ob9 Privacy Policy

1. About This Policy

1.1 This Privacy Policy ("Policy") applies to all personal data collected by ob9 through the ob9.asia website and any associated platform interfaces made available to players ("the Platform").

1.2 By registering an ob9 account or using any part of the Platform, you acknowledge that you have read and understood this Policy. ob9 is the data controller in respect of personal data collected through the Platform.

1.3 This Policy should be read alongside the ob9 Terms & Conditions and the Responsible Gaming policy, which together form the full framework governing your use of the Platform.

1.4 If you do not agree with the practices described in this Policy, you should not use the ob9 Platform. Questions about this Policy may be directed to ob9's data protection contact at [email protected].

2. Data We Collect

ob9 collects personal data in several ways, including directly from you at registration, through your use of the Platform, and through automated technical means.

2.1 Registration & Account Data. When you create an ob9 account, we collect:

• Full legal name
• Date of birth (to verify 21+ age eligibility)
• Email address and mobile phone number
• Residential address
• Government-issued identity document details (MyKad number or passport number) for KYC verification
• Username and encrypted password

2.2 Financial & Transaction Data. We collect data relating to your financial activity on ob9, including:

• Deposit and withdrawal amounts, dates, and methods (e.g., Touch 'n Go eWallet, Boost, Maybank2u, DuitNow, FPX)
• MYR wallet balance history
• Bonus credits awarded, wagered, and forfeited
• Payment method identifiers (e.g., registered bank account names — not full card or account numbers)

2.3 Gaming & Betting Activity Data. ob9 records data related to your use of the Platform, including:

• Games played, stakes placed, wins and losses
• Sports bets placed, odds accepted, and settlement outcomes
• Session start and end times
• Responsible gaming tool usage (deposit limits set, self-exclusion requests)

2.4 Technical & Device Data. We automatically collect technical data when you access the Platform:

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Login timestamps and session duration
• Cookie identifiers (see Section 7)

2.5 Communication Data. If you contact ob9 Customer Support via live chat or email, we retain records of those communications for quality assurance, dispute resolution, and training purposes.

3. How We Use Your Data

ob9 uses the personal data we collect for the following purposes:

• Account management: To create, maintain, and administer your ob9 account, including processing login authentication and enabling two-factor authentication.
• Age and identity verification: To verify that you meet the 21+ age requirement and to complete KYC verification before processing withdrawals.
• Payment processing: To process MYR deposits and withdrawals via the payment methods available on ob9, and to investigate payment disputes.
• Platform delivery: To provide access to ob9 Casino, the sportsbook, slots, and all other Platform features in a functional and personalised manner.
• Fraud prevention and security: To detect and prevent fraudulent activity, account compromise, collusion, and other security threats to the Platform or to other players.
• Regulatory compliance: To fulfil our obligations under our international gaming authority licence, including anti-money laundering (AML) and responsible gaming requirements.
• Responsible gaming: To monitor gaming activity patterns, identify players who may be showing signs of problem gambling behaviour, and proactively offer responsible gaming tools where appropriate.
• Customer support: To investigate and resolve account queries, payment issues, and complaints submitted to ob9 support.
• Platform improvement: To analyse aggregate usage data and improve the functionality, layout, and game selection of the ob9 Platform.
• Marketing communications: Where you have provided consent, to send promotional offers, bonus notifications, and new game announcements relevant to your activity on ob9. You may withdraw consent at any time via your account notification settings.

4. Legal Bases for Processing

ob9 processes personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the ob9 Platform services described in the Terms & Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with our obligations under our gaming licence, applicable AML regulations, and data retention requirements imposed by law.
• Legitimate interests: Processing undertaken for fraud prevention, security monitoring, and aggregate platform analytics, where these interests are not overridden by your fundamental rights.
• Consent: Processing of your data for direct marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Sharing Your Data

5.1 ob9 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following circumstances:

• Payment processors: Your financial transaction data is shared with the relevant payment service providers (e.g., e-wallet operators such as Touch 'n Go eWallet and Boost, or bank payment gateways) solely to process your deposits and withdrawals.
• KYC and identity verification providers: ob9 uses accredited third-party identity verification services to perform KYC checks. These providers process your identity document data under strict confidentiality obligations.
• Game providers: ob9 hosts games from third-party game studios. Your gaming session data (stakes, outcomes) may be transmitted to the relevant provider's platform for the purpose of game delivery. Game providers are prohibited from using this data for any purpose other than game operation.
• Regulatory and law enforcement authorities: ob9 may disclose personal data to our licensing authority, financial intelligence units, or law enforcement agencies where required by law or as part of an AML investigation.
• Fraud prevention networks: ob9 participates in industry fraud prevention networks. Indicators of suspected fraud may be shared with these networks in anonymised or pseudonymised form.

