Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by m9play (hereinafter "m9play", "we", "us", or "our") and governs the collection, use, storage, disclosure, and protection of personal data relating to individuals who access or use the m9play online gaming platform at https://m9play.cam (hereinafter the "Platform"), including all associated subdomains, mobile applications, and software clients.

m9play takes the privacy and security of its players seriously. We are committed to handling all personal data lawfully, fairly, and transparently, consistent with internationally recognised data protection standards. This Policy applies to all registered users of the Platform, prospective users who interact with our website without registering, and individuals who contact us through any available communication channel.

By accessing the Platform, registering an Account, or otherwise interacting with m9play's services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, contact details, financial information, device identifiers, and behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" means the individual to whom the Personal Data relates — in the context of this Policy, typically a registered Player or website visitor.
• "Data Controller" means m9play, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of m9play under a written data processing agreement.
• "KYC Data" means identity and age verification documents submitted by a Player to satisfy m9play's Know Your Customer requirements, including government-issued identification and payment method verification.
• "Cookies" means small text files stored on a user's device by the Platform to enable session management, analytics, and personalisation features.

m9play collects personal data across several categories depending on the nature of the interaction. The table below summarises the principal categories of data collected:

m9play collects personal data through the following channels:

• Directly from You: When you register an Account, complete KYC verification, make a deposit or withdrawal, participate in promotions, contact customer support, or update your Account settings.
• Automatically via the Platform: Technical data including IP addresses, device identifiers, and session logs are collected automatically when you access or interact with the Platform. Cookies and similar tracking technologies also collect certain usage data as described in Section 11.
• From Third-Party Payment Providers: When you initiate a transaction using Touch 'n Go eWallet, Boost, DuitNow, FPX, or other payment methods, we receive transaction confirmation data from the relevant payment processor. We do not receive or store full card numbers or bank login credentials.
• From Identity Verification Services: For KYC purposes, m9play may use licensed third-party identity verification services that cross-reference submitted documents against authoritative databases.
• From Fraud Prevention and AML Services: m9play may receive risk signals or flags from licensed fraud detection and anti-money laundering service providers to protect the integrity of the Platform.

m9play processes personal data for the following specific and documented purposes:

• Account Management: Creating, maintaining, and administering Player Accounts, including authentication, password recovery, and Account security monitoring.
• KYC and Age Verification: Verifying that all Players are aged 21 or above and that their identity is consistent with the information provided at registration, in compliance with m9play's international licensing obligations.
• Payment Processing: Processing deposits, withdrawals, and refunds, including communication with payment service providers (Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, DuitNow, FPX, cryptocurrency processors).
• Service Delivery: Enabling access to gaming products, providing customer support, delivering promotional materials where consent has been given, and personalising the Platform experience.
• Anti-Money Laundering (AML) and Fraud Prevention: Monitoring transaction patterns and Account activity for indicators of money laundering, fraud, or prohibited conduct, and fulfilling mandatory reporting obligations where required.
• Responsible Gambling: Identifying Players who may be exhibiting signs of problematic gambling behaviour, implementing self-imposed limits, and facilitating self-exclusion requests.
• Legal and Regulatory Compliance: Retaining records to satisfy applicable AML regulations, gaming licence conditions, and any other legal obligations applicable to m9play's operations.
• Platform Improvement and Analytics: Aggregated, anonymised analysis of Platform usage to improve game offerings, user interface design, and service performance.
• Marketing Communications: Sending promotional offers, bonus notifications, and newsletters to Players who have provided explicit consent, with the ability to opt out at any time.

m9play processes personal data on the following legal bases, consistent with internationally recognised data protection standards:

• Contractual Necessity: Processing required to fulfil the contract between m9play and the Player (i.e., the Terms & Conditions), including Account creation, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC, AML, and gaming licence conditions.
• Legitimate Interests: Processing carried out for m9play's legitimate business interests, such as fraud prevention, Platform security, and aggregated analytics, where those interests are not overridden by the data subject's fundamental rights.
• Consent: Processing based on the Player's freely given, specific, and informed consent — primarily for marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

m9play does not sell or rent personal data to third parties. We may share personal data with the following categories of recipients, under strict contractual or legal obligations:

• Payment Service Providers: To process deposit and withdrawal transactions. Relevant providers include licensed e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), banking networks (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency processing services.
• Identity Verification and KYC Providers: Licensed third parties engaged to verify identity documents and cross-reference data against sanctions and watchlists for AML compliance purposes.
• Gaming Technology Providers: Game studios and platform software providers whose products are accessible via the Platform, for the purpose of managing player sessions and settling game outcomes. These providers are contractually prohibited from using Player data for any purpose other than delivering their services to m9play.
• Customer Support Technology: Third-party live chat and support ticket platforms used to manage Player support interactions.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or a lawful request from a competent regulatory authority, m9play may disclose personal data without prior notice to the Player.
• Professional Advisers: Lawyers, auditors, and insurers engaged by m9play who process data subject to professional confidentiality obligations.

