Data & Privacy
Privacy Policy
ob9 is committed to protecting your personal data. This Privacy Policy explains what we collect, why we collect it, how we use and safeguard it, and the rights you hold over your own information.
Last Updated: 1 January 2026 · Version 2.0Our Privacy Principles
How We Think About Your Data
These six principles guide every data decision we make at ob9. They are not a substitute for the full policy below, but they reflect our baseline commitments to every player.
Minimum Collection
We collect only the personal data that is strictly necessary to operate your account, process transactions, verify your identity, and comply with our legal obligations. Nothing more.
Secure Storage
All personal data is stored on encrypted servers protected by 256-bit SSL, access controls, and regular security audits. Your data is never stored in plain text or in unprotected environments.
No Data Sales
ob9 does not sell, rent, or trade your personal data to third parties for commercial purposes. Your information is not an inventory item — it belongs to you.
Full Transparency
We tell you clearly what data we hold, why we hold it, who we share it with, and how long we keep it. If you ask to see your data, we will provide it promptly and at no charge.
Your Control
You have the right to access, correct, restrict, object to, and request deletion of your personal data at any time. We respect and honour these rights within the timeframes required by law.
Limited Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations.
User Rights
Your Data Rights at ob9
As an ob9 user, you hold meaningful rights over your personal data. These apply regardless of your location and can be exercised at any time by contacting our support team.
Right of Access
Request a copy of all personal data ob9 holds about you. We will respond within 30 days at no charge.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held in your ob9 account.
Right to Erasure
Request deletion of your personal data where it is no longer necessary or where you withdraw consent, subject to legal retention obligations.
Right to Restriction
Request that we restrict processing of your data in certain circumstances, for example whilst a correction request is being resolved.
Right to Object
Object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
Right to Portability
Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Right to Complain
Lodge a complaint with the relevant data protection supervisory authority in your jurisdiction if you are dissatisfied with how we handle your data.
1. Introduction
This Privacy Policy (the "Policy") is issued by ob9 (hereinafter referred to as "ob9", "we", "us", or "the Company"), the operator of the online gaming platform accessible at https://ob9.cam (the "Platform").
We are committed to protecting the privacy and personal data of all individuals who use our Platform and Services — including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. This Policy explains what personal data we collect, the purposes for which we process it, with whom we may share it, how long we retain it, and the rights available to you in respect of your personal data.
This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, all of which form part of the legal framework governing your relationship with ob9.
IMPORTANT: By registering an account or accessing our Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the collection and processing of your personal data as described herein, please do not use our Platform or Services.
2. Definitions
For the purposes of this Policy, the following terms shall have the meanings set out below:
3. Data Controller
3.1 ob9 acts as the Data Controller in respect of personal data collected through the Platform. As Data Controller, ob9 is responsible for determining why and how your personal data is processed.
3.2 For all data-related enquiries, requests, and complaints, you may contact our Data Protection team directly via the contact details set out in Section 16 of this Policy.
4. Data We Collect
ob9 collects the following categories of personal data from users of the Platform:
4.1 Identity & Contact Data
- Full legal name as it appears on your Malaysian NRIC (MyKad), passport, or driver's licence
- Date of birth and nationality
- Malaysian NRIC number or passport number
- Residential address (including city and postcode)
- Email address and mobile phone number
4.2 Financial & Transaction Data
- Deposit and withdrawal records, including amounts in MYR, transaction reference numbers, and timestamps
- Payment method details (e.g., Touch 'n Go eWallet account identifier, Boost account, GrabPay identifier, bank account number suffix, DuitNow reference, FPX transaction data)
- Account balance history and wagering records
- Bonus and promotion redemption history
4.3 Technical & Usage Data
- IP address, device type, operating system, and browser type
- Pages visited, session duration, click-path data, and feature usage patterns
- Login timestamps and geographic location data (derived from IP address)
- Error logs and performance data
4.4 KYC & Verification Data
- Copies of identity documents (NRIC, passport, driver's licence)
- Proof of address documents (utility bills issued by Tenaga Nasional, Syabas, or Indah Water; bank statements)
- Selfie photographs taken for liveness verification
- Source of funds declarations where required by our AML compliance procedures
4.5 Communications Data
- Records of your communications with our support team via live chat and email
- Feedback, complaints, and survey responses
- Marketing preferences and opt-in/opt-out records
Special Category Data: ob9 does not intentionally collect special category data (e.g., health information, political opinions, religious beliefs). If you disclose such information voluntarily — for example, in relation to a responsible gambling request — we will treat it with the highest level of care and will process it only to the extent strictly necessary to fulfil your request.
5. How We Collect Your Data
ob9 collects personal data through the following means:
- Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions.
- Automatically: Through cookies, server logs, and tracking technologies when you access or interact with our Platform.
- From third parties: From identity verification service providers, payment processors (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong), fraud detection agencies, and KYC verification partners — all of whom are contractually bound to process data only in accordance with our instructions and applicable law.
6. Legal Basis for Processing
We process your personal data on one or more of the following legal bases, as applicable:
- 6.1 Contract performance: Processing necessary to register your account, process deposits and withdrawals, and deliver our gaming services to you.
- 6.2 Legal obligation: Processing necessary to comply with KYC, AML, and other regulatory requirements imposed by applicable law.
- 6.3 Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement — where these interests are not overridden by your rights.
- 6.4 Consent: Processing for direct marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time.
7. How We Use Your Personal Data
ob9 uses your personal data for the following purposes:
8. Data Sharing & Disclosure
8.1 ob9 does not sell, rent, or trade your personal data to any third party for commercial gain.
