Privacy Policy
How o9win Handles Your Data
Your privacy matters to us. This Privacy Policy explains exactly what personal data o9win collects, why we collect it, how it is processed and protected, and what rights you hold as a data subject. We have written this policy in plain, accessible English so that every player on our platform — whether based in Kuala Lumpur, Penang, Johor Bahru, or anywhere across Malaysia — can understand it clearly.
Introduction
This Privacy Policy ("Policy") is published by o9win ("Company", "we", "us", "our") and applies to all personal data collected, processed, stored, and used in connection with your registration and use of the o9win platform at https://o9win.cam ("Platform"), including all associated mobile web services, support channels, and promotional communications.
o9win is committed to protecting the privacy and personal data of all users. We process personal data only to the extent necessary to provide our gaming and betting services, fulfil our legal and regulatory obligations, and maintain the security and integrity of the Platform. We do not sell your personal data to any third party, and we do not use it for purposes beyond those set out in this Policy.
By registering an account on o9win or otherwise using our Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data in accordance with its terms. If you do not agree with any provision of this Policy, you must not use the Platform.
This Policy applies to players based in Malaysia, including those accessing the Platform from Kuala Lumpur, Penang, Shah Alam, Johor Bahru, Petaling Jaya, Bangsar, and all other locations. While Malaysia's Personal Data Protection Act 2010 (PDPA) provides a local framework reference for data protection principles, this Policy also incorporates internationally recognised data protection standards.
Definitions
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| Personal Data | Any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data held by the Company. |
| Data Subject | The individual to whom Personal Data relates — in this context, a registered player or visitor to the o9win Platform. |
| Data Controller | The entity that determines the purposes and means of processing Personal Data — in this context, o9win. |
| Data Processor | A third-party organisation that processes Personal Data on behalf of o9win under a contractual data processing agreement. |
| Processing | Any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion. |
| KYC | Know Your Customer — the mandatory identity and age verification process required for account holders. |
| Cookies | Small text files stored on a user's device by a web browser for the purpose of tracking session data, preferences, and analytics. |
| Consent | A freely given, specific, informed, and unambiguous indication of agreement by the Data Subject to the processing of their Personal Data. |
Data We Collect
o9win collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and in limited cases from third-party verification and payment service providers. The categories of personal data we collect include the following:
Full legal name, date of birth, nationality, government-issued ID number (e.g. MyKad or passport number).
Email address, mobile phone number, and residential address including postcode and city.
Username, hashed password, account preferences, communication language, and security settings.
Deposit and withdrawal transaction records, selected payment methods (e.g. Maybank, DuitNow, Touch 'n Go), and transaction timestamps.
Game sessions, wager history, bet stakes and outcomes, sports betting markets accessed, win/loss records, and session duration.
IP address, browser type, device identifiers, operating system, referring URLs, and session timestamps.
Copies of government-issued photo ID, proof of address, and payment method verification documents as required by our compliance process.
Records of live chat conversations, email correspondence, and support ticket content.
Sensitive Data: o9win does not intentionally collect sensitive personal data (such as health information, racial or ethnic origin, or religious beliefs) except where strictly necessary for responsible gambling purposes, such as recording a self-exclusion request. Where such data is provided by you voluntarily, it will be used solely for the stated purpose.
How We Use Your Data
o9win uses the personal data it collects only for defined, legitimate purposes. We do not process your data in ways that are incompatible with the original purpose of collection. The primary purposes for which we process your personal data are:
4.1 — Account Registration and Management
We use your identity and contact data to create and maintain your o9win account, verify your eligibility, and manage your account preferences and security settings.
4.2 — KYC and Age Verification
We are required to verify the identity and age of all players. KYC data is processed to confirm that you meet the minimum age requirement of 21 years and that your account details match your verified identity. This processing is mandatory — failure to complete KYC will result in withdrawal restrictions.
4.3 — Payment Processing
Financial data is used to process deposits and withdrawals via your selected payment methods, including Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks. Transaction records are retained for audit and compliance purposes.
