🔐 Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") describes how gd9 ("gd9", "we", "us", "our"), the operator of the online gaming platform at gd9.bio, collects, uses, discloses, and safeguards the personal data of individuals who register for and use the gd9 Platform ("you", "Player", "User").

1.2 gd9 is committed to protecting the privacy and personal data of all Malaysian players and users of the gd9 Platform. This Policy is drafted in compliance with applicable data protection principles, including those consistent with the Malaysian Personal Data Protection Act 2010 (PDPA).

1.3 By registering a gd9 account, logging in, or using any gd9 service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

1.4 This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy.

2. Personal Data We Collect

2.1 gd9 collects the following categories of personal data in connection with the operation of the Platform:

Identity & Contact Data

• Full legal name as per your Malaysian identity document (MyKad or passport);
• Date of birth (for mandatory age verification purposes);
• Malaysian identity card number (MyKad) or passport number;
• Residential address, including postcode and state;
• Email address;
• Mobile phone number.

Financial Data

• Bank account details and/or e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow) used for deposits and withdrawals;
• Transaction history, including deposit amounts, withdrawal amounts, and dates;
• Payment method type and last four digits of relevant financial identifiers where applicable.

Technical & Usage Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, browser type and version;
• Session duration, pages visited, and features used within the gd9 Platform;
• Login timestamps and device fingerprint data for security purposes.

Gaming Activity Data

• Bet history, game history, and wagering patterns across gd9 Sportsbook, gd9 Casino, Slots, Arcade, and Poker Online;
• Bonus and promotion participation history;
• Responsible gaming tool usage (deposit limits set, self-exclusion history).

Communications Data

• Records of communications with gd9 customer support, including live chat transcripts and email correspondence;
• Feedback and complaint records.

3. How We Collect Your Data

3.1 gd9 collects personal data through the following means:

• Direct submission: Data you provide when registering a gd9 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or completing any form on the Platform;
• Automated collection: Technical and usage data collected automatically when you access the gd9 Platform, including through cookies, server logs, and similar tracking technologies;
• Third-party sources: Identity verification and fraud prevention data received from third-party KYC verification service providers, payment processors, and anti-money laundering screening databases, where applicable;
• Public sources: Publicly available information used to verify identity or detect fraudulent activity where legally permissible.

4. How We Use Your Personal Data

4.1 gd9 uses your personal data for the following purposes:

• Account management: To register, maintain, and administer your gd9 account, including account security, authentication, and session management;
• Service delivery: To operate the gd9 Sportsbook, Casino, Slots, Arcade, Poker Online, and all other Platform features accessible to you as a registered player;
• Payment processing: To process deposits and withdrawals via your chosen Malaysian payment method (DuitNow, Touch 'n Go eWallet, Boost, FPX, Maybank, CIMB, Public Bank, or GrabPay);
• KYC & regulatory compliance: To verify your identity and age (21+ requirement), conduct anti-money laundering checks, and comply with all applicable legal and regulatory obligations;
• Fraud prevention & security: To detect, investigate, and prevent fraud, unauthorised account access, collusion, and other prohibited activities;
• Responsible gaming: To monitor gaming activity and apply responsible gaming interventions where appropriate, including implementing deposit limits or self-exclusion requests made by you or flagged by gd9's responsible gaming systems;
• Customer support: To respond to your queries, resolve complaints, and maintain records of support interactions;
• Platform improvement: To analyse usage patterns and improve the functionality, performance, and user experience of the gd9 Platform;
• Marketing communications: To send you information about gd9 promotions, bonuses, and updates — where you have provided consent or where permitted by applicable law. You may opt out of marketing communications at any time.

5. Legal Basis for Processing

5.1 gd9 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between gd9 and you — specifically, to operate your gd9 account and provide the gaming and betting services you have registered to use;
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations, age verification requirements, and tax reporting obligations;
• Legitimate interests: Processing for fraud prevention, Platform security, and responsible gaming monitoring, where gd9's legitimate interests in protecting the Platform and its players are not overridden by your data protection rights;
• Consent: Processing for marketing communications, where your explicit consent has been obtained and can be withdrawn at any time.

6. Data Sharing & Disclosure

6.1 gd9 does not sell, rent, or trade your personal data to third parties for their own marketing purposes.

6.2 gd9 may share your personal data with the following categories of recipients, strictly as necessary:

• Payment processors: Malaysian payment service providers (including banks and e-wallet operators such as Touch 'n Go, Boost, and DuitNow) to process your financial transactions;
• KYC and identity verification providers: Third-party identity verification services used to complete mandatory age and identity verification;
• IT and platform service providers: Cloud infrastructure, security, and software providers who process data on gd9's behalf under data processing agreements;
• Game content providers: Limited data shared with licensed game studios whose titles are available on the gd9 Platform, where required for game functionality;
• Regulatory and law enforcement authorities: Where gd9 is legally required or compelled by a competent authority to disclose personal data;
• Professional advisers: Legal, financial, and compliance advisers bound by confidentiality obligations.