5.2 All third parties with whom ob9 shares personal data are required to implement appropriate data protection measures and to use your data only for the specified purpose.

6. International Transfers

6.1 ob9's Platform infrastructure and some third-party service providers may be located outside of Malaysia. Where personal data is transferred internationally, ob9 ensures that appropriate safeguards are in place, including contractual data protection obligations consistent with recognised international data transfer standards.

6.2 If you have questions about the specific safeguards applied to any international transfer of your data, please contact ob9 at [email protected].

7. Cookies & Tracking Technologies

7.1 ob9 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function, including session management, login authentication, and security tokens. These cannot be disabled.
• Functional cookies: Enable personalisation features such as remembering your preferred language, game category, and display settings.
• Analytics cookies: Used by ob9 to understand aggregate Platform usage patterns — for example, which game categories are most popular or which pages have high exit rates. Analytics data is processed in aggregate and is not linked to individual player identities.

7.2 ob9 does not use advertising or retargeting cookies that track your behaviour across third-party websites.

7.3 You may configure your browser to refuse cookies; however, doing so may impair the functionality of the ob9 Platform, including the ability to maintain a logged-in session.

8. Data Retention

ob9 retains personal data for the following periods, unless a longer period is required by law:

• Account and identity data: For the duration of your ob9 account plus five (5) years following account closure, to comply with AML record-keeping obligations.
• Financial transaction data: Five (5) years from the date of each transaction, consistent with applicable financial compliance requirements.
• Gaming activity data: Three (3) years from the date of each gaming session, for dispute resolution and responsible gaming monitoring purposes.
• Customer support communications: Two (2) years from the date of the communication.
• Technical and device data (logs): Ninety (90) days, unless extended where fraud or security investigation is ongoing.

Upon expiry of the applicable retention period, ob9 will securely delete or anonymise the relevant personal data.

9. Security Measures

ob9 implements the following technical and organisational measures to protect your personal data:

• 256-bit SSL/TLS encryption on all data in transit between your browser and ob9.asia
• Encryption of sensitive data fields (passwords, identity document numbers) at rest
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need
• Regular internal and third-party security audits and penetration testing
• Automated monitoring for suspicious login patterns and account activity
• Incident response procedures for data breaches, including player notification where required by applicable law

Notwithstanding the above, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. ob9 will notify affected players and relevant authorities without undue delay in the event of a personal data breach that poses a risk to your rights.

10. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ob9:

• Right of access: You may request a copy of the personal data ob9 holds about you.
• Right of rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to ob9's legal retention obligations.
• Right to restriction of processing: You may request that ob9 restrict processing of your personal data in certain circumstances, for example while a rectification request is being resolved.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting prior lawful processing.
• Right to object: You may object to processing based on legitimate interests. ob9 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, contact ob9 at [email protected] or via live chat. ob9 will respond to verified requests within 30 calendar days. We may request proof of identity before processing a data rights request.

11. Children & Minors

The ob9 Platform is strictly intended for individuals who are 21 years of age or older. ob9 does not knowingly collect personal data from persons under the age of 21. If ob9 determines that personal data has been collected from a minor, that data will be deleted immediately and the associated account will be closed. If you believe a minor has registered an ob9 account, please contact ob9 support immediately at [email protected].

12. Changes to This Policy

ob9 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. Any material changes will be communicated to registered players via email to the address on record, and a notice will be displayed on ob9.asia for a reasonable period following the update. The "Last updated" date at the top of this Policy will be revised accordingly. Continued use of the Platform following notification of changes constitutes acceptance of the revised Policy.

13. Contact & Complaints

For any questions, data rights requests, or complaints regarding this Privacy Policy or ob9's data handling practices, please contact:

• Live Chat: Available 24/7 on ob9.asia — response under 2 minutes.
• Email: [email protected] — response within 4 hours.

If you are not satisfied with ob9's response to a privacy complaint, you may escalate the matter to the relevant data protection authority or to the dispute resolution body designated under ob9's gaming licence.