and licensing record-keeping requirements), you have the following rights in respect of your personal data processed by Shell96:

• Right of Access: You have the right to request a copy of the personal data Shell96 holds about you and information about how it is being used;
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to Shell96's legal retention obligations;
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, while a correction request is being resolved;
• Right to Data Portability: You may request that we provide your personal data in a structured, machine-readable format for transfer to another service provider where technically feasible;
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes. You may also opt out of marketing communications at any time;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact Shell96 support at [email protected]. We will acknowledge your request within five (5) business days and aim to provide a substantive response within thirty (30) calendar days. Complex requests may require additional time; we will notify you if this is the case.

13 Children & Minors

The Shell96 Platform is strictly intended for individuals aged 21 years and above. Shell96 does not knowingly collect, store, or process personal data of individuals below this age threshold. Age verification is conducted during the KYC process for all registered players.

If Shell96 discovers or has reason to believe that personal data of an individual under 21 years of age has been collected, it will take immediate steps to delete that data and close the associated account. Any funds in the account will be forfeited in accordance with the Shell96 Terms & Conditions.

If you are a parent or guardian and believe that your child's personal data has been submitted to Shell96, please contact our support team immediately at [email protected] so that we may take appropriate remedial action.

14 Third-Party Links

The Shell96 Platform may contain references to third-party services, payment providers, or other platforms. These references are provided for informational purposes only. Shell96 does not control, endorse, or accept responsibility for the privacy practices or content of any third-party services. We encourage Players to review the privacy policies of any third-party services they choose to access.

15 Policy Amendments

Shell96 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our processing activities, or our business operations. Material changes to this Policy will be communicated to registered Players via email and/or a prominent notice on the Platform at least seven (7) days before the changes take effect.

We encourage Players to review this Policy periodically. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. Your continued use of the Platform after any amendment constitutes your acceptance of the revised Policy.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or Shell96's handling of your personal data, please contact our Data Protection team through the following channel:

Shell96 takes data protection seriously. If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. Malaysian players may contact the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi — JPDP) for guidance on exercising rights under the Personal Data Protection Act 2010 (PDPA).