9win ("we", "us", "our", "the Company") operates the online gaming and sports betting platform accessible at https://9win.casa and all associated sub-domains, mobile interfaces, and digital properties (collectively, the "Platform"). We are committed to protecting and respecting the privacy of all individuals who interact with our Platform.
This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be collected, processed, stored, and disclosed. It applies to all Members, prospective Members, and visitors to the Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and elsewhere in Malaysia.
This Policy should be read alongside our Terms and Conditions and Responsible Gambling Policy, which together form the complete framework governing your relationship with 9win. By registering an Account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
9win will never sell, rent, or commercially transfer your personal data to third-party advertising networks or unrelated organisations. Your data is processed solely for the purposes of operating the Platform, fulfilling our regulatory obligations, and improving the services we provide to you.
For the purposes of this Privacy Policy, the following defined terms apply:
- "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers such as IP addresses and device identifiers.
- "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, consultation, use, transmission, erasure, or destruction.
- "Data Controller" means 9win, the entity that determines the purposes and means by which your Personal Data is processed.
- "Data Processor" means any third party that processes Personal Data on behalf of and under instruction from 9win.
- "Member" / "User" / "you" means any natural person who has registered an Account on the Platform or is otherwise using or visiting the Platform.
- "KYC Data" means identity verification documentation collected in connection with 9win's Know Your Customer obligations, including but not limited to government-issued ID, proof of address, and selfie verification.
- "Cookies" means small text files placed on your device by the Platform for authentication, session management, analytics, and functional purposes.
- "Sensitive Personal Data" means categories of data requiring heightened protection, including financial account details, government identification numbers, and biometric data.
9win collects the following categories of Personal Data from Members and Platform users. Data collection is limited to what is necessary for the purposes described in Section 5 of this Policy (data minimisation principle).
| Data Category | Examples | Basis for Collection |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, MyKad / passport number | Account registration; KYC compliance |
| Contact Data | Email address, mobile phone number, residential address (city, postcode, state) | Account communication; verification |
| Financial Data | Payment method details (e-wallet IDs, bank account numbers), deposit and withdrawal history, transaction amounts in MYR | Payment processing; AML compliance |
| KYC Documentation | Government-issued photo ID, proof of address (utility bill / bank statement ≤3 months), selfie with ID | Regulatory obligation; fraud prevention |
| Account Data | Username, encrypted password hash, account settings, bonus balances, VIP tier status, session history | Platform operation; Member services |
| Gaming & Wagering Data | Bet history, game selections, wager amounts, win/loss records, game duration, RTP statistics | Responsible gambling monitoring; service improvement |
| Technical Data | IP address, device type, browser type and version, operating system, geolocation (country/region level), cookie identifiers | Security; fraud detection; analytics |
| Communications Data | Live chat transcripts, email correspondence, support ticket records, survey responses | Customer support; service quality |
| Marketing Preferences | Opt-in/opt-out status for promotional emails, SMS notifications, and push notifications | Consent-based marketing communications |
9win collects only the minimum Personal Data required for each specific processing purpose. We do not collect data "just in case" and we do not process categories of Sensitive Personal Data beyond what is necessary for KYC, fraud prevention, and regulatory compliance.
9win collects Personal Data through the following methods and touchpoints:
4.1 Data Provided Directly by You
- Information you submit during account registration, including your name, date of birth, email address, phone number, and Malaysian residential address.
- KYC verification documents you upload in response to identity verification requests.
- Financial information you provide when making deposits or requesting withdrawals via payment methods such as Touch'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Boost, or GrabPay.
- Communications you send to us through live chat, email, or any other support channel.
- Responses to surveys, promotions, or feedback requests.
- Information you provide when setting responsible gambling preferences, including deposit limits, session time limits, or self-exclusion requests.
4.2 Data Collected Automatically
- Technical data collected when you access the Platform, including IP address, device identifiers, browser characteristics, and session duration.
- Cookies and similar tracking technologies as described in Section 11 of this Policy.
- Gaming activity data generated automatically as you interact with games, place wagers, and conduct transactions on the Platform.
- Access logs recording pages visited, features used, time spent on-Platform, and navigation patterns.
4.3 Data Received from Third Parties
- Identity and fraud risk data from KYC verification service providers used to cross-validate documents submitted by Members.
- Transaction confirmation data from payment service providers and financial institutions, including Malaysian banks and e-wallet operators.
- Sanctions screening data from licensed third-party AML screening services used to comply with anti-money laundering obligations.
- Referal data where a new Member account is created via a referral link originating from an existing 9win Member.
