Privacy Policy

1. Introduction

9winbox operates as a licensed online casino and sports betting platform serving Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and other locations throughout Malaysia. As part of operating a regulated gaming platform, 9winbox is required to collect and process certain personal data about its Members — both to fulfil contractual obligations and to comply with international gaming authority licensing conditions, which include mandatory Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures.

This Policy is intended to give you a clear, plain-English explanation of what data we collect, why we collect it, how it is used and stored, and what rights you have in relation to it. We do not sell your personal data to third parties for marketing purposes, and we do not share your data with anyone who is not involved in the operation of the 9winbox platform or required to receive it by law.

If you have any questions about this Policy or how your personal data is handled, please contact 9winbox through the live chat function on the Platform or at the email address provided at the end of this document.

2. Data We Collect

9winbox collects the following categories of personal data from Members and, in limited circumstances, from Platform visitors:

2.1 Registration Data

• Full legal name
• Date of birth (for age verification)
• Email address
• Malaysian phone number
• Residential address (city and postcode at minimum)
• Username and encrypted password

2.2 Identity Verification (KYC) Data

• Government-issued photo identification (MyKad front and back image, or passport photo page)
• Proof of address document (utility bill, bank statement, or e-wallet transaction history)
• Selfie or live photo for identity matching, where required

2.3 Financial Data

• Payment method details (bank account name, last four digits of account or card; full card numbers are never stored)
• E-wallet account identifiers (TnG eWallet, Boost, GrabPay) associated with your account
• Transaction history: deposits, withdrawals, transfer amounts, and timestamps

2.4 Gaming & Betting Activity Data

• Bet history across all 9winbox game verticals (casino, sports, slots, lottery)
• Session duration, frequency, and gameplay patterns
• Bonus and promotion usage history
• Responsible gaming tool usage (deposit limit activations, self-exclusion events)

2.5 Technical & Device Data

• IP address at time of registration and each login
• Device type, operating system, and browser version
• Geolocation data (country/city level, derived from IP)
• Session timestamps and login history

2.6 Communications Data

• Content and timestamps of live chat support conversations
• Email correspondence with the 9winbox support or compliance team
• Feedback or dispute submissions

3. How We Collect Data

9winbox collects personal data through the following means:

• Directly from you — when you register an account, complete KYC, make a deposit or withdrawal, contact support, or use any interactive feature on the Platform.
• Automatically — through cookies, server logs, and analytics tools when you visit or interact with the 9winbox website, as described in Section 9 below.
• From third-party payment processors — transaction confirmation data passed from payment providers such as Maybank2u, CIMB Clicks, DuitNow, and Touch 'n Go eWallet when you initiate a deposit or withdrawal through their services.
• From identity verification services — where 9winbox uses a third-party KYC service provider to assist with document verification, that provider may return verification results and data quality scores to 9winbox as part of the KYC process.

4. Purpose of Processing

9winbox processes personal data for the following purposes:

• Account creation and management: To register, maintain, and administer your 9winbox member account, including processing logins and account security.
• KYC and age verification: To verify that you are aged 21 or above and that the identity information you provided at registration is accurate, as required by our licensing conditions.
• Payment processing: To process deposits, withdrawals, and refunds in Malaysian Ringgit through your chosen payment method.
• AML compliance: To monitor transactions for patterns consistent with money laundering or financial crime, as required under our international gaming licence.
• Customer support: To respond to queries, disputes, and complaints submitted through live chat or email.
• Responsible gaming: To operate deposit limits, loss limits, self-exclusion tools, and player protection monitoring programmes.
• Platform security: To detect, investigate, and prevent fraud, unauthorised access, and technical abuse of the Platform.
• Regulatory reporting: To fulfil mandatory reporting obligations to our licensing authority, including suspicious transaction reports where required by law.
• Service improvement: To analyse aggregated, anonymised usage patterns to improve Platform performance, game catalogue, and user experience.

5. Legal Basis for Processing

9winbox processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations to you as a Member — including account management, payment processing, and service delivery.
• Legal obligation: Processing required by applicable law and our international gaming licence — including KYC, AML monitoring, age verification, and regulatory reporting.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gaming programme management, where those interests are not overridden by your fundamental rights.
• Consent: Where we send you optional marketing communications (e.g. promotional emails about new bonuses), we will do so only with your explicit consent, which you may withdraw at any time.

