9naga Privacy Policy – Personal Data Protection for Malaysian Players

1Personal Data We Collect

9naga collects various categories of personal data depending on how you interact with our platform. Below is a detailed breakdown of the types of data we collect:

Data You Provide Directly:

• Identity information: full name, date of birth, national identity card number (MyKad) or passport
• Contact information: mobile phone number, email address, current residential address
• Account information: username, password (stored as an unreadable hash), security questions
• Verification documents: a copy of your MyKad or passport, proof of address (utility bill or bank statement) submitted during the KYC process
• Financial information: digital wallet or bank account numbers used for deposits and withdrawals via Touch 'n Go, GrabPay, DuitNow, FPX, Boost or ShopeePay

Automatically Collected Data:

• Technical data: IP address, web browser type, operating system, device model, screen resolution
• Usage data: pages visited, time spent on each page, click patterns and navigation behaviour within the platform
• Betting data: betting history, bet types, markets used, stake amounts and outcomes
• Transaction data: deposit and withdrawal history, payment methods used, transaction time and date
• Location data: general country and region based on IP address (we do not collect precise GPS location without your consent)

Data from Third-Party Sources:

• Identity verification information from approved KYC service providers
• Risk assessment data from fraud prevention service providers
• Information from loyalty or referral programmes if you registered through those channels

2How Your Personal Data Is Used

9naga uses your personal data for the following purposes. We will only use your data for purposes you have consented to or that have a valid legal basis:

3Data Sharing with Third Parties

9naga does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Your data may be shared with the following parties only where necessary and with appropriate safeguards in place:

• Payment Service Providers: Required transaction information is shared with providers such as Touch 'n Go, GrabPay, DuitNow, FPX, Boost and ShopeePay solely to process your deposits and withdrawals. These providers are bound by strict financial security standards.
• KYC and Anti-Fraud Providers: Identity information is shared with approved identity verification and fraud prevention service providers to ensure platform security and legal compliance.
• Game Software Providers: Minimum account information required is shared with third-party game software providers (such as Live Casino or slots providers) to enable you to access their games through the 9naga platform.
• Authorities: Personal data may be disclosed to Malaysian authorities such as Bank Negara Malaysia, the Royal Malaysia Police, or relevant regulatory bodies when required by law, court order, or in the course of a financial crime investigation.
• Professional Advisors: Lawyers, accountants, and auditors bound by professional confidentiality obligations may have limited access to data in the context of the business advice they provide.

All third parties who receive your personal data from 9naga are required to handle that data with a level of protection no less stringent than the standards we apply to ourselves.

4Data Retention Period

9naga retains your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable law. The following is a general guide to our data retention periods:

• Active Account Data: For as long as your account is active and for a period of 7 years after account closure, to meet Malaysia's financial record-keeping and anti-money laundering legal requirements.
• Transaction Records: A minimum of 7 years from the date of the transaction, in line with Malaysian financial regulatory requirements.
• KYC Documents: A minimum of 5 years from the date of verification or from the date of account termination, whichever is later.
• Support Communication Data: 3 years from the date of last interaction.
• Technical Log Data: Between 90 days and 12 months, depending on the type of log.
• Cookie Data: By cookie type – ranging from session duration (expires when the browser is closed) to a maximum of 2 years for preference cookies.

When data is no longer needed and there is no legal obligation to retain it, we will securely delete or anonymise it.

5Your Rights Under PDPA 2010

As an individual whose personal data is processed by 9naga, you have the following rights under Malaysia's Personal Data Protection Act 2010 (PDPA):

To exercise any of the rights above, please contact the 9naga Data Protection Officer by email at privacy@9naga.best or through our customer support. We are committed to responding to all rights-related requests within the timeframe required by law.

