Privacy Policy — svip9

01 Introduction

This Privacy Policy (hereinafter referred to as the "Policy") sets out the practices of svip9 (hereinafter referred to as the "Platform", "Operator", "we", "us", or "our") with respect to the collection, use, storage, disclosure, and protection of personal data provided by or collected from users (hereinafter referred to as "Players", "Users", or "you") of the svip9 website accessible at svip9.click and all associated mobile-optimised interfaces and gaming applications.

By accessing, registering on, or continuing to use the svip9 platform, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue your use of the platform immediately and contact our support team to request account closure and data handling instructions.

02 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information that identifies or can be used to identify an individual, including but not limited to name, date of birth, email address, phone number, residential address, financial account details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, disclosure, or erasure.
• "Data Controller" — svip9, as the entity that determines the purposes and means of processing Personal Data collected via the platform.
• "Data Processor" — any third party that processes Personal Data on behalf of svip9 under a data processing agreement, such as payment gateway operators and KYC verification service providers.
• "KYC Data" — identity and address verification documents collected during the Know Your Customer process, including government-issued identification and proof of address.
• "Cookies" — small text files stored on a User's device by the platform for session management, analytics, and fraud prevention purposes.
• "Third Party" — any entity other than the Player and svip9 that may receive or process Personal Data under the terms described in this Policy.

03 Data We Collect

svip9 collects personal data through multiple touchpoints during the course of the account registration, verification, gaming, and customer support processes. The categories of data collected are set out below.

3.1 Registration Data

When you create an account with svip9, you are required to provide the following information:

• Full legal name as shown on your government-issued identification;
• Date of birth (for mandatory age verification — minimum 21 years);
• Email address and mobile phone number;
• Residential address, including city and postcode;
• Preferred username and account password (stored in encrypted form).

3.2 KYC Verification Data

To comply with our Anti-Money Laundering (AML) obligations and to verify your identity and age, we collect and retain the following documentation:

• Scanned or photographed copies of government-issued photo identification (e.g., Malaysian MyKad, passport, or driving licence);
• Proof of residential address dated within the preceding three months; and
• Where applicable, evidence of ownership of the payment method used for deposits.

3.3 Transaction and Financial Data

We collect and retain data related to your financial interactions with the platform, including:

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• Wallet balance history and gaming account ledger entries; and
• Partial payment instrument identifiers (e.g., last four digits of a registered bank account or e-wallet account number) — full financial credentials are never stored on our servers.

3.4 Technical and Behavioural Data

The platform automatically collects certain technical and usage data when you access svip9, including:

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser version;
• Session duration, pages visited, and in-platform navigation patterns;
• Game session logs, betting history, and wagering records.

3.5 Customer Support Communications

Any information you share with our support team via Live Chat, WhatsApp, WeChat, or email — including the content of your messages and any attachments submitted — is recorded and retained for quality assurance, dispute resolution, and regulatory compliance purposes.

04 How We Use Your Data

svip9 processes your personal data only for the purposes set out below. We do not engage in automated decision-making that produces legal or similarly significant effects on Players without human review being available upon request.

Purpose	Data Used	Legal Basis
Account registration and management	Registration data, device data	Contract performance
Age and identity verification (KYC)	KYC documentation, registration data	Legal obligation
Processing deposits and withdrawals	Transaction data, payment instrument references	Contract performance
AML and fraud prevention monitoring	Transaction data, behavioural data, KYC data	Legal obligation
Delivering gaming services	Account data, game session logs	Contract performance
Customer support and dispute resolution	Support communications, account data	Contract performance / Legitimate interests
Platform analytics and performance improvement	Technical data, behavioural data (anonymised)	Legitimate interests
Responsible gambling monitoring	Gaming activity data, deposit and loss records	Legal obligation / Legitimate interests
Promotional and loyalty communications	Email address, account tier, opt-in status	Consent

05 Legal Basis for Processing

svip9 processes your personal data on the following legal grounds, depending on the specific purpose of the processing activity:

1. Contract Performance — processing is necessary to fulfil our contractual obligations to you as a registered Player, including account maintenance, game delivery, and payment processing.
2. Legal Obligation — processing is required for compliance with applicable AML regulations, KYC requirements, responsible gambling obligations, and any reporting duties imposed by our operating licence.
3. Legitimate Interests — processing is necessary for our legitimate business interests in operating a secure, reliable, and commercially sustainable platform, where these interests are not overridden by your fundamental rights and freedoms.
4. Consent — for specific processing activities such as promotional communications, we rely on your freely given, informed, and unambiguous consent. You may withdraw consent at any time by contacting our support team or updating your account communication preferences.

06 Data Sharing & Disclosure

svip9 does not sell, rent, or commercially transfer your personal data to third parties for their own marketing purposes. We may share your data in the following limited circumstances:

6.1 Authorised Service Providers

We engage trusted third-party service providers who process personal data on our behalf under written data processing agreements, including:

• Payment processors and gateway operators — to facilitate deposits and withdrawals via DuitNow, FPX, e-wallets, and Malaysian bank transfers;
• KYC and identity verification providers — to authenticate identity documents submitted during account verification;
• Fraud detection and AML screening services — to monitor transactions for suspicious activity; and
• Cloud infrastructure and hosting providers — to store and serve platform data under contractual security standards.

