shell96 Privacy Policy

1 About This Policy

1.1  This Privacy Policy applies to all personal data collected and processed by shell96 ("we", "us", "our") in connection with the operation of the shell96 platform at shell96.win, including the website, mobile application, live chat support system, and all associated services.

1.2  Shell96 acts as the data controller in respect of personal data collected from players and visitors to the Platform. As data controller, shell96 is responsible for determining the purposes and means by which personal data is processed.

1.3  This Policy should be read alongside shell96's Terms & Conditions, which together constitute the complete agreement governing your relationship with the Platform. In the event of any conflict between this Policy and any other document, this Privacy Policy shall prevail in respect of data privacy matters.

1.4  Shell96 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection obligations under our licensing framework. We do not treat data privacy as a compliance formality — it is a core operational commitment.

2 Categories of Personal Data We Collect

2.1  Shell96 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

Registration & Identity Data:

• Full legal name as it appears on your government-issued identification document;
• Date of birth (to verify you meet the minimum age requirement of 21 years);
• Residential address;
• Email address;
• Mobile telephone number;
• Username and encrypted password credentials.

KYC Verification Data:

• Copy of government-issued photo identification (e.g., MyKad for Malaysian players);
• Proof of address documentation where required;
• Facial verification data submitted during video KYC processes;
• Source of funds documentation where required under our compliance obligations.

Financial & Transaction Data:

• Payment method details (e.g., registered e-wallet account identifiers, bank account details for withdrawal processing);
• Deposit and withdrawal transaction history;
• Account balance records.

Platform Activity Data:

• Game history, wager records, and session duration logs;
• Login timestamps and IP addresses;
• Device identifiers and browser type;
• Support chat logs and email correspondence.

3 How We Collect Your Data

3.1  Shell96 collects personal data through the following mechanisms:

• Direct submission: information you provide when registering an account, completing KYC, contacting support, or submitting a withdrawal request;
• Automated collection: technical data collected automatically when you access the Platform, including IP address, session tokens, device fingerprinting data, and cookie-derived identifiers;
• Third-party providers: identity verification data returned by our KYC service providers; payment confirmation data from payment processors including Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank;
• Game providers: game round data and RNG outcome records submitted by certified third-party game studios integrated with the shell96 Platform.

4 Purposes of Processing

4.1  Shell96 processes your personal data for the following purposes:

• Account creation, management, and authentication;
• Age verification and eligibility confirmation (minimum 21 years);
• Identity verification under KYC obligations imposed by our licensing framework;
• Processing deposits, withdrawals, and maintaining accurate transaction records;
• Detection and prevention of fraud, money laundering, and other prohibited activities;
• Providing customer support and resolving account disputes;
• Delivering personalised promotions and platform notifications where you have not opted out;
• Analysing Platform usage to improve functionality and user experience;
• Complying with legal, regulatory, and licensing obligations;
• Enforcing shell96's Terms & Conditions and other platform policies.

5 Legal Basis for Processing

5.1  Shell96 processes personal data on the following legal bases, as applicable to each processing activity:

• Contractual necessity: processing required to perform the contract between you and shell96, including account management, game access, and payment processing;
• Legal obligation: processing required to comply with KYC, anti-money laundering, and other regulatory obligations under our licensing framework;
• Legitimate interests: fraud prevention, platform security, abuse detection, and analytical processing to improve service quality;
• Consent: marketing communications and non-essential cookies, where your consent has been obtained and can be withdrawn at any time.

6 Data Sharing & Third Parties

6.1  Shell96 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

6.2  Shell96 shares personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• KYC and identity verification service providers engaged to verify identity documents and perform age checks;
• Payment processors and financial institutions (including e-wallet operators and banks) engaged to facilitate deposits and withdrawals in MYR;
• Game studio providers whose games are accessible through the shell96 Platform, to the extent required for game functionality and dispute resolution;
• IT infrastructure and cloud service providers supporting the technical operation of the Platform;
• Regulatory and licensing authorities where disclosure is required by law or licensing obligation;
• Law enforcement agencies where disclosure is required by a lawful order or where there is a reasonable basis to believe criminal activity has occurred.

6.3  All third-party service providers engaged by shell96 are required to implement appropriate technical and organisational measures to protect personal data and to process it only in accordance with shell96's documented instructions.

7 KYC & Identity Verification Data

7.1  KYC verification is a mandatory requirement for all shell96 accounts before any withdrawal is processed. The collection and processing of KYC data is governed by our licensing obligations and applicable anti-money laundering regulations.

7.2  Identity documents submitted for KYC purposes — including copies of MyKad, passport, or other government-issued photo identification — are transmitted over encrypted connections and stored on access-controlled secure servers. Access to KYC documents is restricted to shell96 compliance personnel and authorised third-party verification service providers.

7.3  Shell96 retains KYC documentation for a minimum period as required by our licensing jurisdiction, typically not less than five years from the date of account closure or last transaction. This retention is a legal obligation and cannot be waived upon player request during the mandatory retention period.

7.4  KYC data will not be used for any purpose other than identity verification, age confirmation, compliance with regulatory obligations, and the resolution of account disputes where identity is in question.