6. Data Sharing

9winbox does not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary:

• Payment processors: Maybank2u, CIMB Clicks, Public Bank, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and FPX — to process your financial transactions.
• KYC / identity verification providers: Third-party services that assist with document verification as part of our licensing-mandated KYC process.
• IT infrastructure and hosting providers: Cloud and server providers that host 9winbox platform data under data processing agreements that require them to handle data to our security and confidentiality standards.
• Licensing authority: Our international gaming regulator, to whom we are required to provide certain player and transaction data as a condition of our licence.
• Law enforcement and regulatory authorities: Where we are required by law, court order, or regulatory direction to disclose information — including suspicious transaction reports filed under AML obligations.
• Professional advisers: Legal, compliance, and audit professionals engaged by 9winbox who are subject to confidentiality obligations.

7. International Data Transfers

Some of the third parties with whom 9winbox shares data — including certain KYC providers and cloud infrastructure providers — may process data in jurisdictions outside Malaysia. Where such transfers occur, 9winbox takes steps to ensure that appropriate safeguards are in place, including contractual protections and, where applicable, reliance on recognised international data transfer mechanisms. If you have questions about specific transfer arrangements, contact us using the details in Section 14.

8. Data Retention

9winbox retains personal data for the period necessary to fulfil the purposes set out in this Policy, and in any event for no shorter than the minimum retention periods required by our international gaming licence and applicable anti-money laundering regulations. In practice, this means:

• Account registration data and KYC documents are retained for a minimum of five (5) years following account closure.
• Transaction and betting history is retained for a minimum of five (5) years from the date of each transaction.
• Communications data (live chat and email records) is retained for a minimum of two (2) years from the date of each communication.
• Technical and device data (IP logs, session records) is retained for a minimum of twelve (12) months.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

9. Cookies & Tracking Technologies

9winbox uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function — including session management, login state, and security tokens. These cannot be disabled without breaking core Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how visitors navigate the Platform, allowing us to identify and fix performance issues and improve the user experience.
• Preference cookies: Store your language preferences and other settings to personalise your experience across sessions.

9winbox does not use advertising or retargeting cookies. You can manage cookie preferences through your browser settings, though disabling essential cookies will affect your ability to log in and use the Platform.

10. Your Rights

Subject to applicable law and our licensing obligations, you have the following rights in relation to your personal data held by 9winbox:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to our legal and licensing retention obligations (which may override this right in specific circumstances).
• Right to restriction: You may request that we restrict processing of your data in certain circumstances, for example while a dispute about accuracy is being resolved.
• Right to object: You may object to processing based on legitimate interests grounds, unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent (e.g. marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact the 9winbox data team at [email protected] (plain text only — not a clickable link). We will respond within 30 days of receiving a valid request. We may ask you to verify your identity before processing a data rights request.

11. Children's Privacy

The 9winbox Platform is strictly intended for persons aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete the data to the extent permitted by our licensing retention obligations, and notify the relevant licensing authority. If you believe a person under 21 has registered on 9winbox, please notify us immediately at the contact details below.

12. Security Measures

9winbox implements technical and organisational security measures appropriate to the risk associated with processing personal data on a licensed gaming platform. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the 9winbox Platform.
• Encryption at rest for sensitive data categories including KYC documents and payment information.
• Access controls limiting internal access to personal data to authorised staff on a need-to-know basis.
• Regular security audits and penetration testing of the Platform infrastructure.
• Multi-factor authentication requirements for staff accessing administrative systems.
• Incident response procedures for detecting, containing, and notifying relevant parties in the event of a data breach.

While 9winbox takes these measures seriously, no internet-based platform can guarantee absolute security. Members are encouraged to use strong, unique passwords and to enable Two-Factor Authentication on their 9winbox accounts.

13. Changes to This Policy

9winbox may update this Privacy Policy from time to time to reflect changes in our data practices, technology, or legal requirements. When material changes are made, the updated Policy will be published on this page with an updated effective date, and we will endeavour to notify active Members by email. Continued use of the Platform following publication of a revised Policy constitutes your acceptance of the updated terms.

14. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 9winbox, please contact our team:

• Live Chat: Available 24/7 through the Platform (English and Mandarin)
• Email: [email protected] (plain text — not a clickable link)

Our support and compliance teams are available around the clock to address data privacy enquiries. We aim to respond to all privacy-related requests within five (5) business days.