6Data Security and Protective Measures

9naga invests seriously in security infrastructure to protect your personal data. The security measures we have in place include:

• Data Encryption in Transit: All data transmitted between your device and 9naga's servers is protected by 256-bit SSL/TLS encryption — the same encryption technology used by Malaysia's leading financial institutions.
• Data Encryption at Rest: Sensitive data, including passwords and financial information, is stored in encrypted form. Passwords are hashed using a one-way algorithm and cannot be reversed to their original plaintext.
• Internal Access Controls: Access to user data within 9naga's internal systems is restricted to staff who require it on a strict need-to-know basis. All access is logged and audited on a regular basis.
• Two-Factor Authentication: All administrative access to systems containing user data requires two-factor authentication (2FA) as an additional layer of security.
• Continuous Monitoring: 9naga's security monitoring system operates around the clock to detect and respond promptly to any threats or suspicious activity.
• Regular Security Audits: The 9naga platform undergoes periodic independent security audits conducted by qualified cybersecurity firms to identify and address any vulnerabilities.
• Incident Response Plan: 9naga has a documented incident response procedure to address any data breach swiftly and effectively, including notifying the relevant authorities and affected users where required.

While we implement all reasonable security measures, no system is 100% secure. You also play an important role in protecting your data by keeping your 9naga account login credentials safe.

7Use of Cookies and Tracking Technologies

The 9naga platform uses cookies and similar technologies to enhance the user experience, analyse platform usage, and deliver more relevant content. Below are the types of cookies we use:

You can manage cookie settings through your web browser's preferences. Please note that disabling essential cookies may affect the functionality of the 9naga platform. For more information on how to manage cookies in your browser, please refer to your browser's help documentation.

8International Data Transfers

In the course of operating the 9naga platform, your personal data may be processed or stored on servers located outside Malaysia — for example, by cloud service providers or international gaming software providers that we use.

Whenever personal data is transferred outside Malaysia, 9naga ensures that protections equivalent to the standards of Malaysia's PDPA 2010 are applied. This is implemented through:

• Binding data processing agreements with overseas service providers requiring them to comply with appropriate data protection standards
• Selection of providers operating under recognised data protection frameworks (such as ISO 27001 standards)
• Use of recognised standard contractual clauses for international data transfers

You may request further information about international data transfers by contacting the 9naga Data Protection Officer at privacy@9naga.best.

9Children's Privacy

The 9naga platform is strictly restricted to individuals aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

If you are a parent or guardian and have reason to believe that a minor in your care has registered an account or provided personal data to 9naga without your consent, please contact us immediately at privacy@9naga.best. We will take prompt action to review and delete the relevant data and close the account.

9naga employs multiple measures to prevent underage registration, including an age verification process at sign-up and a rigorous KYC process that requires identity verification with official documents.

10Direct Marketing and Promotional Communications

9naga may send you marketing communications about promotions, new bonuses, special offers, and platform news via email, SMS, or in-platform notifications — but only if you have given your consent to receive them during registration or through your communication preferences in your account settings.

You can opt out of marketing communications at any time by:

• Click the "Unsubscribe" link at the bottom of any marketing email from 9naga
• Update your communication preferences under "Account Settings" on the platform
• Contact the 9naga support team via LiveChat, WhatsApp, or email at support@9naga.best

Please note that even if you opt out of marketing communications, you will still receive important transactional emails related to your account and betting activity — such as deposit confirmations, withdrawal notifications, and account security alerts. These are not marketing communications and are necessary for the operation of your account.

11Changes to This Privacy Policy

9naga reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or platform improvements. Any significant changes to how we handle your personal data will be communicated to you through:

• Email notification to your registered email address
• A clear notice within the 9naga platform when you log in
• Updating the "Last Updated" date at the top of this document

Your continued use of the 9naga platform after any changes to this Privacy Policy take effect will be considered your acceptance of the updated version. We encourage you to review this page periodically. If you disagree with any changes made, please contact us or close your account before the changes take effect.

12How to Contact the 9naga Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or how 9naga handles your personal data, you can reach our Data Protection Officer through the following channels:

• Dedicated privacy email: privacy@9naga.best – for all enquiries related to data protection and user rights requests
• General support: support@9naga.best – for general questions about the platform
• In-platform LiveChat: Available 24/7 in Bahasa Melayu
• WhatsApp Support: For cases requiring documentation or ongoing follow-up

For formal requests relating to your rights under PDPA 2010 — such as data access, correction, or erasure requests — please use the email privacy@9naga.best and clearly state the nature of your request. We are committed to responding to all privacy enquiries within 14 business days.

If you are not satisfied with how 9naga has handled your privacy complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under the provisions of PDPA 2010.