6.2 Regulatory and Legal Disclosures

svip9 may be required to disclose personal data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where such disclosure is mandated by applicable law, regulatory directive, court order, or where disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

6.3 Business Transfers

In the event of a merger, acquisition, or transfer of all or part of svip9's business assets, personal data held on registered Players may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer in advance, where practicable, and the receiving entity will be required to honour the commitments in this Policy.

07 Data Retention

svip9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by our operating licence and applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data — retained for the duration of the account relationship and for a period of no less than five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC documentation — retained for a minimum of five (5) years from the date of last account activity or account closure, whichever is later.
• Transaction records — retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications — retained for a minimum of two (2) years from the date of the interaction.
• Technical and analytics data — retained in anonymised or aggregated form indefinitely for platform improvement purposes; identifiable technical data is purged within twelve (12) months of collection.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders re-identification impossible.

08 Cookies & Tracking Technologies

svip9 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you access the site. We use the following categories of cookies:

• Strictly Necessary Cookies — required for the platform to function correctly, including maintaining your logged-in session state and processing in-platform transactions. These cannot be disabled without affecting core platform functionality.
• Performance and Analytics Cookies — used to collect aggregated, anonymised data about how Players navigate and use the platform, enabling us to identify areas for improvement. No personally identifiable information is transmitted via these cookies.
• Security Cookies — used to detect and prevent fraudulent login attempts, multi-account creation, and other platform abuse patterns.

09 Data Security

svip9 implements a range of technical, physical, and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure:

• Encryption — all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. Account passwords are hashed and salted using industry-standard cryptographic algorithms and are never stored in recoverable plain-text form.
• Access Controls — access to personal data is restricted to authorised svip9 personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Infrastructure Security — our servers are hosted in facilities with physical access controls, environmental monitoring, and 24/7 security operations.
• Incident Response — svip9 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected Players and relevant authorities in accordance with applicable regulatory obligations.

While svip9 takes all reasonable precautions to protect your data, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You use the platform at your own risk and should take personal precautions to protect your account credentials.

10 Your Data Rights

Subject to applicable legal exceptions, you have the following rights with respect to your personal data held by svip9:

1. Right of Access — you may request a copy of the personal data we hold about you, including a description of the categories of data, the purposes for which it is processed, and the recipients to whom it has been disclosed.
2. Right to Rectification — if you believe that any personal data we hold is inaccurate or incomplete, you may request that it be corrected. Corrections to KYC-related data will require submission of updated documentation.
3. Right to Erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, provided that no overriding legal retention obligation applies. Note that AML and KYC data is subject to mandatory minimum retention periods that take precedence over erasure requests.
4. Right to Restrict Processing — in certain circumstances, you may request that we restrict the processing of your data, for example while the accuracy of data you have contested is being verified.
5. Right to Data Portability — where processing is based on your consent or on contract performance, you may request that we provide your personal data in a structured, commonly used, and machine-readable format.
6. Right to Withdraw Consent — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
7. Right to Object — you may object to the processing of your data where that processing is carried out on the basis of our legitimate interests, subject to any overriding legitimate grounds we may have for continuing the processing.

To exercise any of the rights listed above, please contact our support team via Live Chat or email at [email protected]. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. We may request that you verify your identity before processing a data rights request.

11 Minors & Age Restriction

The svip9 platform is strictly for use by individuals who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by an individual who does not meet the minimum age requirement, we will immediately suspend the relevant account, delete all associated personal data, and return any deposited funds subject to completion of necessary AML checks.

12 International Data Transfers

As an internationally operated platform, svip9 may transfer personal data to servers or service providers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your personal data, including:

• Contractual data protection clauses binding the receiving party to equivalent data protection standards;
• Transfer to jurisdictions that provide an adequate level of data protection as determined by applicable data protection authorities; or
• Other lawful transfer mechanisms available under applicable data protection law.

You may request further information about the specific safeguards applied to international data transfers by contacting our support team.

13 Amendments to this Policy

svip9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable data protection law, regulatory requirements, or our internal data processing practices. Material changes will be communicated to registered Players via the email address associated with their account and/or via a prominent notice on the platform homepage. The "Effective Date" shown at the top of this Policy reflects the date of the most recent revision.

Your continued use of the svip9 platform following the posting of an updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. We encourage you to review this Policy periodically to remain informed about how we protect your personal data.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which svip9 handles your personal data, please contact us through the following channels:

• Live Chat — available 24 hours a day, 7 days a week, directly within the platform interface. Live Chat is the fastest channel for all data rights requests, account queries, and privacy concerns. Our English, Bahasa Melayu, and Chinese-speaking agents are on standby around the clock.
• Email — for formal written data protection enquiries, you may contact us at [email protected]. Please note that this email address is provided for written correspondence only and is not a clickable link.

We aim to acknowledge all written data protection enquiries within 2 business days and to provide a substantive response within 30 calendar days. For urgent account or security concerns, Live Chat remains the recommended contact channel.