9win processes Personal Data only for specified, explicit, and legitimate purposes. The following table outlines our primary processing activities, the purpose of each, and the legal basis on which we rely:
| Processing Purpose | Legal Basis |
|---|---|
| Account registration and management | Performance of contract (membership agreement) |
| Identity verification (KYC) and age verification (21+) | Legal obligation; legitimate interests (fraud prevention) |
| Processing deposits and withdrawals in MYR | Performance of contract; legal obligation (AML) |
| Anti-money laundering (AML) and sanctions screening | Legal obligation |
| Responsible gambling monitoring and intervention | Legal obligation; legitimate interests (player protection) |
| Customer support and dispute resolution | Performance of contract; legitimate interests |
| Platform security, fraud detection, and abuse prevention | Legitimate interests |
| Analytics and platform improvement | Legitimate interests (aggregated/anonymised data) |
| Promotional communications and bonus notifications | Consent (where required); legitimate interests |
| Compliance with legal and regulatory obligations | Legal obligation |
Where processing is based on consent, you retain the right to withdraw that consent at any time by updating your preferences in your Account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
9win does not sell, rent, lease, or commercially transfer your Personal Data to third parties. Data is shared only in the limited circumstances described below, and only with parties who are contractually bound to protect your data to at least the same standard as9win.
6.1 Service Providers (Data Processors)
9win engages third-party service providers who process data strictly on our instruction. These include:
- Payment processors and financial institutions — including Malaysian e-wallet operators (Touch 'n Go, Boost, GrabPay), banks (Maybank, CIMB, Public Bank, Hong Leong), and payment infrastructure providers (DuitNow, FPX). Data shared is limited to what is necessary to process your deposit or withdrawal.
- KYC and identity verification providers — licensed third-party services that validate the authenticity of government-issued documents and cross-reference identity data against fraud watchlists.
- AML and sanctions screening services — platforms used to screen Member data against legally mandated sanctions lists and politically exposed persons (PEP) databases.
- Cloud infrastructure and hosting providers — data centre and cloud providers responsible for the storage and processing infrastructure underlying the Platform. All providers are contractually required to maintain equivalent data protection standards.
- Customer support platform providers — third-party live chat and ticket management systems used to deliver24/7 Member support.
- Analytics providers — services used to analyse Platform usage patterns using aggregated and, where possible, anonymised data to improve user experience.
6.2 Regulatory and Legal Disclosure
9win may disclose Personal Data to regulatory authorities, law enforcement agencies, courts, or government bodies where required to do so by law or where disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of 9win; (c) prevent or investigate possible wrongdoing in connection with the Platform; or (d) protect the personal safety of Platform users or the public.
6.3 Business Transfers
In the event that9win undergoes a merger, acquisition, restructuring, or asset sale, Personal Data held about Members may be transferred to the successor entity as part of that transaction. You will be notified via the Platform or by email prior to any such transfer, and the successor entity will be bound by privacy obligations at least equivalent to those in this Policy.
9win does not share your Personal Data with third-party advertisers, data brokers, or affiliate marketing networks for the purpose of targeted advertising. Your gaming preferences and betting behaviour are never disclosed to external commercial entities.
Some of9win's service providers operate infrastructure located outside Malaysia. Where your Personal Data is transferred to, or processed in, a jurisdiction outside Malaysia, 9win takes reasonable steps to ensure that equivalent levels of data protection apply, including through the use of contractual data protection agreements with third-party processors.
9win will not transfer your Personal Data internationally except where: (a) it is necessary for the performance of the contract between you and 9win; (b) the transfer is subject to appropriate safeguards; or (c) you have provided explicit consent to the transfer.
Payment processing data shared with Malaysian financial institutions — including Maybank, CIMB, Public Bank, and e-wallet operators such as Touch 'n Go — is processed within Malaysia's financial infrastructure and is governed by the applicable Malaysian financial data protection framework.
9win retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulation. The following general retention guidelines apply:
- Active Account Data: Retained for the duration of the Member's active Account relationship with 9win, plus an additional period as required for legal compliance.
- KYC and Identity Documentation: Retained for a minimum of five (5) years following account closure or the last transaction, in accordance with anti-money laundering record-keeping obligations.
- Financial Transaction Records: Retained for a minimum of seven (7) years following the date of the transaction, consistent with applicable financial regulation and audit requirements.
- Gaming Activity Logs: Retained for a minimum of three (3) years for responsible gambling monitoring and dispute resolution purposes.
- Customer Support Records: Retained for three (3) years following the resolution of each enquiry or complaint.
- Marketing Consent Records: Retained until consent is withdrawn and for a period thereafter sufficient to demonstrate compliance.
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Data that has been anonymised may be retained indefinitely for statistical and analytical purposes.
9win implements and maintains a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:
- Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS (Transport Layer Security) with a minimum of 256-bit encryption. HTTPS is enforced across all pages and API endpoints.
- Encryption at Rest: Sensitive data stored in our databases — including KYC documentation, financial records, and password credentials — is encrypted at rest using industry-standard encryption algorithms.
