Privacy Policy

This Privacy Policy ("Policy") describes how a9play ("a9play", "We", "Us", "Our") collects, uses, stores, shares, and protects the personal data of individuals ("You", "User", "Player") who access or use the a9play platform at https://a9play.cam, including all associated services, features, and content.

a9play recognises that privacy is a fundamental right. We are committed to handling your personal data with transparency, integrity, and in accordance with internationally recognised data protection principles. This Policy applies to all personal data provided to us directly during registration, gathered automatically during your use of the platform, or obtained from third-party sources for verification purposes.

By registering an account on a9play or by continuing to use our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should discontinue use of the platform and contact us to close your account.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, phone number, financial account details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, a9play.
• "Data Processor" means an entity that processes personal data on behalf of the Data Controller, such as payment processors, KYC verification providers, and cloud hosting services.
• "Cookies" means small text files placed on your device by the a9play platform to enable session management, analytics, and personalisation functions.
• "KYC Data" means identity verification documentation, including government-issued photo identification and proof of address documents, submitted in connection with the account verification process.
• "Sensitive Data" means personal data that warrants a higher level of protection, including financial data, identification document data, and data relating to gambling behaviour.

The Data Controller responsible for personal data processed through the a9play platform is the a9play operating entity, which holds the international gaming licence under which a9play operates. a9play operates the platform at https://a9play.cam and is responsible for determining how and why your personal data is processed.

For all privacy-related queries, data subject rights requests, or complaints, you may contact a9play's designated data protection contact using the details set out in Section 16 (Contact Us) of this Policy.

Where third-party service providers process your data on a9play's behalf (for example, payment gateways such as those facilitating Touch 'n Go eWallet or DuitNow transactions, or KYC verification services), those providers act as Data Processors under contractual obligations to process data only in accordance with a9play's instructions and applicable data protection requirements.

a9play collects personal data through three primary channels: data you provide directly, data generated automatically by your use of the platform, and data received from third-party verification services. The categories of data collected are set out in the table below:

a9play processes your personal data for the following specific, legitimate purposes:

1. Account Management: Creating, maintaining, and administering your a9play account, including authentication, password management, and account security alerts.
2. Identity Verification (KYC): Confirming your identity and age (21+) in compliance with our licensing obligations and anti-money-laundering requirements. This includes verifying that identity documents are genuine and that you are who you claim to be.
3. Payment Processing: Facilitating deposits and withdrawals in MYR via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Malaysian bank transfers, and cryptocurrency. Transaction data is retained for reconciliation and dispute resolution.
4. Regulatory Compliance: Meeting our obligations under our international gaming licence, including record-keeping, anti-money-laundering monitoring, responsible gambling programme administration, and responding to regulatory inquiries.
5. Fraud Prevention and Platform Security: Detecting and investigating fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct.
6. Customer Support: Responding to enquiries, resolving disputes, processing complaints, and providing assistance via live chat and email.
7. Responsible Gambling: Monitoring gaming behaviour to identify patterns that may indicate problem gambling, administering self-exclusion requests, and enforcing deposit and loss limits.
8. Service Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game library selection, and user experience.
9. Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may opt out at any time.

a9play relies on the following legal bases for processing your personal data, consistent with internationally recognised data protection frameworks:

• Contractual Necessity: Processing required to perform the contract between you and a9play — specifically, account creation, game provision, payment processing, and customer support.
• Legal Obligation: Processing required to comply with legal and regulatory obligations, including KYC/AML requirements imposed by our gaming licence, and record-keeping obligations.
• Legitimate Interests: Processing necessary for a9play's legitimate business interests, including fraud prevention, platform security, service improvement, and responsible gambling monitoring — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your explicit, informed consent — specifically for marketing communications and for the placement of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Where we rely on legitimate interests as our legal basis, we conduct a balancing assessment to ensure our interests do not outweigh your rights. If you would like more information about these assessments, contact us using the details in Section 16.

a9play does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. We may share your personal data in the following limited circumstances:

• Payment Processors: We share relevant financial data with licensed payment service providers to facilitate deposits and withdrawals. This includes providers supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank transfers. These processors are contractually bound to handle your data securely and solely for payment processing purposes.
• KYC Verification Providers: Identity documents and selfie images may be shared with licensed third-party KYC verification services for the purpose of identity and age verification. These providers operate under strict data security and confidentiality obligations.
• Cloud Infrastructure Providers: a9play uses reputable cloud hosting and data storage services. Data stored on these platforms is subject to appropriate data processing agreements and security controls.
• Regulatory and Law Enforcement Authorities: a9play may disclose personal data to licensing authorities, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required by applicable law, regulatory obligation, or pursuant to a valid legal order.
• Anti-Fraud and AML Networks: Where permitted by law, a9play may participate in industry-wide fraud prevention databases or responsible gambling self-exclusion registers, disclosing limited data for the purpose of protecting players and the integrity of the platform.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by a9play may access personal data to the extent reasonably necessary for the performance of their professional services, subject to confidentiality obligations.