4.4 — Fraud Prevention and Security
Technical and account data is used to detect and prevent fraud, money laundering, multi-account abuse, bonus exploitation, and other prohibited conduct. Automated screening and manual review may be applied where suspicious activity is identified.
4.5 — Responsible Gambling Monitoring
Gaming activity data, session data, and financial data are used to monitor for indicators of problem gambling and to apply responsible gambling tools such as deposit limits, session reminders, and self-exclusion where appropriate or as requested by the player.
4.6 — Customer Support
Communications data is used to process and respond to support queries, live chat conversations, formal complaints, and dispute resolution requests.
4.7 — Legal and Regulatory Compliance
We are required to retain certain categories of personal and transactional data to comply with anti-money laundering (AML) obligations, gaming licence conditions, and applicable laws in our licensing jurisdiction. This processing is mandatory and cannot be opted out of.
4.8 — Platform Improvement and Analytics
Aggregated and anonymised technical data is used to analyse Platform usage patterns, identify performance issues, and improve the user experience. Individual-level data used for analytics is anonymised wherever possible.
4.9 — Promotional Communications
Where you have provided consent, we may use your contact data to send you information about promotions, bonuses, and new features on o9win. You may withdraw your consent to marketing communications at any time. See Section 13 for details.
Legal Basis for Processing
o9win processes personal data on the following legal grounds, consistent with internationally recognised data protection standards:
- Contractual Necessity: Processing required to perform our contractual obligations to you under our Terms and Conditions — including account management, payment processing, and game delivery.
- Legal Obligation: Processing required by applicable laws and regulatory obligations, including AML compliance, KYC verification, and gaming licence conditions.
- Legitimate Interests: Processing carried out for o9win's legitimate business interests where these are not overridden by your rights — including fraud detection, platform security, and aggregated analytics.
- Consent: Processing for which you have given explicit, informed consent — principally marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
Data Sharing & Disclosure
o9win does not sell, rent, or commercially trade your personal data to any third party under any circumstances. We share personal data only in the limited circumstances described below, and always under appropriate contractual or legal safeguards:
6.1 — Payment Service Providers
Financial and identity data is shared with our payment processing partners (including local Malaysian banking and e-wallet providers such as Maybank, CIMB, Touch 'n Go, DuitNow, FPX, Boost, and GrabPay) solely for the purpose of processing your transactions. These providers are contractually bound not to use your data for any other purpose.
6.2 — KYC and Identity Verification Services
Identity and document data may be shared with third-party KYC verification platforms to facilitate the mandatory age and identity verification process. All such providers operate under strict data processing agreements.
6.3 — Game Content Providers
Limited technical data (such as session tokens and game round identifiers) is shared with our licensed game studio partners to deliver game content and resolve game-level disputes. No personally identifying information is shared with game studios beyond what is technically necessary.
6.4 — Legal and Regulatory Authorities
We may be required by law, court order, or instruction from a competent regulatory or law enforcement authority to disclose personal data. In such cases, o9win will comply with applicable legal obligations while endeavouring to notify you where permitted by law.
6.5 — Fraud Prevention Networks
Where required for fraud prevention or AML purposes, limited data may be shared with industry-standard fraud prevention organisations or databases. Data shared in this context is used solely for the detection and prevention of financial crime.
No Sale of Data: o9win does not sell, licence, or commercially transfer your personal data to any marketing company, data broker, advertiser, or unrelated third party. This is an unconditional commitment.
Cookies & Tracking Technologies
o9win uses cookies and similar tracking technologies to operate core Platform functions and to improve the user experience. The following categories of cookies are used:
- Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing core Platform functionality.
- Functional Cookies: Used to remember your account preferences, such as language settings, last-visited game category, and responsible gambling limit preferences.
- Analytics Cookies: Used in aggregate form to understand how users navigate the Platform, which features are most used, and where performance improvements are needed. Analytics data is anonymised before use in reporting.
- Security Cookies: Used to detect and prevent fraudulent access, suspicious session behaviour, and multi-account abuse.
You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform, including the ability to maintain your login session. o9win does not use cookies to serve third-party advertising on the Platform.
