Privacy Policy — 09win

This Privacy Policy ("Policy") is published by 09win ("09win", "we", "us", "our") and applies to all personal data collected from users ("you", "User", "Player") who access or use the 09win platform located at https://09win.cam, including all associated online casino, sports betting, live dealer, and account management services.

We are committed to handling your personal data with care, transparency, and in accordance with applicable data protection laws and the principles of purpose limitation, data minimisation, and storage limitation. This Policy is intended to give you a clear understanding of your data and how it is used before you create an account or interact with 09win in any capacity.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By registering an account or continuing to use the 09win platform, you acknowledge that you have read and understood this Policy in full.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, email address, payment details, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or combination with other data.
• "Data Controller" means 09win, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of 09win in accordance with documented instructions.
• "KYC Data" means identity verification documents such as Malaysian IC (MyKad), passport, proof of address, and payment verification records collected during the Know Your Customer process.
• "Cookie" means a small text file placed on your device by the 09win platform to facilitate functionality, session management, and analytics.
• "MYR" means Malaysian Ringgit, the transaction currency of the 09win platform.

09win collects personal data through a number of channels, including account registration, KYC verification, payment processing, platform usage, customer support interactions, and cookies. The specific categories of data we collect are set out below.

We do not collect sensitive categories of personal data such as racial or ethnic origin, health data, or biometric data unless specifically required for compliance purposes and disclosed to you in advance.

09win processes your personal data for the following specific purposes. Where we rely on a legal basis other than consent for processing, that basis is identified in Section 05 below.

• Account Management: To create, maintain, and administer your 09win account, including verifying your identity and eligibility, and enabling you to access platform services.
• Payment Processing: To facilitate deposits and withdrawals in MYR through your chosen Malaysian payment channel, and to maintain accurate transaction records.
• Legal & Regulatory Compliance: To comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and gaming regulatory requirements, including the retention of transaction records and KYC documentation.
• Fraud & Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, collusion, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gambling: To monitor betting and gaming patterns that may indicate problem gambling behaviour, and to enforce self-exclusion and deposit limit settings where activated by you.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance and regulatory purposes.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the overall functionality and user experience of the 09win platform.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus notifications, and platform updates. You may withdraw this consent at any time.

We process your personal data only where we have a valid legal basis to do so. Depending on the purpose of processing, the applicable legal basis is one of the following:

• Contractual Necessity: Processing is necessary to perform our contract with you (i.e., to operate your 09win account and provide the services you have signed up for).
• Legal Obligation: Processing is necessary to comply with applicable law, including AML, KYC, and gaming regulatory requirements.
• Legitimate Interests: Processing is necessary for 09win's legitimate business interests, such as fraud prevention, platform security, and responsible gambling monitoring, provided those interests are not overridden by your rights and interests.
• Consent: For marketing communications and optional analytics cookies, we rely on your explicit consent. You may withdraw consent at any time without affecting our right to process data under other legal bases.

09win does not sell, rent, or trade your personal data. We may share your data with third parties only in the following limited circumstances:

• Payment Service Providers: We share financial transaction data with our Malaysian payment partners (including FPX, DuitNow, and e-wallet providers) solely to process your deposits and withdrawals.
• Identity Verification Providers: We may use third-party KYC and identity verification services to assist with the verification of your Malaysian IC or other identification documents.
• Regulatory Authorities: We may disclose your data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where required to do so by applicable law or valid legal order.
• Fraud Prevention Agencies: We may share data with third-party fraud prevention and AML screening services where we have reasonable grounds to suspect fraudulent or unlawful activity.
• Service Providers: We engage carefully vetted third-party service providers (such as cloud infrastructure, customer support software, and analytics tools) who process data on our behalf as Data Processors, bound by strict data processing agreements.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of 09win's business, your data may be transferred as part of that transaction, subject to equivalent privacy protections.

09win retains your personal data for only as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Active Account Data: Retained for the lifetime of your account plus a minimum of five (5) years following account closure, in line with standard AML and gaming regulatory requirements.
• Transaction Records: Financial records including deposit and withdrawal history are retained for a minimum of seven (7) years from the date of the transaction.
• KYC Documents: Identity and verification documents are retained for a minimum of five (5) years following account closure or the date of the last transaction, whichever is later.
• Support Communications: Live chat logs and email correspondence are retained for three (3) years from the date of the interaction, unless a longer period is required for dispute resolution.
• Marketing Consent Records: Records of your consent to receive marketing communications are retained for the duration of your account and for two (2) years following account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with your identity.

09win implements a comprehensive range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, and disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and the 09win platform.
• Encryption of personal data at rest using industry-standard encryption algorithms.
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific duties.
• Regular security audits and penetration testing conducted by independent third-party security firms.
• Multi-factor authentication (MFA) options for Player accounts to mitigate the risk of unauthorised account access.
• Comprehensive data breach response procedures, including notification obligations to relevant authorities and affected Players where a breach poses a risk to your rights.

While we take every reasonable precaution, no data transmission over the internet is entirely risk-free. You are responsible for maintaining the security of your own account credentials and for notifying us immediately if you suspect that your account has been compromised.

09win uses cookies and similar tracking technologies to deliver a functional, secure, and personalised platform experience. Cookies are small data files stored on your device when you visit the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the operation of the Platform, including session management, authentication, and security. These cookies cannot be disabled without affecting core functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gambling limits you have configured on your account.
• Analytics Cookies: Used to collect aggregated, anonymised information about how Players use the Platform, enabling us to identify issues and improve performance. These are only set with your consent.
• Security Cookies: Used to detect and prevent fraudulent activity, including session hijacking and account takeover attempts.

You can control and manage cookie settings through your browser. Please note that disabling certain cookies may affect your ability to use parts of the 09win platform. Analytical and non-essential cookies are only activated with your explicit consent.

Subject to applicable law, you have the following rights in relation to the personal data that 09win holds about you. To exercise any of these rights, please contact us using the details in Section 14.

We will respond to all valid data subject requests within thirty (30) days of receipt. In cases of complexity or volume, we may extend this period by a further two months, in which case we will notify you of the extension and the reason for it within the initial thirty-day period.

The 09win platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor has registered an account with 09win or has provided us with personal data, please contact our support team immediately using the details provided in Section 14 of this Policy.

In the course of operating the 09win platform, some of your personal data may be transferred to, stored in, or processed in jurisdictions outside of Malaysia. Such transfers may occur where our service providers, game studio partners, or infrastructure providers are located in other countries.

Where personal data is transferred outside Malaysia, we ensure that appropriate safeguards are in place to protect it at a standard at least equivalent to that required under applicable Malaysian data protection law. These safeguards may include contractual data processing agreements with standard data protection clauses, adequacy decisions, or other recognised transfer mechanisms.

09win reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the scope of platform services. Where changes are material, we will notify active Players by email or by a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the 09win platform following publication of a revised Policy constitutes your acknowledgement of the changes.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact the 09win Data Privacy team through the following channels:

• Privacy Enquiries Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please include "Privacy Request" or "Data Subject Request" in your subject line for faster routing.
• Live Chat: Available 24/7 through the Platform for general enquiries
• Response Time: Data subject requests acknowledged within 5 business days; substantive response within 30 days

When submitting a data subject request, please provide sufficient information to enable us to verify your identity and locate your account. This is necessary to protect your data and prevent unauthorised access to another person's information.