6.3 All third parties to whom gd9 discloses personal data are required to process that data in accordance with applicable data protection standards and are prohibited from using it for any purpose other than that for which it was disclosed.

7. Cookies & Tracking Technologies

7.1 The gd9 Platform uses cookies and similar tracking technologies to operate and improve the Platform, maintain your logged-in session, detect fraud, and analyse usage patterns.

7.2 The following categories of cookies are used on gd9.bio:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that maintain your gd9 login state and security tokens. These cannot be disabled.
• Performance cookies: Used to collect anonymous data about how players use the Platform — pages visited, errors encountered, and session duration — to help gd9 improve Platform performance.
• Functional cookies: Used to remember your Platform preferences, such as language or display settings.

7.3 You may control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate securely.

8. Data Retention

8.1 gd9 retains your personal data for as long as your gd9 account is active and for a period thereafter as required by applicable legal and regulatory obligations. In practice, this means:

• Account data and transaction records: retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements;
• KYC documentation: retained for the period required by applicable regulations, typically five (5) years from the date of the last transaction;
• Support and communications data: retained for two (2) years from the date of the relevant interaction;
• Marketing consent records: retained until you withdraw consent, plus one (1) year thereafter.

8.2 Where gd9 no longer has a legal basis to retain your personal data, it will be securely deleted or anonymised.

9. Data Security

9.1 gd9 implements robust technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• TLS 1.3 encryption for all data in transit between your device and gd9 servers;
• Encryption of sensitive data at rest, including financial account identifiers and identity documents;
• Two-factor authentication (2FA) available for all gd9 player accounts;
• Access controls limiting internal data access to authorised personnel on a need-to-know basis;
• Regular security audits and penetration testing of Platform infrastructure;
• Device fingerprinting and anomalous login detection to identify and block unauthorised access attempts.

9.2 Notwithstanding the above, no security system is impenetrable. gd9 cannot guarantee the absolute security of your personal data and shall not be liable for any unauthorised access resulting from factors outside gd9's reasonable control.

9.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gd9 will notify affected players and relevant authorities as required by applicable law.

10. Your Data Rights

10.1 Subject to applicable law and regulatory constraints, you have the following rights in respect of your personal data held by gd9:

• Right of access: You may request a copy of the personal data gd9 holds about you;
• Right to rectification: You may request correction of any inaccurate or incomplete personal data gd9 holds about you;
• Right to erasure: You may request deletion of your personal data in certain circumstances, subject to gd9's legal obligations to retain records;
• Right to restrict processing: You may request that gd9 restrict the processing of your personal data in certain circumstances;
• Right to data portability: Where processing is based on your consent or on a contractual necessity, you may request that gd9 provide your personal data in a structured, commonly used, and machine-readable format;
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing;
• Right to object: You may object to processing of your personal data where gd9 relies on legitimate interests as the legal basis.

10.2 To exercise any of the above rights, please contact gd9's data protection contact at [email protected]. gd9 will respond to all valid requests within thirty (30) days.

10.3 gd9 may need to verify your identity before processing a data rights request to ensure your personal data is not disclosed to an unauthorised person.

11. Children's Privacy

11.1 The gd9 Platform is strictly intended for persons aged 21 years and over. gd9 does not knowingly collect personal data from any person under 21 years of age.

11.2 If gd9 becomes aware that personal data has been collected from a person under 21 years of age, the relevant account will be immediately closed and all associated personal data deleted, except where retention is required by applicable law.

11.3 If you are a parent or guardian and believe a person under 21 has registered a gd9 account using your or their details, please contact gd9 immediately at [email protected].

12. International Data Transfers

12.1 gd9 may process or store personal data on servers located outside of Malaysia, including in cloud infrastructure regions serving the Asia-Pacific area. Where personal data is transferred outside Malaysia, gd9 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to that required under the Malaysian PDPA.

12.2 Safeguards for international transfers may include: contractual clauses binding the recipient to applicable data protection standards; transfer to jurisdictions with recognised adequate data protection regimes; or other lawful transfer mechanisms as applicable.

13. Updates to This Privacy Policy

13.1 gd9 reserves the right to update this Privacy Policy at any time. Where changes are material, gd9 will notify registered players via the Platform or by email to the address registered on the player's gd9 account.

13.2 The date of the most recent revision is displayed at the top of this page. gd9 recommends that players review this Policy periodically. Continued use of the gd9 Platform following the publication of an updated Policy constitutes acceptance of the revised terms.

14. Contact Us

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or gd9's handling of your personal data, please contact us using the details below:

14.2 For responsible gaming support and self-exclusion requests, please visit gd9.bio/responsible-gaming.