S9MY Privacy Policy — Your Personal Data Protection

To ensure a safe, fair, and enjoyable gaming experience, s9my collects various categories of information from our members. This information is collected directly from you, automatically through our technology, or from trusted third-party sources.

For identity verification (KYC) as required by law, we may request additional documents such as a copy of your Malaysian identity card (MyKad), recent bank statement, or proof of residential address. These documents are submitted through fully encrypted channels and stored with the highest security protection.

All information collected by s9my is used for legitimate and transparent purposes. We do not use your data for unrelated purposes without first obtaining your consent. The following are the primary purposes for data use:

• Account Management: Creating, verifying, and managing your account; processing registration and login; confirming your identity through mandatory KYC procedures.
• Transaction Processing: Processing deposits, withdrawals, and bonus payments quickly and accurately; generating transaction records for accounting and internal audit purposes.
• Platform Security: Detecting and preventing fraud, money laundering, bot activity, and account intrusion attempts; monitoring suspicious usage patterns in real time.
• Customer Support: Responding to inquiries, resolving complaints, and providing technical assistance; maintaining communication records for quality assurance purposes.
• Experience Personalization: Recommending games based on your preferences; tailoring promotional content relevant to your gaming habits.
• Legal Compliance: To fulfill obligations under the PDPA, anti-money laundering laws (AMLA), and the reporting requirements of relevant regulatory bodies.
• Platform Improvement: Analyzing usage data in aggregate and anonymized form to develop new features and improve the performance of the s9my platform.

S9MY does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. However, in the context of legitimate platform operations, we may share certain information with the following parties:

• Payment Providers: Authorized payment processing platforms such as FPX, Touch 'n Go, GrabPay, and Boost, solely for processing deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Technology Service Providers: Cloud infrastructure and cybersecurity companies that support our platform operations, subject to data processing agreements compliant with PDPA.
• Identity Verification Providers: Certified third-party KYC services to ensure identity verification processes meet regulatory standards.
• Legal Authorities: Law enforcement agencies, regulatory bodies, or courts when we are required to do so by Malaysian law or a valid court order.
• Merger or Acquisition: If s9my is involved in any business transaction such as a merger or acquisition, user data may be transferred as part of the business assets, subject to notification to affected members.

In all of the above sharing scenarios, s9my ensures that recipients have adequate security and privacy protections in place, and receive only the minimum information necessary for the specific purpose.

The s9my platform uses cookies and similar tracking technologies to enhance user experience, analyze traffic, and maintain session security. Cookies are small data files stored on your device when you visit our website.

We use three main categories of cookies:

• Essential Cookies: Required for core platform operations, including login session management, security verification, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies: Used to analyze how members use the platform, identify the most frequently visited pages, and detect technical errors. This data is collected anonymously and used solely for platform improvement.
• Functional Cookies: Allows the platform to remember your preferences such as language, display settings, and game preferences to deliver a more personalized experience.

You can manage or disable cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of some parts of the platform. For detailed guidance on managing cookies, refer to your web browser's help section.

S9MY continuously invests in advanced security infrastructure to ensure your personal data remains protected at all times. The technical and organizational security measures we implement include:

• 256-bit SSL/TLS Encryption: All communications between your device and s9my's servers are fully encrypted using the highest encryption standards, ensuring no third party can intercept or read your data in transit.
• Multi-Layer Firewall: Our infrastructure is protected by an actively managed firewall system, with access rules regularly updated to address the latest security threats.
• Two-Factor Authentication (2FA): s9my members can — and are encouraged to — enable two-factor authentication for an added layer of security during the login process.
• 24/7 Monitoring: A real-time threat detection system monitors our platform around the clock to identify and neutralize any unauthorized access attempts.
• Employee Access Controls: Internal access to member personal data at s9my is restricted on a need-to-know basis, with audit logs tracking every access.
• Regular Penetration Testing: We conduct regular security testing by independent experts to identify and address any vulnerabilities before they can be exploited.

While s9my takes all reasonable steps to protect your data, no system can guarantee absolute security. You also play an important role by keeping your password confidential, using a secure internet connection, and promptly reporting any suspicious activity on your account.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal information we hold:

• Right of Access: You have the right to know whether s9my holds your personal data and to request a copy of that information in a readable format.
• Right to Rectification: If any personal information we hold is inaccurate or incomplete, you have the right to request correction without undue delay.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data, except where retention is required to fulfill legal obligations or resolve outstanding disputes.
• Right to Restriction of Processing: You may request that s9my restrict the processing of your data under certain circumstances, such as when you are disputing the accuracy of the data.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format for transfer to another data processor.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time, and s9my will cease processing for that purpose immediately.

To exercise any of the rights above, please contact our privacy team via email at [email protected] or via the in-platform live chat. We will endeavor to respond to all requests within 30 calendar days of receipt.

We may require you to verify your identity before processing any personal data requests, to ensure the security and confidentiality of your information.

S9MY retains your personal data only for as long as necessary to fulfill the purpose for which it was collected, including compliance with any legal, accounting, or reporting requirements. The following are general guidelines for our retention periods:

• Active Account Data: Retained for as long as your account remains active. Upon account closure, data is kept for 7 years for anti-money laundering legal compliance purposes.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with the Financial Services Act 2013 and Malaysian tax laws.
• Support Communication Logs: Retained for 3 years for quality assurance and dispute resolution purposes.
• Technical Log Data: Access and technical activity logs are retained for 12 months before being automatically deleted.
• KYC Documents: Retained for 6 years after account closure in accordance with the Anti-Money Laundering and Anti-Terrorism Financing Act 2001.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymized using approved procedures, ensuring it cannot be recovered or re-identified.

The s9my platform is strictly for adults aged 18 and above. We do not knowingly collect personal information from individuals under 18. Account registration by minors is strictly prohibited and constitutes a violation of our terms of use.

If we discover that we have collected personal information from a minor without proper age verification, we will take immediate steps to delete that information and close the account in question. If you are a parent or guardian who believes your child has registered an s9my account, please contact us immediately at [email protected].

S9MY reserves the right to amend or update this Privacy Policy at any time to reflect changes in our privacy practices, legal requirements, or new platform features. Any material changes will be communicated to you via:

• In-platform notifications that appear upon your next login.
• An email sent to your registered email address at least 14 days before the changes take effect.
• Notices prominently displayed on the s9my.pro homepage.

The "Updated" date at the top of this page indicates the date of the latest revision to the Privacy Policy. You are advised to review this page periodically. Continued use of the s9my platform after any amendments take effect will be considered your acceptance of the updated policy.

If you do not agree with any amendments made, you have the right to close your account and request deletion of your personal data in accordance with the procedure outlined in Section 6 above.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how s9my handles your personal data, our Data Protection Officer (DPO) team is ready to assist.

• Privacy Email: [email protected] (please include "Privacy Inquiry" in the email subject line)
• Live Chat: Available on the platform 24 hours a day, 7 days a week
• Response Time: We are committed to responding to all privacy inquiries within 7 business days

If you are unsatisfied with our response to your privacy concern, you have the right to file a complaint with the Department of Personal Data Protection under Malaysia's Ministry of Communications and Digital.