Super9 Privacy Policy — Protecting Your Personal Data

Super9 ("we", "us", "platform") operates an online casino and sports betting service accessible at super9.cam. As part of that operation we process personal data — information that identifies or can be used to identify a living natural person ("personal data", "personal information").

This Privacy Policy describes the categories of personal data we collect, the legal or operational basis for each type of processing, the purposes for which data is used, how long data is retained, the parties with whom data may be shared, the security safeguards in place, the rights available to data subjects, and how those rights can be exercised.

This Policy should be read alongside the super9 Terms & Conditions. In the event of any inconsistency, the Terms & Conditions govern account and gaming matters while this Policy governs personal data processing.

The following defined terms are used throughout this Policy:

• Account Holder / Player: A person who has registered a super9 account and may deposit funds, place wagers, or use the platform's features.
• Personal Data: Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, IP address, and device identifiers.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, anonymisation, and deletion.
• Controller: The entity that determines the purposes and means of processing personal data — in this context, super9.
• Processor: A third party that processes personal data on behalf of and under the instruction of super9.
• Consent: A freely given, specific, informed, and unambiguous indication of agreement to processing personal data for a stated purpose.
• KYC: Know Your Customer — the identity and document verification procedure applied to account holders.
• MYR / RM: Malaysian Ringgit, the currency in which super9 accounts may be maintained and transacted.

Super9 collects personal data through account registration, ongoing account use, identity verification procedures, and technical interactions with the platform. The categories collected include:

Where you decline to provide information that is required for a mandatory purpose (such as KYC identity documents), super9 may be unable to open or continue operating the relevant account.

Super9 processes personal data on one or more of the following bases:

• Contractual necessity: Processing required to fulfil the player agreement — account creation, wager settlement, MYR payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable law, including anti-money-laundering regulations, identity verification requirements, and lawful requests from competent authorities.
• Legitimate interests: Processing undertaken to protect platform security, prevent fraud and account abuse, improve services, and maintain responsible gambling controls, where such interests are not overridden by the rights of the data subject.
• Consent: Where no other basis applies and consent has been obtained — for example, for optional marketing communications about super9 promotions. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Super9 does not engage in automated decision-making that produces legal or similarly significant effects on a player without a lawful basis and appropriate safeguards.

Super9 uses session cookies, persistent cookies, and similar technologies to maintain login state, remember preferences, detect irregular activity, and analyse aggregate platform usage. The following categories of cookies may be active:

• Strictly necessary cookies: Essential for page navigation, login authentication, and transaction security. These cannot be disabled without breaking core functionality.
• Functional cookies: Store preferences such as chosen language, remembered username, and session settings to improve navigation convenience.
• Analytics cookies: Collect aggregated, anonymised data about page views, session durations, and feature usage to guide platform improvement decisions.
• Security cookies: Detect and help prevent fraudulent activity, account takeover attempts, and unusual access patterns.

Most browsers allow you to manage or delete cookies through their settings. Disabling strictly necessary cookies will affect your ability to log in and use super9 normally.

Super9 does not sell personal data. Information may be shared in the following circumstances:

• Service providers and processors: Payment processors (handling Maybank, CIMB, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay transactions), identity verification specialists, fraud detection providers, cloud hosting partners, and customer support infrastructure providers receive data only to the extent needed to perform their contracted function.
• Game providers and platform integrators: Game suppliers may receive a player session token and relevant gameplay parameters. They do not receive full identity records beyond what is technically necessary.
• Regulatory and law-enforcement authorities: Super9 may disclose data when required by a valid court order, regulatory directive, or applicable law. Where legally permitted, super9 will attempt to inform the affected account holder.
• Corporate restructuring: In the event of a merger, acquisition, or transfer of business assets, personal data may be transferred to the succeeding entity, which will be bound by commitments consistent with this Policy.
• Fraud prevention networks: Super9 may exchange identifiers with recognised fraud-prevention databases to protect accounts and the integrity of real-money gaming.

Any third party receiving personal data from super9 is required to maintain appropriate security measures and to process that data only for the permitted purpose.

Super9 retains personal data for no longer than is necessary for the purposes described in this Policy, subject to legal or regulatory requirements that impose minimum retention periods. General retention principles are:

• Active account data: Retained throughout the period an account remains open and in active use.
• Account and transaction records: Retained for a minimum of five years from the date of the last transaction or account closure to satisfy anti-money-laundering, financial reporting, and dispute-resolution obligations.
• KYC and identity documents: Retained for the period required by applicable law following verification — typically a minimum of five years after account closure.
• Support communications: Retained for a period sufficient to resolve disputes and maintain a quality record, generally three years after the matter is closed.
• Technical and session data: Retained for security analysis and fraud detection for up to twelve months, after which it is anonymised or deleted.

When retention is no longer justified, super9 deletes or anonymises the relevant data using secure methods.

Super9 applies technical and organisational measures proportionate to the sensitivity of personal data and the risk of unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and super9 servers.
• Encryption of sensitive stored fields including payment references and identity document copies.
• Role-based access controls ensuring that staff see only the data necessary for their function.
• Intrusion detection, anomaly monitoring, and regular security assessments.
• Multi-factor authentication options for account access.
• Regular staff training on data protection responsibilities.

No system can guarantee absolute security. Players are also responsible for maintaining the confidentiality of their own login credentials and for reporting any suspected unauthorised access to support promptly.

Depending on applicable law, you may be entitled to exercise one or more of the following rights in relation to your personal data held by super9:

To exercise any of these rights, contact super9 support with the subject line "Data Subject Request", your full registered name, and a clear description of your request. Super9 may need to verify your identity before acting on the request and will respond within the period required by applicable law.

Exercising a privacy right will not result in any restriction of gaming access unless the requested action — such as account deletion — makes continued platform use technically impossible.

Super9 is strictly for players aged 21 and above. We do not knowingly collect personal data from anyone under 21. Age is verified during account registration and through KYC document checks. If super9 discovers that personal data has been collected from a person who is under 21, the account will be closed, pending deposits will be returned where lawfully possible, and all associated data will be deleted except where retention is required for compliance purposes.

Parents and guardians who believe that a minor has accessed super9 should contact support immediately so that appropriate action can be taken without delay.

Super9 may update this Privacy Policy to reflect changes in processing activities, applicable law, regulatory guidance, or platform features. When a material change is made, the revised Policy will be published with an updated effective date. Continued use of super9 after the effective date of a revised Policy constitutes acceptance of those changes.

Players are encouraged to review this Policy periodically. For changes that significantly affect how personal data is used, super9 may provide additional notice through account communication where practical.

All privacy enquiries, data subject access requests, correction requests, erasure requests, objections, and complaints relating to this Policy should be directed to the super9 privacy support team. Please include your full registered name, your account username, and a detailed description of your request or concern.

Email: [email protected] — subject line: "Privacy Policy Enquiry"

Super9 aims to acknowledge all privacy requests within five business days and to provide a substantive response within the period required under applicable law. Complex requests involving large volumes of data or requiring third-party verification may take longer; super9 will communicate an expected timeline in such cases.