As an international gaming platform, m9play operates servers and engages service providers in multiple jurisdictions. Personal data collected from Malaysian players may therefore be transferred to, stored in, and processed in countries outside Malaysia.

Where personal data is transferred internationally, m9play applies appropriate safeguards to ensure that the data receives a level of protection equivalent to that described in this Policy. Such safeguards may include: standard contractual clauses approved by the relevant supervisory authority; data processing agreements with service providers; and technical and organisational security measures.

By using the Platform, you acknowledge and consent to international transfers of your personal data as described in this section.

m9play retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual.

m9play implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between Players' devices and m9play's servers is encrypted using 256-bit SSL/TLS technology.
• Encryption at Rest: Personal data stored on m9play's servers is encrypted using industry-standard encryption algorithms.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Two-Factor Authentication (2FA): Players are offered 2FA for Account access. Internal administrative systems require 2FA as a mandatory control.
• Regular Security Audits: m9play engages independent third-party security specialists to conduct periodic penetration testing and vulnerability assessments of Platform infrastructure.
• Incident Response: m9play maintains a documented data breach response procedure. In the event of a breach affecting Player data, m9play will notify affected individuals and applicable authorities in accordance with applicable regulations.

m9play uses cookies and similar tracking technologies on the Platform for the purposes described below. By continuing to use the Platform, you consent to the use of cookies in accordance with this section.

• Strictly Necessary Cookies: Required for the Platform to function correctly, including maintaining your logged-in session, remembering items in your transaction flow, and enabling security features. These cannot be disabled without materially affecting Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised information about how visitors interact with the Platform — including pages visited, time on site, and error events. This data helps us improve Platform performance and user experience.
• Preference Cookies: Store your language, display, and notification preferences so you do not need to re-enter them on each visit.
• Marketing Cookies: Used to track the effectiveness of marketing campaigns and to limit the frequency of promotional messages displayed to you. These are only set with your consent.

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Note that disabling certain cookie types may impair Platform functionality. Detailed cookie settings are available through the Platform's Cookie Preferences panel.

Subject to applicable law and certain exceptions (including overriding legal obligations such as AML record-keeping requirements), you have the following rights with respect to your personal data held by m9play:

To exercise any of these rights, please contact our Data Protection team at the address provided in Section 15. m9play will respond to all valid data subject requests within 30 days. Where requests are complex or numerous, we may extend this period by a further 60 days with appropriate notification.

m9play's Platform and services are strictly for individuals aged 21 years and above. m9play does not knowingly collect personal data from persons under 21 years of age. The Platform includes age verification controls as part of the registration and KYC process.

If m9play becomes aware or has reasonable grounds to suspect that personal data has been collected from a person under 21, that Account will be immediately suspended, associated funds frozen, and the data deleted or quarantined pending investigation. Parents or guardians who believe that their child may have registered an Account are asked to contact us immediately using the details in Section 15.

m9play reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Last Updated" date at the top of this document will be revised accordingly.

Where changes are material — for example, where we introduce a new category of data processing or a new category of third-party recipient — m9play will provide advance notice to registered Players via the Platform notification system or by email to the registered Account address. Continued use of the Platform following the effective date of a material amendment constitutes acceptance of the revised Policy.

We encourage Players to review this Policy periodically to remain informed about how m9play protects and uses their personal data.

For all privacy-related enquiries, data subject requests, or complaints regarding m9play's handling of personal data, please contact us through the following channels:

• Data Privacy Enquiries — Email: [email protected] (plain text — not a clickable link) with the subject line "Privacy Request — [Your Username]"
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. For urgent data security concerns, live chat provides the fastest response.
• Response Time: m9play acknowledges all privacy enquiries within 2 business days and provides a substantive response within 30 days.

If you are not satisfied with m9play's response to a privacy concern, you retain the right to escalate the matter to the applicable data protection supervisory authority in your jurisdiction.