In all cases, data sharing is subject to contractual safeguards requiring recipient parties to maintain appropriate security standards and to process data only for the specific purpose for which it was disclosed.

a9play operates internationally and your personal data may be stored and processed in countries outside Malaysia. Where data is transferred to jurisdictions that may not provide the same level of data protection as your home country, a9play will implement appropriate safeguards to ensure your data remains protected. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Data processing agreements incorporating appropriate security and confidentiality obligations;
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

By using the a9play platform, you acknowledge and consent to the transfer, storage, and processing of your personal data in jurisdictions outside Malaysia as described in this section. If you have concerns about international data transfers, contact us using the details in Section 16.

a9play retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our regulatory and legal obligations. The following general retention periods apply:

• Account and Registration Data: Retained for the duration of your account's active status, plus a minimum of 5 years following account closure to satisfy regulatory record-keeping requirements.
• KYC Documentation: Retained for a minimum of 5 years from the date of submission, in accordance with anti-money-laundering record-keeping obligations.
• Transaction and Financial Records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming Activity Logs: Retained for a minimum of 3 years for responsible gambling monitoring and dispute resolution purposes.
• Customer Support Communications: Retained for up to 2 years from the date of the interaction unless required longer for dispute resolution.
• Marketing Preferences: Retained until you withdraw consent or request deletion, subject to minimum regulatory retention periods.
• Technical and Log Data: Typically retained for up to 12 months for security monitoring and fraud prevention purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Backup copies are purged on a rolling schedule consistent with our data management procedures.

a9play uses cookies and similar tracking technologies to operate the platform, improve performance, and — with your consent — deliver personalised experiences. The types of cookies we use are described below:

• Strictly Necessary Cookies: Required for core platform functionality, including user authentication, session management, and security features. These cookies cannot be disabled without affecting your ability to use the platform.
• Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate the platform, which pages are visited most frequently, and where errors occur. This data helps us improve the platform experience.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and responsible gambling tool settings (e.g., deposit limit reminders).
• Marketing and Targeting Cookies: Used only with your explicit consent to deliver relevant promotional content. If you opt out of marketing communications, related cookies will be disabled.

On your first visit to a9play, you will be presented with a cookie preference banner allowing you to accept, reject, or customise non-essential cookie categories. You may also update your cookie preferences at any time through your account settings or browser settings. Disabling cookies that are not strictly necessary may affect certain platform features but will not prevent you from accessing core gaming functionality.

a9play implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and a9play's servers is encrypted using TLS 1.2 or higher (256-bit SSL). You can verify this by the padlock icon in your browser's address bar when visiting https://a9play.cam.
• Encryption at Rest: Sensitive data stored on our servers, including KYC documents and financial records, is encrypted using AES-256 or equivalent encryption standards.
• Access Controls: Personal data is accessible only to authorised a9play personnel and approved third-party processors on a strict need-to-know basis. Access is logged and regularly audited.
• Two-Factor Authentication: a9play supports two-factor authentication for player account logins to reduce the risk of unauthorised account access.
• Intrusion Detection and Monitoring: Our platform infrastructure is monitored continuously for suspicious activity, including automated intrusion detection systems and regular vulnerability assessments.
• Staff Training: All a9play personnel with access to personal data receive regular training on data protection obligations and security best practices.

While a9play takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, a9play will notify affected users and relevant authorities in accordance with applicable data breach notification obligations.

You are also responsible for maintaining the security of your a9play account. Please use a strong, unique password, enable two-factor authentication, and notify us immediately at [email protected] if you suspect unauthorised access to your account.

Subject to applicable law and regulatory retention obligations, you have the following rights in respect of your personal data held by a9play. To exercise any of these rights, contact us using the details in Section 16:

We will respond to data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

The a9play platform is strictly intended for individuals aged 21 years and above. a9play does not knowingly collect, process, or retain personal data of individuals under the age of 21. If we become aware that personal data belonging to a minor has been submitted to our platform, we will take immediate steps to close the associated account, delete the data, and — where applicable — report the incident to relevant authorities.

Age verification is conducted as part of the KYC process. All registered players are required to provide valid government-issued identity documents confirming they meet the minimum age requirement before full account functionality is enabled.

Parents, guardians, or individuals who have concerns about a minor potentially having accessed the a9play platform should contact us immediately at [email protected] so that the matter can be investigated and resolved promptly.

The a9play platform may contain references to third-party services, including game providers, payment method providers (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX), and responsible gambling resources. Where you interact with such third-party services, their own privacy policies will govern the processing of your personal data by those entities.

a9play is not responsible for the privacy practices of third-party service providers. We recommend that you review the privacy policy of any third-party service you use in connection with your a9play account, particularly your chosen payment provider.

Payment data shared with e-wallet and banking providers in connection with deposits or withdrawals is governed by the privacy policy and terms of service of the respective payment provider. a9play receives only the minimum data necessary to reconcile transactions and confirm successful payments.

a9play reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, regulatory requirements, or platform features. The "Last Updated" date at the top of this page will be updated whenever material changes are made.

Where changes are significant, a9play will use reasonable efforts to notify registered Players via email or in-platform notification. We encourage all users to review this Policy periodically so that they remain informed of how their personal data is being processed.

Your continued use of the a9play platform following the posting of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you should discontinue use of the platform and contact us to close your account.

For all privacy-related queries, data subject rights requests, complaints, or concerns regarding a9play's data processing practices, please contact us using the following details. We are committed to responding to all legitimate privacy enquiries promptly and transparently.