Privacy Policy

1. Introduction

gd9 ("gd9", "we", "us", "our") is the operator of the online gaming platform available at gd9.asia ("the Platform"). We are committed to protecting the privacy and personal data of all users of the Platform, including registered players and visitors from Malaysia and elsewhere.

This Privacy Policy describes the types of personal information we collect, how we use and protect that information, the circumstances in which we may share it, and the rights you have in relation to your personal data. It applies to all personal data collected through the Platform, our customer support channels, and any other interactions you have with gd9.

This policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform and are incorporated herein by reference.

2. Personal Data We Collect

gd9 collects personal data from you in a variety of ways. The categories of personal data we collect include:

2.1 Registration and Identity Data

• Full legal name;
• Date of birth (for age verification purposes);
• Residential address;
• Email address;
• Mobile phone number;
• Username and encrypted password;
• Government-issued identification documents (e.g., Malaysian identity card, passport) — collected as part of Know Your Customer (KYC) verification.

2.2 Financial Data

• Payment method details (e.g., Touch 'n Go eWallet account reference, Boost account reference, bank account name, DuitNow registered mobile number, FPX bank reference — we do not store full bank account numbers or card numbers);
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used;
• Source of funds documentation where requested as part of enhanced due diligence.

2.3 Gaming and Activity Data

• Bet history, game session logs, and wagering records;
• Bonus and promotion activity;
• Account balance history;
• Responsible gaming tool usage (deposit limits set, self-exclusion periods, session alerts).

2.4 Technical and Usage Data

• IP address and approximate geographic location derived from IP;
• Device type, operating system, and browser information;
• Pages visited on the Platform and time spent;
• Referring URL (how you arrived at the Platform);
• Cookie identifiers (see Section 7).

2.5 Communications Data

• Live chat transcripts;
• Email correspondence with gd9 support;
• Records of any formal complaints or disputes submitted to gd9.

3. How We Use Your Personal Data

gd9 uses the personal data we collect for the following purposes:

• Account Registration and Management: To create, verify, and administer your gd9 account, including processing deposits and withdrawals.
• Identity and Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity as required by our licensing and AML obligations.
• Service Delivery: To provide you with access to the games, betting markets, and other features of the Platform.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, and other illegal activity on the Platform.
• Regulatory Compliance: To meet our obligations under applicable gaming, anti-money laundering, and financial crime prevention laws and the conditions of our gaming licence.
• Customer Support: To respond to your enquiries, complaints, and support requests.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling and to administer responsible gaming tools including deposit limits, session alerts, and self-exclusion requests.
• Promotions and Marketing: To send you information about gd9 promotions, bonuses, and new features, where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time by contacting support.
• Platform Improvement: To analyse Platform usage patterns in order to improve the performance, design, and features of the Platform.
• Legal Claims: To establish, exercise, or defend legal claims where necessary.

4. Legal Basis for Processing

gd9 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you have accepted, including providing the gaming services, processing payments, and managing your account.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including our anti-money laundering obligations, gaming licence conditions, and applicable data protection laws.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, security, and improving our services, provided such interests are not overridden by your rights and interests.
• Consent: Where we rely on your consent as the legal basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5. Data Sharing and Disclosure

gd9 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with third parties only in the following circumstances:

• Payment Service Providers: We share necessary financial data with approved payment processors (including but not limited to Touch 'n Go, Boost, GrabPay, DuitNow network operators, Maybank, CIMB, and FPX operators) to process your deposits and withdrawals. These providers process your data as data processors acting under our instructions and are bound by strict data processing agreements.
• Game Content Providers: We share session data with our game software providers (such as Pragmatic Play, PG Soft, and similar studios) to facilitate game access, fair play verification, and game logging. This data is limited to what is technically necessary.
• Identity Verification Services: We use third-party KYC service providers to assist with identity document verification and age verification. These providers process only the data necessary for verification purposes.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to our gaming licence authority, financial intelligence units, law enforcement agencies, or other competent authorities where required by applicable law or regulation, or where we are compelled to do so by legal process.
• Fraud Prevention Networks: We may share data with industry fraud prevention databases and networks for the purpose of preventing fraudulent activity and protecting the integrity of the Platform.
• Group Companies: gd9 may share data with its affiliated and subsidiary companies for internal operational purposes, subject to the same data protection standards as apply to gd9 itself.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of gd9's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections as set out in this policy.

