M9my Privacy Policy – Personal Data Protection for Malaysia's Online Casino Platform

M9my, operating through the domain m9my.my, is the data controller for all personal information collected through our online casino platform. We are fully committed to protecting the privacy of every registered member and ensuring that all personal data is handled with care, security and responsibility in accordance with the highest legal and ethical standards.

This Privacy Policy applies to all users of the m9my platform, including website visitors, registered members and anyone who interacts with any service provided by m9my. By accessing, registering or continuing to use the m9my platform, you consent to the collection and use of your personal data as described in this document.

We believe privacy is more than a legal obligation — it is the foundation of trust we have built with over 500,000 registered m9my members across Malaysia. Every decision we make regarding data handling is guided by the best interests of our users.

M9my collects various categories of personal data depending on the nature of your interaction with our platform. In general, the data we collect can be divided into three main categories:

A. Data You Provide Directly:

• Registration details: full name, email address, Malaysian phone number, date of birth and account password.
• Identity verification (KYC) information: a copy of a valid Malaysian MyKad or passport, and proof of current residential address.
• Financial information: bank account numbers, digital wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay), and DuitNow information required for deposits and withdrawals.
• Communications with m9my: records of correspondence, live chat conversations and emails between you and the m9my support team.

B. Automatically Collected Data:

• Technical data: IP address, web browser type, device operating system, and screen resolution.
• Usage data: pages visited, time spent on each section of the platform, games played and frequency of use.
• Location data: geographical location information derived from your IP address to ensure compliance with m9my's regional service restrictions.

C. Data from Authorised Third Parties:

• Verification information from Malaysian payment service providers (such as Touch 'n Go, GrabPay, and FPX) to confirm transaction accuracy.
• Identity verification information from licensed identity verification agencies operating in Malaysia.

M9my uses the personal data collected for the following purposes, all of which are lawful and necessary for the provision of our services:

• Account Management: New account registration, identity verification, password recovery and m9my member profile management.
• Gaming Services Provision: Allows you to access and play all games on the m9my platform, including video slots, Live Casino, Casino War, and other card games.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as managing withdrawal of winnings to your bank account or digital wallet.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, multi-account use and platform exploitation.
• Customer Support: Handling enquiries, resolving complaints and providing technical support in Bahasa Melayu 24 hours a day.
• Marketing & Promotions (with your consent): Sending you information about bonuses, promotions, and new offers at m9my that may be of interest to you.
• Platform Improvements: Analysing usage patterns to improve the performance, interface and game content of m9my.
• Legal Compliance: Meeting reporting requirements, financial record-keeping, and other compliance obligations stipulated under Malaysian law.

M9my processes your personal data on the following legal bases recognised under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent: When you register an m9my account, you provide us with your explicit consent to process your personal data for the purposes set out in this Privacy Policy. You may withdraw this consent at any time, though doing so may affect your ability to continue using m9my's services.
• Contractual Necessity: Data processing necessary to fulfil the agreement between you and m9my — including account management, payment processing and the provision of gaming services.
• Legal Obligations: Data processing required to comply with m9my's legal obligations under Malaysian law, including AML, KYC and financial reporting requirements.
• Legitimate Interests: Processing data for m9my's legitimate interests — such as fraud prevention, platform security and service improvement — provided these interests do not override your fundamental privacy rights.

M9my stores your personal data on secure, protected servers. Data retention periods are determined based on service delivery requirements and legal obligations:

• Active Account Data: For as long as your m9my account remains active and you continue to use our platform.
• Data After Account Closure: m9my retains certain data for a minimum of 7 years following account closure to meet financial reporting requirements, AML compliance, and potential legal investigations.
• Transaction Record Data: Records of all financial transactions (deposits and withdrawals) are retained for a minimum of 7 years, in line with Malaysian accounting and financial law requirements.
• Communication Data: Records of communications between you and the m9my support team are retained for 2 years for reference and dispute resolution purposes.

When data is no longer needed, m9my will securely delete or anonymise it using procedures that comply with industry standards.

M9my does not sell or provide members' personal data to third parties for commercial marketing purposes. However, there are certain circumstances where m9my may need to share your personal data with specific parties:

• Payment Service Providers: To process deposits and withdrawals, m9my is required to share relevant transaction information with providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow and FPX-participating banks operating in Malaysia.
• Gaming Service Provider: Game technology providers that supply video slots, live casino and table games to the m9my platform may receive game activity data necessary for the technical operation of their systems.
• Identity Verification Agency: For KYC and identity verification purposes, m9my may share relevant information with licensed verification agencies operating in Malaysia.
• Malaysian Authorities: m9my will disclose personal data to Malaysian government authorities or law enforcement bodies when required to do so by law or a valid court order.
• Professional Advisors: Lawyers, accountants and auditors who assist m9my with business operations may access certain data, subject to strict confidentiality obligations.

