Privacy Policy — ob9my

This Privacy Policy ("Policy") is issued by ob9my ("we", "us", "our", "the Platform") and governs the collection, processing, storage, and use of personal data provided by or collected from individuals ("you", "Player", "User") who access or use the ob9my platform at ob9my.cam and all associated services.

ob9my takes the privacy of its players seriously. We operate in accordance with applicable data protection laws and international best practices for the handling of personal information in the online gaming industry. This Policy is designed to give you full transparency over how your data is managed from the moment you register an account through to the closure of your relationship with us.

By registering an account, making a deposit, or otherwise using the ob9my platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and request account closure.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or can reasonably be used to identify a living individual, including name, identification number, contact details, financial information, device identifiers, and behavioural data.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Data Controller" — ob9my, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — A third party that processes personal data on behalf of ob9my under contractual instruction, such as a payment gateway provider or KYC verification service.
• "Consent" — A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "KYC" — Know Your Customer. The identity and address verification process required under applicable anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.
• "Cookies" — Small text files placed on your device by the Platform to store preference data, session identifiers, and analytics information.

ob9my collects personal data through several channels. The categories of data we collect include, but are not limited to, the following:

3.1 Registration & Account Data

• Full legal name as it appears on your Malaysian identity document (MyKad or passport).
• Date of birth (used to verify the minimum age requirement of 21 years).
• Malaysian IC number (MyKad) or passport number for identity verification.
• Residential address, including city (such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or Shah Alam).
• Email address and mobile phone number.
• Username and encrypted account password.
• Preferred language and communication preferences.

3.2 KYC & Verification Documents

• Scanned copies or photographs of government-issued identity documents.
• Proof of address documents such as utility bills or bank statements.
• Source of funds documentation where required for enhanced due diligence.
• Selfie or liveness verification images where required by our verification partner.

3.3 Financial & Transaction Data

• Payment method identifiers (e.g., GrabPay account reference, Touch 'n Go eWallet ID, DuitNow registered number, FPX bank account details).
• Deposit and withdrawal transaction history, including amounts in Malaysian Ringgit (MYR).
• Bonus and promotional redemption records.
• Cryptocurrency wallet addresses where applicable (USDT, BTC).

3.4 Gameplay & Behavioural Data

• Betting history across all products — sports, live casino, slots, and other game categories.
• Session duration, login timestamps, and activity patterns.
• Responsible gambling tool usage, including deposit limits and self-exclusion requests.
• Game preferences and platform interaction data.

3.5 Technical & Device Data

• IP address and approximate geolocation data.
• Device type, operating system, and browser version.
• Session cookies, persistent cookies, and unique device identifiers.
• Referring URLs and clickstream data within the Platform.

3.6 Communications Data

• Live chat transcripts and support ticket content.
• Email correspondence with the ob9my support team.
• Survey responses and feedback submissions.

ob9my processes your personal data for the following purposes. Each purpose is supported by a specific legal basis as described in Section 5:

ob9my will not use your personal data for any purpose that is incompatible with those listed above without first obtaining your explicit consent or having a clear legal obligation to do so.

ob9my processes your personal data under one or more of the following legal bases depending on the specific processing activity involved:

• Contractual Necessity: Processing is required to perform the contract between you and ob9my — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing is necessary to comply with applicable laws, including anti-money laundering regulations, responsible gambling obligations, and data retention requirements imposed by our operating licence conditions.
• Legitimate Interests: Processing is necessary for ob9my's legitimate business interests, such as fraud prevention, platform security, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where required, ob9my will seek your explicit consent before processing data for purposes such as marketing communications or the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ob9my does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only where operationally necessary, legally required, or where you have provided explicit consent. The categories of recipients with whom data may be shared include:

• Payment Service Providers: Licensed payment processors and e-wallet operators (including GrabPay, Touch 'n Go, Boost, DuitNow, FPX, and banking partners such as Maybank, CIMB, Public Bank, and Hong Leong Bank) receive the minimum necessary financial data to process your transactions.
• KYC & Identity Verification Partners: Accredited third-party identity verification services that process your identity documents and biometric data to complete KYC checks. These partners operate under strict data processing agreements with ob9my.
• Game Content Providers: Licensed game studios and live casino operators whose games are hosted on the Platform may receive anonymised session and gameplay identifiers for game integrity and RNG certification purposes.
• Fraud Prevention & Risk Services: Specialist fraud detection platforms that analyse transactional patterns and device fingerprints to identify suspicious activity across our player base.
• IT & Infrastructure Providers: Cloud hosting, content delivery network (CDN), and data centre operators who provide the underlying infrastructure on which the Platform operates, under strict security and confidentiality obligations.
• Regulatory & Law Enforcement Authorities: ob9my will disclose personal data to competent regulatory authorities, financial intelligence units, or law enforcement agencies where legally compelled to do so, or where such disclosure is necessary to protect the safety of players or the public.
• Professional Advisors: Legal counsel, auditors, and compliance advisors who process limited personal data in the course of providing professional services to ob9my, under binding confidentiality obligations.