Data Retention
o9win retains personal data only for as long as is necessary for the purposes set out in this Policy, or as required by applicable legal and regulatory obligations. The following general retention principles apply:
- Account Data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, in compliance with AML and gaming licence record-keeping requirements.
- Financial Transaction Records: Retained for a minimum of five (5) years following the date of the transaction, as required by applicable AML regulations.
- KYC Documents: Retained for a minimum of five (5) years following account closure or the completion of the last transaction, whichever is later.
- Support Communications: Retained for up to three (3) years following the resolution of a support query or formal complaint.
- Gaming Activity Logs: Retained for up to five (5) years for compliance, dispute resolution, and responsible gambling monitoring purposes.
- Marketing Consent Records: Retained for the duration of your account and for two (2) years following withdrawal of consent, as proof of prior consent.
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.
Data Security
o9win implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:
- 256-bit SSL/TLS Encryption: All data transmitted between your browser and the o9win Platform is encrypted using industry-standard Transport Layer Security protocols.
- Password Hashing: Account passwords are stored as salted cryptographic hashes. Plain-text passwords are never stored or accessible to o9win staff.
- Two-Factor Authentication (2FA): Optional 2FA is available for all player accounts and is strongly recommended to enhance account security.
- Access Controls: Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis and is subject to role-based access controls and audit logging.
- Data Minimisation: We collect only the data that is necessary for the stated processing purposes and do not retain unnecessary data beyond its purpose.
- Third-Party Security Assessments: Our payment processing integrations and data handling infrastructure are periodically reviewed against applicable security standards.
While o9win implements robust security measures, no system is entirely immune to risk. In the event of a data security incident that creates a material risk to your rights and freedoms, we will notify affected users and, where required, relevant supervisory authorities within timeframes consistent with applicable obligations.
International Data Transfers
As an internationally operated platform, o9win may transfer personal data to servers, service providers, and partner organisations located in jurisdictions outside of Malaysia. Such transfers may occur in connection with payment processing, KYC verification, game content delivery, and IT infrastructure hosting.
Where personal data is transferred internationally, o9win ensures that appropriate safeguards are in place, including contractual data protection clauses with all third-party recipients that impose obligations consistent with internationally recognised data protection standards. We do not transfer personal data to jurisdictions that do not offer an adequate level of data protection without first implementing appropriate contractual protections.
Your Rights as a Data Subject
Subject to applicable law and the specific circumstances of your request, you hold the following rights in relation to your personal data held by o9win:
Right of Access
You may request a copy of the personal data we hold about you and information about how it is being processed.
Right to Rectification
You may request the correction of inaccurate or incomplete personal data held by o9win without undue delay.
Right to Erasure
In certain circumstances, you may request that o9win delete your personal data. Note that this right is subject to legal retention obligations.
Right to Restriction
You may request that o9win restrict the processing of your data while a rectification or objection request is under review.
Right to Portability
Where processing is based on consent or contract, you may request your personal data in a structured, commonly used, machine-readable format.
Right to Object
You may object to processing carried out on the basis of legitimate interests, including profiling. We will cease processing unless we have compelling legitimate grounds.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
Right to Lodge a Complaint
You have the right to lodge a complaint with a competent supervisory or data protection authority in your jurisdiction.
To exercise any of the above rights, please contact our support team as detailed in Section 15. We will respond to verified requests within 30 calendar days. Complex requests may require an extension of up to a further 60 days, in which case we will notify you of the extension and the reasons for it.
Minors & Age Policy
The o9win Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. KYC verification is mandatory for all accounts and is specifically designed to confirm that no individual under the minimum age is registered on the Platform.
If you have reason to believe that an individual under the age of 21 has registered an account on o9win, please contact our support team immediately at [email protected] (plain text — not a clickable link). Upon receiving such a report, we will conduct an investigation and, if confirmed, immediately close the account and delete any personal data held in connection with it, subject to applicable legal retention requirements.
21+ Age Requirement: Providing false information about your age during registration is a serious breach of our Terms and Conditions and may constitute fraud under applicable law. o9win reserves the right to report such instances to relevant authorities.