All third parties that receive personal data from m9my are bound by strict data protection agreements and are required to uphold data security standards no less stringent than those of m9my itself.

M9my implements comprehensive technical and organisational security measures to protect members' personal data against unauthorised access, loss, destruction or accidental disclosure:

• Data Encryption: All data transmitted between your browser and m9my's servers is protected by 256-bit SSL encryption. Stored data is further encrypted using AES-256.
• Firewall & Intrusion Detection System: The m9my infrastructure is protected by multi-layered firewalls and an active intrusion detection system that monitors network traffic 24 hours a day.
• Internal Access Controls: Only m9my staff who require access to personal data to carry out their duties are granted permission, based on a strict need-to-know principle.
• Regular Security Testing: m9my conducts regular penetration testing and security audits by qualified independent parties to identify and address security vulnerabilities.
• Staff Training: All m9my staff who handle personal data undergo rigorous data protection training and are required to sign legally binding confidentiality agreements.
• Incident Response Procedure: m9my maintains tested security incident response procedures to ensure any data breach is promptly detected, contained, and reported.

As an m9my member and as an individual protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights with respect to your personal data:

M9my will process every privacy rights request within 30 working days from the date the request is received. For cases requiring additional information or identity verification, we will follow up with you within the first 5 business days.

Please note that certain rights may be limited in specific circumstances — for example, we are unable to delete data required to fulfil legal obligations or data needed for purposes of public interest.

M9my uses cookies and similar tracking technologies to enhance the user experience and analyse platform usage patterns. The following types of cookies are used:

• Essential Cookies: Cookies required for the core functions of the m9my platform to operate correctly — such as maintaining your login session and saving your language preference. These cookies cannot be disabled.
• Performance Cookies: Collecting anonymous information about how you use the m9my platform to help us identify and improve areas that need attention.
• Functional Cookies: Remembering your preferences — such as game settings, deposit options and display preferences — to personalise your experience on m9my.
• Analytics Cookies: Used by analytics tools to help us understand how visitors interact with the m9my platform in aggregate and anonymised form.

You can manage your cookie settings through your web browser. Disabling certain cookies may affect the functionality of the m9my platform. For more information on how to manage cookies in popular browsers such as Chrome, Firefox, or Safari, please refer to the relevant browser's help documentation.

M9my's technical infrastructure may involve processing data outside Malaysia under certain circumstances, such as the use of internationally accredited cloud server services. In all cases, m9my ensures that:

• Any transfer of data outside Malaysia only takes place to countries or entities that provide a level of data protection equivalent to or greater than that afforded in Malaysia.
• Strict, legally binding data protection agreements exist between m9my and all international data recipients.
• All international data transfers comply with Malaysia's PDPA requirements and relevant international standards.

If you would like to know more about the safeguards in place for international data transfers related to your account, please contact us at [email protected].

M9my takes child protection extremely seriously. Our platform is strictly restricted to individuals who are of age 18 years and above only, and we do not knowingly collect or process personal data of individuals under the age of 18.

Measures taken by m9my to protect minors include:

• Strict age verification during the new account registration process.
• A KYC process requiring verification of valid identity documents to confirm the applicant's age.
• Immediate closure without notice of any account confirmed to belong to an individual under 18 years of age.

If you become aware that a minor under the age of 18 has registered an m9my account, please notify us immediately via email at [email protected] so that appropriate action can be taken promptly.

M9my reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, legal requirements or the services we offer to members in Malaysia.

When material amendments are made to this Privacy Policy, m9my will notify you through:

• An in-platform m9my notification will be displayed upon your next login.
• A notification email sent to the email address registered with your m9my account.
• Updating the "Last Updated" date displayed at the top of this Privacy Policy page.

Your continued use of the m9my platform after an amended Privacy Policy takes effect constitutes your acceptance of the revised terms. If you do not agree with the changes, you have the right to close your m9my account by contacting our support team.

If you have any questions, concerns, or requests regarding m9my's Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Email (Data Privacy): [email protected] – Please include "Data Privacy Inquiry" in the subject line of your email for faster processing.
• Live Chat: Available directly within the m9my platform 24 hours a day, 7 days a week. Our Bahasa Malaysia-speaking support team is always ready to assist.

M9my aims to address all privacy-related enquiries promptly and respectfully. We are committed to providing an initial response within 48 hours and a full resolution within 30 business days for cases requiring further investigation.

If you are dissatisfied with m9my's response regarding your data privacy, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia in accordance with the provisions of the PDPA 2010.