Privacy Policy — a9member

This Privacy Policy ("Policy") is issued by a9member ("the Company", "we", "our", "us"), the operator of the online gaming and sports betting platform accessible at https://a9member.cam (the "Platform"). It governs the collection, use, storage, disclosure, and protection of personal data relating to registered members, prospective members, and visitors to the Platform ("you", "your", "Data Subject").

a9member is committed to handling all personal data with integrity and in compliance with applicable data protection principles. This Policy has been drafted to reflect international best practice in data privacy, including the principles embodied in Malaysia's Personal Data Protection Act 2010 (PDPA), where applicable, as well as equivalent international frameworks.

By registering for an account, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree, please discontinue your use of the Platform and contact us to request account closure.

In this Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, combination, restriction, or deletion.
• "Data Controller" means a9member, which determines the purposes and means of processing personal data collected via the Platform.
• "Data Processor" means any third party engaged by a9member to process personal data on its behalf, including payment gateway providers and KYC verification services.
• "Sensitive Personal Data" means data that warrants heightened protection, including identity document numbers (e.g., MyKad), financial account details, and biometric verification data.
• "Cookies" means small text files stored on your device by the Platform to facilitate functionality and analytics.
• "KYC" means Know Your Customer — the identity verification process required prior to processing withdrawals or upon reaching deposit thresholds.

a9member collects personal data in the following categories. We collect only what is genuinely necessary for the purposes described in this Policy:

We do not collect special-category sensitive data (such as health information, racial or ethnic origin, or political opinions) except where expressly required by applicable law or voluntarily provided by you in a support context.

a9member collects personal data through the following channels:

• Directly from you: When you register, complete KYC verification, make a deposit or withdrawal, contact support, or respond to surveys.
• Automatically: Via cookies, web beacons, server logs, and similar technologies during your use of the Platform — including IP address, device data, and session activity.
• From third-party verification services: Identity and document verification providers may return verification results and flags to us as part of the KYC process.
• From payment processors: Our payment gateway partners — including those handling Touch 'n Go eWallet, DuitNow, FPX, and other Malaysian payment methods — may share transaction confirmation data with us.

a9member processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your member account, including balance management in MYR, password resets, and account security.
• Identity Verification (KYC): To verify your age (21+ requirement) and identity in accordance with applicable anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• Payment Processing: To facilitate deposits and withdrawals via Malaysian banking and e-wallet channels, including Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency methods.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and other prohibited conduct.
• Responsible Gambling Monitoring: To monitor gaming patterns, enforce self-exclusion and deposit limit requests, and identify players who may be displaying signs of problematic gambling behaviour.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from competent authorities, and maintain required records.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions.
• Service Improvement: To analyse Platform usage, identify technical issues, and improve the user experience for Malaysian players.
• Marketing Communications: Where you have opted in, to send promotional offers, bonus notifications, and platform updates. You may withdraw consent at any time.

a9member relies on the following legal bases for processing your personal data, depending on the specific purpose:

• Contractual Necessity: Processing required to perform our obligations under the Terms and Conditions you accepted upon registration — including account operation, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable law, including KYC/AML obligations, record-keeping requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out for our legitimate business interests — including fraud prevention, security monitoring, and service improvement — where those interests are not overridden by your fundamental rights.
• Consent: Processing for optional purposes where you have provided explicit, freely given, and revocable consent — such as receiving marketing communications or participating in optional surveys.

Where we rely on consent as the legal basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

a9member does not sell or commercially share your personal data with third parties. Disclosure of personal data is limited to the following categories of recipients, and only to the extent strictly necessary:

• Payment Service Providers: Banks and e-wallet operators (including Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency processing services) receive the minimum data required to process your transactions.
• Identity Verification Services: Third-party KYC and document verification providers receive identity documents and personal data submitted during the KYC process. These providers are contractually bound to process data solely for verification purposes.
• Fraud Prevention and AML Services: Specialist providers who screen transactions and account activity for potential fraud, money laundering, or sanctions risks.
• Technology Service Providers: Cloud hosting, data storage, and platform infrastructure providers who process data on our behalf under strict data processing agreements.
• Legal and Regulatory Authorities: Competent government authorities, regulatory bodies, law enforcement agencies, or courts, where disclosure is required by law, court order, or regulatory obligation.
• Professional Advisers: Legal counsel, auditors, and compliance consultants, bound by professional confidentiality obligations, where necessary for business operations.