ob9my retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status plus a minimum period of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction Records: Financial transaction histories are retained for a minimum of seven (7) years in accordance with applicable financial regulations, regardless of account status.
• KYC & Identity Documents: Identity verification documents are retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later.
• Support Communications: Live chat transcripts and support email records are retained for a period of three (3) years from the date of the interaction.
• Marketing Data: Data processed solely on the basis of your consent for marketing purposes will be deleted within 90 days of consent withdrawal, subject to any overlapping legal retention obligations.
• Cookie & Analytics Data: Non-essential analytics data is retained in aggregated, anonymised form for up to two (2) years. Session cookies expire upon browser closure. Persistent cookies expire within the timeframes disclosed in Section 9.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be attributed to any individual.

ob9my implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and ob9my's servers is protected by TLS 1.2 or higher with 256-bit AES encryption.
• Encryption at Rest: Sensitive personal data fields — including identity document data and payment identifiers — are encrypted at rest in our databases.
• Access Controls: Access to personal data within ob9my's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• Two-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication.
• Vulnerability Management: ob9my conducts regular penetration testing and security audits of its infrastructure. Identified vulnerabilities are remediated in accordance with a defined patch management policy.
• Incident Response: ob9my maintains a formal data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities within the timeframes required by applicable law.

While ob9my employs robust security measures, no data transmission over the internet can be guaranteed to be 100% secure. Players are responsible for maintaining the security of their own account credentials and for notifying ob9my immediately if they suspect any unauthorised access.

ob9my uses cookies and similar technologies (including local storage objects and pixel tags) on the Platform. These technologies serve the following purposes:

You can manage or delete non-essential cookies at any time through your browser settings. Please note that disabling functional or analytics cookies may affect your experience on the Platform. Detailed instructions for managing cookies are available via the help documentation of your browser (Chrome, Safari, Firefox, Edge, or Samsung Internet on Android).

ob9my does not use cookies to track your activity across third-party websites or to build advertising profiles for sale to external parties.

Subject to applicable law, you hold the following rights in relation to your personal data held by ob9my. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Privacy Request", including your full name, registered email address, and a description of the right you wish to exercise.

• Right of Access: You may request a copy of the personal data ob9my holds about you, together with information about how it is processed. ob9my will respond to access requests within 30 calendar days.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. For account details such as name and address, corrections require supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right is subject to overriding legal retention obligations — for example, AML record-keeping requirements will take precedence over erasure requests.
• Right to Restrict Processing: You may request that ob9my limits the processing of your data to storage only, pending resolution of a dispute about its accuracy or the legitimacy of processing.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Upon receipt of a valid objection to marketing, ob9my will cease marketing communications within 5 business days.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

ob9my's platform and services are strictly intended for individuals aged 21 years and above. ob9my does not knowingly collect personal data from individuals under the age of 21, and it is a fundamental condition of account registration that the Player confirms they meet this minimum age requirement.

Where ob9my discovers or has reasonable grounds to suspect that personal data has been collected from an individual under the age of 21, the following steps will be taken immediately:

• The account will be suspended pending investigation.
• All personal data associated with the account will be permanently deleted from our systems, subject to any overriding legal obligations.
• Any funds deposited via the account will be returned to the originating payment method after identity verification of the account holder.
• The incident will be documented and reviewed by ob9my's compliance team.

If you are a parent or guardian and believe that a minor has registered an account on ob9my, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

ob9my operates globally and some of its third-party service partners — including cloud infrastructure providers, KYC verification services, and game content providers — may be located outside of Malaysia. As a result, your personal data may be transferred to and processed in countries other than Malaysia.

Where such international transfers occur, ob9my ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that which applies within Malaysia. These safeguards include:

• Transferring data only to countries or organisations that provide an adequate level of data protection as recognised by applicable law.
• Entering into standard contractual clauses with data processors in third countries that impose equivalent data protection obligations.
• Applying additional technical measures such as data minimisation and pseudonymisation where feasible to reduce the risk associated with international processing.

Details of the specific transfer mechanisms in place for any given processing activity are available upon request by contacting [email protected].

ob9my reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business operations, or data processing practices. When material changes are made, ob9my will notify registered players via email or an on-Platform notification prior to the changes taking effect.

The "Last Updated" date at the top of this document indicates when the current version of the Policy was published. Players are encouraged to review this Policy periodically to remain informed about how their data is being handled. Continued use of the Platform following the publication of an updated Policy constitutes acceptance of the revised terms.

If you have objections to any amendment to this Policy, you have the right to request account closure and deletion of your personal data, subject to any overriding legal retention obligations as described in Section 7.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the ob9my Data Protection team through any of the following channels:

• Email: [email protected] — please use the subject line "Data Privacy Request" for all data-related enquiries to ensure prompt routing to the correct team.
• Live Chat: Available 24/7 on the Platform in English, Bahasa Melayu, and Chinese. For data subject requests, please ask to be connected to the Data Protection team.

ob9my aims to acknowledge all privacy-related enquiries within 5 business days. For formal data subject rights requests as described in Section 10, a substantive response will be provided within 30 calendar days of receipt.