6. Data Retention

gd9 retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal, regulatory, and contractual obligations. In particular:

• Account data and KYC documentation are retained for a minimum of five (5) years from the date of account closure, as required by anti-money laundering regulations applicable to licensed gaming operators.
• Transaction records, including deposit and withdrawal history and betting records, are retained for a minimum of five (5) years from the date of the transaction.
• Communications records (live chat transcripts, email correspondence) are retained for three (3) years from the date of the communication.
• Technical and usage data (log files, IP address records, device data) are retained for up to two (2) years from the date of collection.
• Where personal data is held solely on the basis of consent (e.g., marketing preferences), it is deleted upon receipt of a valid withdrawal of consent, unless retention is required for another purpose.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

7. Cookies and Tracking Technologies

The gd9 Platform uses cookies and similar tracking technologies to provide Platform functionality, improve user experience, and collect analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They include session authentication cookies, security tokens, and cookies that remember your preferences within a session. These cookies cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: These cookies enable enhanced functionality on the Platform, including remembering your language preferences, display settings, and whether you have dismissed certain notices. They are not strictly necessary but improve your experience.
• Analytics Cookies: We use analytics tools to understand how players interact with the Platform — which pages are visited most, where players encounter difficulties, and how they navigate through the site. This data is collected in aggregate form and is used solely to improve the Platform. Where third-party analytics tools are used, they are configured to anonymise IP addresses.
• Marketing Cookies: Where applicable and with your consent, we may use cookies to track whether you arrived at gd9 via a referral source, for the purpose of administering affiliate and referral programmes.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to refuse or delete cookies. Note that refusing certain cookies may affect Platform functionality. Our Platform does not currently respond to browser "Do Not Track" signals.

8. Data Security

gd9 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the gd9 Platform;
• Encryption of sensitive data fields (including passwords, which are stored as salted one-way cryptographic hashes and are never stored in plain text) within our databases;
• Role-based access controls restricting employee access to personal data to those with a legitimate need;
• Regular security assessments and penetration testing of the Platform;
• Secure, access-controlled data centre facilities for all servers hosting gd9 data.

While gd9 employs industry-standard security measures, no data transmission over the internet or data storage system is completely secure. You are responsible for maintaining the confidentiality of your gd9 account credentials and should notify us immediately via Live Chat or at [email protected] if you suspect any unauthorised access to your account.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, gd9 will notify affected players without undue delay in accordance with applicable data protection law.

9. Your Data Rights

Subject to applicable data protection law and our legal and regulatory obligations, you have the following rights in relation to your personal data held by gd9:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request that we correct any inaccurate personal data we hold about you, or complete any incomplete data.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. This right is subject to our legal and regulatory obligations to retain certain data (see Section 6).
• Right to Restriction: You have the right to request that we restrict processing of your personal data in certain circumstances, for example while a data accuracy dispute is being resolved.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, and to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us via Live Chat or email at [email protected]. We will respond to all valid requests within thirty (30) calendar days. In complex cases, this period may be extended by a further sixty (60) days with notice to you. We may require you to verify your identity before processing your request.

10. Minors and Age Restriction

The gd9 Platform is strictly intended for persons aged 21 years and above. gd9 does not knowingly collect personal data from persons under the age of 21. We employ age verification procedures as part of the account registration process to prevent underage access.

If gd9 becomes aware that personal data of a person under the age of 21 has been collected, that data will be deleted and the associated account will be closed. If you have reason to believe that a minor has registered an account on the Platform, please contact us immediately at [email protected].

11. Third-Party Links

The gd9 Platform does not contain links to third-party websites. However, in any case where you navigate from the Platform to a third-party website, application, or service, please note that gd9's Privacy Policy does not apply to any data processed by that third party. We have no control over the privacy practices of third parties and are not responsible for their policies. We encourage you to review the privacy policy of any third-party service you access.

12. International Data Transfers

gd9 operates internationally and your personal data may be transferred to, stored in, and processed in countries outside of Malaysia. Where personal data is transferred internationally, gd9 takes steps to ensure that appropriate safeguards are in place to protect that data, including the use of standard contractual clauses or equivalent data transfer mechanisms that provide a level of protection equivalent to that required by applicable data protection law.

In particular, data processed by our game software providers, payment processors, and KYC verification partners may be processed in the jurisdiction of those service providers. All such transfers are governed by data processing agreements that impose obligations on the recipient consistent with the standards described in this Privacy Policy.

13. Changes to This Privacy Policy

gd9 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, we will publish the updated policy on the Platform with a revised "Last Updated" date. Where the changes are significant, we may also notify you by email to your registered address.

Continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. If you disagree with the updated policy, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how gd9 protects your data.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data gd9 holds about you, please contact our data privacy team through the following channels:

• Live Chat: Available 24/7 on the gd9 Platform. This is the fastest way to reach us.
• Email: [email protected] — please use the subject line "Privacy Request" for privacy-related enquiries. We aim to respond within 30 calendar days.
• Operating Hours: 24/7, 365 days (GMT+8).