As an internationally operated platform, some of the third-party service providers engaged by a9member may be located in jurisdictions outside Malaysia. Where personal data is transferred outside Malaysia, a9member takes steps to ensure that an equivalent level of data protection is maintained, including:

• Entering into data transfer agreements with recipient organisations that incorporate internationally recognised data protection clauses.
• Transferring data only to jurisdictions that have been assessed as providing adequate data protection standards.
• Applying contractual and technical safeguards to minimise the risk of unauthorised access during transfer.

You may request information about the specific safeguards applied to international transfers of your personal data by contacting us using the details in Section 15.

a9member retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised and aggregated data (from which individuals cannot be identified) may be retained indefinitely for statistical and analytical purposes.

The a9member Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. Cookies do not contain your financial data or password — they are small text files stored by your browser.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens, and your login state. These cannot be disabled without breaking core Platform functionality.
• Performance and Analytics Cookies: Collect anonymised data on how visitors use the Platform — pages visited, time spent, and error messages encountered. This data helps us improve the Platform experience for Malaysian users.
• Functional Cookies: Remember your preferences such as language (English), display settings, and notification preferences across sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, including detecting unusual login patterns across different locations such as Kuala Lumpur, Penang, and Johor Bahru.

You can control cookie settings through your browser preferences. Please note that disabling certain cookies may impact the functionality of the Platform. We do not use third-party advertising or behavioural tracking cookies.

Subject to applicable law, you hold the following rights in respect of your personal data held by a9member. To exercise any of these rights, contact our support team (see Section 15). We will respond within 30 calendar days of receipt of a valid request.

The a9member Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory component of our KYC process, and any account found to have been opened by a person under 21 will be immediately closed and any funds returned.

If you believe that a minor has registered an account on our Platform, please notify us immediately via live chat or at [email protected]. We will investigate and take appropriate action without delay.

a9member implements a layered security architecture to protect your personal data against unauthorised access, loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using industry-standard TLS protocols.
• Password Hashing: Account passwords are hashed using a strong one-way algorithm. We do not store passwords in plain text and are unable to retrieve your password — only reset it.
• Payment Tokenisation: Payment method details are tokenised and handled by certified payment processors. a9member does not store raw card or bank account numbers.
• Two-Factor Authentication (2FA): Optional but strongly recommended additional verification layer available for all accounts.
• Access Controls: Internal access to personal data is governed by role-based access controls, with all access logged and subject to periodic audit.
• Penetration Testing: Our platform and infrastructure undergo regular security assessments to identify and remediate vulnerabilities.
• Incident Response: We maintain a documented data breach response plan. In the event of a breach that poses a risk to your rights, we will notify you and relevant authorities within the applicable regulatory timeframe.

While we take all reasonable precautions, no system is entirely immune to security risks. You also play a role in keeping your account secure: use a strong, unique password, do not share your credentials, and contact us immediately if you suspect unauthorised access to your account.

a9member reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

For material changes that significantly affect your rights or the way we process your data, we will provide advance notice via the Platform homepage or by email to your registered address. Your continued use of the Platform following the effective date of any updated Policy constitutes acceptance of the revised terms.

We recommend revisiting this page periodically. If you have concerns about any change, you are welcome to contact us using the details provided in Section 15 before the revised Policy takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by a9member, please contact our Data Protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available on the Platform during operating hours (9:00 AM – 12:00 AM MYT, GMT+8)

Please mark your correspondence clearly as a "Privacy Request" or "Data Subject Rights Request" so that it is routed to the appropriate team. We aim to acknowledge all privacy requests within three (3) business days and to provide a substantive response within thirty (30) calendar days of receipt of a complete and valid request.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. Malaysian residents may contact the Department of Personal Data Protection (JPDP) for guidance on exercising rights under the Personal Data Protection Act 2010.