8.2 We may share your personal data with the following categories of recipients strictly on a need-to-know basis:
- Payment processors: Malaysian payment partners including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong — solely for the purpose of processing your transactions.
- KYC and identity verification providers: Third-party identity verification services engaged to perform age and document verification as required by our regulatory obligations.
- Fraud prevention and AML service providers: Agencies that help us identify, prevent, and investigate fraudulent activity and money laundering.
- Technology and infrastructure providers: Cloud hosting, database, and security service providers who process data on our behalf under strict data processing agreements.
- Legal and regulatory authorities: Courts, law enforcement agencies, regulatory bodies, or government authorities where disclosure is required or permitted by applicable law.
- Professional advisers: Lawyers, auditors, and insurers where disclosure is reasonably necessary in the course of professional services.
8.3 All third-party Data Processors engaged by ob9 are required to maintain appropriate technical and organisational security measures and are prohibited from using your personal data for their own independent purposes.
9. Cookies & Tracking Technologies
9.1 ob9 uses cookies and similar tracking technologies on our Platform to improve your user experience, maintain your session, analyse usage patterns, and support security and fraud prevention functions.
9.2 The main categories of cookies we use are:
- Strictly necessary cookies: Essential for the Platform to function — for example, maintaining your login session. These cannot be disabled.
- Performance and analytics cookies: Help us understand how users interact with the Platform, which pages are most visited, and where technical improvements are needed.
- Functional cookies: Remember your preferences, language settings, and other personalisation choices.
- Security cookies: Detect and prevent fraudulent activity and unauthorised account access.
9.3 You may configure your browser to refuse cookies or to alert you when cookies are being set. Please note that disabling certain cookies may affect the functionality of the Platform. ob9 does not currently respond to browser "Do Not Track" signals.
10. Data Retention
10.1 ob9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations.
10.2 As a general guide:
- Account and KYC data: Retained for a minimum of 5 years from the date of account closure, in compliance with AML regulatory requirements.
- Transaction records: Retained for a minimum of 7 years in compliance with financial record-keeping obligations.
- Support communications: Retained for 3 years from the date of the communication.
- Marketing preferences: Retained until you withdraw consent or until 2 years of account inactivity, whichever is earlier.
- Technical and usage data: Generally retained for 13 months on a rolling basis for analytics purposes.
10.3 Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that renders it irrecoverable.
11. Data Security
11.1 ob9 implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction.
11.2 Our security measures include, but are not limited to: 256-bit SSL/TLS encryption for all data in transit; encryption of sensitive data at rest; role-based access controls limiting staff access to personal data on a strict need-to-know basis; regular penetration testing and security assessments; and multi-factor authentication for internal administrative systems.
11.3 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, ob9 will notify the relevant supervisory authority and, where required, the affected individuals, within the timeframes prescribed by applicable law.
Your Role in Security: You are responsible for maintaining the confidentiality of your account credentials. Please use a strong, unique password for your ob9 account and enable two-factor authentication where available. If you suspect unauthorised access to your account, contact our 24/7 support team immediately.
12. International Data Transfers
12.1 ob9 operates globally, and your personal data may be transferred to and processed in countries outside Malaysia. When we transfer personal data internationally, we ensure that appropriate safeguards are in place — including standard contractual clauses, data processing agreements, or other mechanisms recognised under applicable data protection law — to ensure that your data receives an equivalent level of protection.
12.2 By using our Platform, you consent to the transfer of your personal data to jurisdictions outside Malaysia as described in this Policy.
13. Children's Privacy
13.1 Our Platform and Services are strictly intended for adults aged 21 years and above. ob9 does not knowingly collect personal data from any individual under the age of 21.
13.2 If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on our Platform, please notify us immediately via the contact details in Section 16.
14. Exercising Your Data Rights
14.1 You may exercise any of the data rights described in this Policy by submitting a request to our Data Protection team. Please refer to Section 16 for contact details.
14.2 To protect your privacy and account security, we may need to verify your identity before processing your request. We will acknowledge receipt of your request promptly and will aim to respond substantively within 30 calendar days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you accordingly.
14.3 ob9 will not charge a fee for processing data rights requests unless the request is manifestly unfounded, repetitive, or excessive — in which case we reserve the right to charge a reasonable administrative fee.
14.4 Please note that certain rights are subject to limitations. For example, we may be unable to delete data that we are legally required to retain, or data the retention of which is necessary for the establishment, exercise, or defence of legal claims.
15. Updates to This Privacy Policy
15.1 ob9 may update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. The most current version of this Policy will always be accessible on our Platform, with the "Last Updated" date reflecting the date on which the most recent changes took effect.
15.2 Where a material change is made to this Policy, we will make reasonable efforts to notify registered users via email or an in-Platform notification at least 7 days prior to the change taking effect.
15.3 Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of those revisions. We encourage you to review this Policy periodically.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by ob9, please contact our Data Protection team through any of the following channels:
- Live Chat: Available 24/7 directly within the ob9 Platform — the fastest method of contact.
- Email (plain text — not a clickable link): [email protected]
Please include the subject line "Privacy Request" along with your registered account email address so that we can locate your records promptly. We will respond to all privacy-related enquiries within the timeframes prescribed by applicable data protection law.
Note: All email addresses on this page are displayed as plain text only and are not clickable links. Please type the address manually into your email client. ob9 will never ask you to provide your password, payment card details, or full NRIC number via email.