8 Payment Data & Financial Records

8.1  Shell96 processes financial transaction data for the purpose of completing deposits, processing withdrawals, maintaining accurate account records, and complying with anti-money laundering reporting obligations.

8.2  Shell96 does not store full payment card numbers or sensitive authentication data beyond what is strictly necessary for transaction completion. Payment processing is handled in conjunction with regulated payment service providers, including operators of Touch 'n Go eWallet, Boost, and Malaysian bank transfer services, each of whom maintains their own independent security and compliance standards.

8.3  Transaction records are retained for a minimum period required by our licensing obligations. These records form part of the legally mandated financial audit trail and cannot be deleted upon request during the mandatory retention period.

9 Cookies & Tracking Technologies

9.1  Shell96 uses the following categories of cookies and tracking technologies:

• Strictly necessary cookies: required for the Platform to function, including session authentication tokens, load balancing identifiers, and fraud detection parameters. These cannot be disabled without rendering the Platform non-functional.
• Analytical cookies: used to understand how players interact with the Platform, including page visit frequency, feature usage, and error reporting. Analytics data is aggregated and anonymised where possible.
• Preference cookies: used to remember your language preferences, display settings, and other Platform configurations.
• Marketing cookies: used to deliver relevant promotional content. These are deployed only with your consent and can be disabled at any time through your browser settings or account preferences.

9.2  You may manage cookie preferences through your browser settings at any time. Disabling non-essential cookies will not affect your ability to use the core shell96 gaming and sportsbook features.

10 Data Retention

10.1  Shell96 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or licensing obligations, whichever is longer.

10.2  Upon account closure at your request, shell96 will:

• Anonymise or delete marketing preference data and non-essential session data promptly;
• Retain KYC, transaction, and account history data for the mandatory period required under our licensing and anti-money laundering obligations (typically five years from the date of the last transaction or account closure, whichever is later);
• Retain support correspondence and dispute records for the applicable limitation period under the governing law of our licensing jurisdiction.

11 Security Measures

11.1  Shell96 implements the following technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• TLS 1.3 encryption for all data in transit between your device and the Platform;
• Encryption of sensitive personal data stored in our databases;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Multi-factor authentication for internal system access by shell96 personnel;
• Regular penetration testing and vulnerability assessments;
• Incident response procedures for notifying affected players in the event of a data breach that poses a material risk to their rights.

11.2  Notwithstanding these measures, no data transmission over the internet is entirely without risk. Shell96 cannot guarantee the absolute security of data transmitted to the Platform, and players transmit data at their own risk. Once we receive your data, we apply the security measures described above to protect it.

12 Your Data Subject Rights

12.1  Subject to applicable legal and regulatory limitations, you have the following rights in respect of your personal data held by shell96:

• Right of access: you may request a copy of the personal data shell96 holds about you;
• Right to rectification: you may request correction of inaccurate or incomplete personal data;
• Right to erasure: you may request deletion of your personal data, subject to our legal and regulatory retention obligations which may preclude deletion during mandatory retention periods;
• Right to restriction: you may request that processing of your personal data be restricted in certain circumstances;
• Right to data portability: you may request a copy of personal data you have provided to shell96 in a structured, machine-readable format;
• Right to object: you may object to processing of your personal data for direct marketing purposes at any time, without providing any reason;
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

12.2  To exercise any of the above rights, please contact shell96 support via live chat or at the email address provided in Section 16. Shell96 will respond to data subject requests within 30 days of receipt, in accordance with applicable obligations.

13 Children & Minors

13.1  Shell96 does not knowingly collect personal data from individuals under the age of 21. The Platform is strictly for adult users meeting the minimum age requirement. Where shell96 becomes aware that personal data has been collected from a person under 21, such data will be deleted and the associated account suspended immediately.

13.2  If you believe that a minor has registered a shell96 account or submitted personal data to the Platform, please contact shell96 support immediately so that the matter can be investigated and appropriate action taken.

14 International Data Transfers

14.1  Shell96's data infrastructure may involve processing of personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, shell96 ensures that appropriate safeguards are in place to provide an equivalent level of data protection to that applicable under our licensing framework.

14.2  Safeguards may include standard contractual clauses, data processing agreements with receiving entities, or transfers to jurisdictions with recognised data protection standards as determined under our licensing authority's guidance.

15 Amendments to This Policy

15.1  Shell96 reserves the right to amend this Privacy Policy at any time to reflect changes in data protection law, our licensing obligations, or our operational practices. The "Last updated" date at the top of this Policy indicates when the most recent revision was made.

15.2  Material changes to this Policy will be communicated to registered players via email notification or by means of a prominent notice on the Platform prior to the changes taking effect. Continued use of the Platform following a material amendment constitutes acceptance of the revised Policy.

16 Contact & Data Queries

16.1  For any queries, concerns, or requests relating to this Privacy Policy or the handling of your personal data by shell96, please contact our support team via live chat on the Platform or at: [email protected] (plain text — not a clickable link).

16.2  Shell96 aims to acknowledge all data-related enquiries within 2 business days and to provide a substantive response within 30 days. For complex requests requiring detailed investigation, we may extend this period and will notify you accordingly.

16.3  For responsible gaming and self-exclusion matters, please visit the Responsible Gaming page or contact support directly.