- Password Security: Passwords are never stored in plain text. Only irreversible cryptographic hashes are retained. 9win will never ask for your password via email or live chat.
- Two-Factor Authentication (2FA): Members are encouraged and, in certain circumstances, required to enable 2FA on their accounts. 9win staff accounts require mandatory 2FA.
- Access Controls: Access to Personal Data within9win's internal systems is restricted on a strict need-to-know basis using role-based access controls (RBAC).
- Intrusion Detection: Real-time monitoring systems detect and alert on suspicious access patterns, unusual transaction behaviour, and potential security incidents.
- Security Audits: 9win conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in the Platform infrastructure.
Notwithstanding these measures, no internet-based system can guarantee absolute security. In the event of a data breach that poses a significant risk to Members' rights and freedoms, 9win will notify affected Members promptly and take all reasonable steps to contain and remediate the incident.
If you believe your 9win account has been compromised or you wish to report a suspected data security issue, please contact our support team immediately via live chat or email at [email protected]. We take all security reports seriously and will investigate promptly.
As a data subject, you have a number of rights in relation to the Personal Data 9win holds about you. These rights may be subject to certain limitations under applicable law, particularly in the context of our legal and regulatory obligations (such as AML record-keeping requirements). To exercise any of the rights below, please contact our Data Protection team at [email protected] or via live chat.
Right of Access
You have the right to request a copy of the Personal Data 9win holds about you, along with information about how it is processed. Requests are typically fulfilled within 30 days.
Right to Rectification
If any Personal Data we hold is inaccurate or incomplete, you have the right to request that it be corrected. You can update many account details directly via your Account settings.
Right to Erasure
In certain circumstances, you have the right to request that we delete your Personal Data. This right does not apply where data is required to be retained for legal or regulatory compliance purposes.
Right to Restrict Processing
You may request that we restrict the processing of your Personal Data in specific circumstances — for example, while the accuracy of data is being disputed.
Right to Data Portability
Where technically feasible and where processing is based on consent or contract, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
Right to Object
You have the right to object to processing of your Personal Data where that processing is based on legitimate interests, including the use of your data for analytical or profiling purposes.
All data rights requests will be acknowledged within 5 business days and resolved within 30 calendar days of receipt. In cases of complexity or volume, we may extend this period by a further 30 days, in which case we will notify you in writing.
9win uses cookies and similar technologies to operate improve the Platform, maintain session security, and understand how Members use our services. Cookies are small text files placed on your device by the Platform when you visit.
The Platform uses the following categories of cookies:
- Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without impairing Platform functionality.
- Functional Cookies: Remember your preferences and settings — including preferred language, notification settings, and responsible gambling tool configurations — to personalise your experience across sessions.
- Analytical / Performance Cookies: Collect aggregated, anonymised information about how users navigate the Platform, which pages are visited most frequently, and where technical errors occur. This data is used to improve Platform performance and user experience.
- Security Cookies: Used to detect and prevent fraudulent activity, including multiple-account creation attempts, abnormal session behaviour, and credential stuffing attacks.
You can control non-essential cookies through your browser settings. However, disabling strictly necessary cookies may prevent certain features of the Platform from working correctly.9win does not use third-party advertising cookies or cross-site tracking technologies for marketing purposes.
The 9win Platform is strictly intended for persons aged21 years and above. 9win does not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered Members.
If 9win becomes aware that Personal Data has been collected from a person under the age of 21, that data will be immediately deleted and the associated Account will be permanently closed. Any wagers placed or winings accumulated by an underage user are void and non-withdrawable.
If you are a parent or guardian and believe that a minor in your care has registered an Account with 9win, please contact us immediately at [email protected] so that we may take appropriate action without delay. For tools prevent underage access to gambling content, please visit our Responsible Gambling page.
The Platform may contain references to third-party services, including Malaysian payment providers, identity verification services, and game content suppliers. When you interact with these services — for example, by initiating a DuitNow or FPX transfer — you will be subject to those providers' own privacy policies and terms.
9win is not responsible for the privacy practices or content of any third-party services accessed through the Platform. We encourage Members to review the privacy policies of all third-party services they interact with, particularly payment and banking services.
9win reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform functionality. Where changes are material, we will provide advance notice to Members via on-Platform notification, email, or a prominent notice on the homepage.
Continued use of the Platform following the effective date of any revised Privacy Policy constitutes acceptance of the updated terms. The effective date at the top of this page reflects the date of the most recent revision. We recommend that Members review this Policy periodically.
If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 10, or wish to make a complaint about how9win has handled your Personal Data, please contact us through the following channels:
This Privacy Policy was last updated on 1 January 2026 and is effective from that date. By continuing to use the 9win Platform, you acknowledge that you have read and accepted the terms of this Policy.