Marketing Communications
o9win may send you promotional communications about new games, bonuses, seasonal promotions, VIP programme updates, and other Platform features where you have given your explicit consent to receive such communications during the registration process or at any subsequent point.
Marketing communications will be sent via email, and where you have provided a mobile number and consented, via SMS. We will not send marketing communications to you via any channel for which you have not provided consent.
13.1 — Withdrawing Marketing Consent
You may withdraw your consent to receive marketing communications at any time by:
- Clicking the unsubscribe link included in any marketing email from o9win.
- Updating your communication preferences from within your account settings.
- Contacting our support team and requesting removal from marketing lists.
Withdrawal of marketing consent will take effect within 5 business days. You will continue to receive transactional and account-related communications necessary for the operation of your account regardless of your marketing preference.
13.2 — No Third-Party Marketing
o9win does not share your contact data with third parties for their own marketing purposes. We do not participate in data exchange programmes with external marketing organisations or data brokers.
Policy Amendments
o9win reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or Platform features. Revised versions will be published on this page with an updated "Last Updated" date.
For material changes to the Policy — particularly those that affect how your data is used or your rights as a data subject — o9win will endeavour to provide advance notice via email or in-platform notification at least 14 days before the changes take effect.
Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms and Conditions.
Contact & Data Requests
For all matters relating to this Privacy Policy, including requests to exercise your data subject rights, questions about how your personal data is processed, or to report a potential privacy concern, please contact the o9win team through the channels below.
Email Contact
Direct all privacy-related queries to: [email protected] (plain text only — not a clickable link). Please include "Privacy Request" or "Data Subject Request" in your subject line so that your message is routed correctly. We will acknowledge receipt within 48 hours and respond substantively within 30 calendar days.
Live Chat
For general privacy questions, our 24/7 live chat support team can assist with initial queries and direct you to the appropriate resolution channel. Live chat response time averages under 3 minutes.
Identity Verification for Data Requests
To protect your privacy, o9win requires identity verification before processing any data subject access, rectification, erasure, or portability request. Requests submitted without sufficient identifying information to verify the requester's identity cannot be acted upon. Required verification details will be communicated to you upon receipt of your request.
All privacy requests are handled confidentially by our designated data protection team. We do not share the content of privacy requests with any third party beyond what is strictly necessary to process them.
Six Ways o9win Protects Your Data
We don't just state our privacy commitments — we build them into the technical and operational fabric of the Platform.
Zero Data Sales — Full Stop
o9win does not sell, rent, or trade your personal data to any third party under any circumstances. Your information is used only to deliver and improve the services you signed up for — nothing more.
256-bit SSL Encryption End-to-End
Every byte of data transmitted between you and o9win is encrypted using industry-standard TLS protocols. Passwords are stored as salted hashes — plain-text credentials are never accessible to anyone, including our staff.
GDPR-Aligned Data Subject Rights
Regardless of where you are based in Malaysia — Kuala Lumpur, Penang, Johor Bahru or beyond — you hold rights of access, rectification, erasure, and portability over your personal data. We honour all valid requests within 30 days.
Data Minimisation Principle
We collect only what we actually need for the stated purpose. We don't gather data speculatively, and we don't retain it beyond its defined retention period. When data is no longer needed, it is securely deleted or anonymised.
Opt-Out Marketing at Any Time
Promotional emails from o9win require your explicit prior consent. You can withdraw that consent in a single click at any time, and we will stop all marketing communications within 5 business days. Transactional account emails are unaffected.
Contractual Safeguards on All Third Parties
Every third party that processes your personal data on o9win's behalf — from payment providers like DuitNow and Touch 'n Go to KYC platforms — operates under a formal data processing agreement. They cannot use your data for their own purposes.
Ready to Play on a Platform That
Actually Respects Your Privacy?
At o9win, privacy is a technical commitment — not a marketing claim. Your data stays on our platform, your winnings stay in your account, and your identity stays protected. Come experience Malaysia's most player-focused online casino for yourself. For players aged 21 and above only.
21+ only. Gambling involves financial risk. For privacy queries, contact us at [email protected] (plain text — not a link).