Privacy Policy

Section 01

Introduction

This Privacy Policy ("Policy") describes how GD9 ("the Platform", "we", "us", "our") — the operator of the online gaming services accessible at gd9.cam — collects, processes, stores, shares, and protects personal data relating to individuals ("you", "the User", "the Player") who access or use our website, mobile-optimised interface, or any service offered by the Platform.

GD9 operates as an internationally licensed online gaming platform serving players across multiple markets, including a substantial user base in Malaysia. We are committed to handling personal data responsibly, in accordance with internationally recognised data protection principles and the requirements of our licensing jurisdiction.

By registering an account with GD9, accessing the Site, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the GD9 platform.

Policy Scope

This Policy applies to all personal data collected through the GD9 website, mobile interface, live support channels, email correspondence, and any other interaction you have with the GD9 platform. It does not apply to third-party websites, payment processors, or services that may be linked to or from our platform — each of which operates under its own independent privacy terms.

Section 02

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

Term	Meaning
"Personal Data"	Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data.
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or any combination thereof.
"Data Controller"	GD9, in its capacity as the entity that determines the purposes and means of processing Personal Data collected through the platform.
"Data Processor"	A third party engaged by GD9 to process Personal Data on its behalf, under binding contractual obligations to protect that data.
"Sensitive Data"	A subset of Personal Data carrying heightened risk, including identity document images, payment method details, and KYC verification records.
"Cookie"	A small text file placed on a User's device by the GD9 website for the purpose of session management, analytics, or performance optimisation.
"KYC"	Know Your Customer — the mandatory identity and age verification process applied to all GD9 account holders prior to withdrawal processing.

Section 03

Data We Collect

GD9 collects personal data from several sources in the course of providing its services. The categories of data collected are as follows:

3.1 Registration Data

When you create a GD9 account, we collect the information you provide in the registration form, including:

Full legal name
Date of birth (to verify you are 21 years of age or older)
Email address
Mobile phone number
Residential address (country, city, postcode)
Preferred currency (Malaysian Ringgit — MYR)
Username and encrypted password

3.2 Identity Verification (KYC) Data

Prior to processing your first withdrawal, we are required to collect identity documentation, which may include:

Copy of a valid government-issued photo ID — for Malaysian users, this means a current MyKad, Malaysian Passport, or Driver's Licence
Proof of residential address — utility bill, bank statement, or official correspondence dated within three months
Selfie photograph holding your primary ID document
Proof of payment method ownership (e.g., screenshot of Touch 'n Go eWallet showing registered name)

3.3 Financial Transaction Data

We record data related to all financial activity on your account, including deposit amounts, withdrawal requests, transaction timestamps, and payment method references. We do not store full bank account numbers, card numbers, or e-wallet credentials — these are handled by our regulated payment processor partners.

3.4 Gaming Activity Data

We log your platform activity including game sessions, bet history, wagering patterns, bonus usage, and login/logout times. This data is used for account management, fraud prevention, responsible gambling monitoring, and platform improvement.

3.5 Technical & Device Data

When you access GD9, our systems automatically collect technical information including your IP address, device type, browser type and version, operating system, referring URL, and session duration. This data is used for security, fraud detection, and platform performance optimisation.

3.6 Communication Data

If you contact our support team via live chat, email, or WhatsApp, we retain records of that correspondence for quality assurance, dispute resolution, and regulatory compliance purposes.

Sensitive Data Notice

Identity document images and payment method verification materials are classified as Sensitive Data. They are stored in encrypted, access-restricted repositories with strict internal access controls. GD9 staff who handle Sensitive Data are subject to confidentiality obligations and regular data protection training.

Section 04

Lawful Basis for Processing

GD9 processes personal data only where a valid lawful basis exists. The primary bases applicable to our data processing activities are:

Lawful Basis	Processing Activities Covered
Contractual Necessity	Account registration, identity verification, payment processing, game service delivery, withdrawal handling, and customer support.
Legal Obligation	Anti-money laundering (AML) checks, KYC verification, age verification, fraud investigation, and regulatory reporting to licensing authorities.
Legitimate Interests	Platform security, fraud detection, responsible gambling monitoring, analytics for platform improvement, and internal audit trails.
Consent	Marketing communications, optional promotional updates, and any processing activities for which consent is specifically requested and can be withdrawn at any time.

Section 05

How We Use Your Data

GD9 uses the personal data we collect for the following purposes:

Account Management: To create, maintain, and administer your GD9 account, process deposits and withdrawals in MYR, and deliver the platform services you have requested.
Identity & Age Verification: To confirm that you are at least 21 years of age and that your identity matches the registration details provided, as required by our licensing obligations.
Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, or other conduct prohibited under our Terms & Conditions. This includes monitoring for unusual account behaviour, irregular betting patterns, and suspicious financial transactions.
Responsible Gambling: To monitor gaming behaviour for indicators of problem gambling and to implement player protection tools including deposit limits, cooling-off periods, and self-exclusion, where triggered voluntarily or proactively by our team.
Customer Support: To respond to queries, complaints, and requests submitted by you via live chat, email, or WhatsApp. Support interactions are logged for quality assurance.
Marketing Communications: Where you have provided consent, to send you promotional offers, bonus notifications, and platform updates relevant to your gaming preferences. You may withdraw consent at any time.
Platform Analytics & Improvement: To analyse aggregated, anonymised usage data in order to identify performance issues, optimise the user experience, and guide product development decisions.
Legal & Regulatory Compliance: To fulfil obligations imposed by our licensing authority, respond to lawful requests from competent authorities, and maintain records as required by applicable law.

Section 06

Data Sharing & Disclosure

GD9 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data in the limited circumstances described below:

6.1 Service Providers (Data Processors)

We engage third-party service providers to assist with specific operational functions including payment processing (e.g., FPX gateways, e-wallet providers such as Touch 'n Go, Boost, and GrabPay), KYC verification services, cloud infrastructure and data hosting, live chat software, and fraud detection platforms. All service providers are contractually bound to process your data only on GD9's instructions and to maintain appropriate security standards.

6.2 Legal and Regulatory Authorities

GD9 may disclose personal data to competent regulatory or law enforcement authorities where required to do so by applicable law, court order, or as necessary to fulfil our obligations to our licensing authority. We will notify affected users of such disclosures where we are legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of GD9's assets, personal data may be transferred as part of that transaction. Affected users will be notified via email and/or platform notification in advance of any such transfer, and the acquiring entity will be bound by the terms of this Privacy Policy with respect to your personal data.

6.4 Fraud and Safety

Where GD9 reasonably believes that disclosure is necessary to protect the rights, property, or safety of GD9, its users, or the public — including sharing data with fraud prevention agencies, payment networks, or affiliated gaming platforms in cases of confirmed abuse — we may share relevant personal data to the extent necessary to address the identified risk.

What We Will Never Do

GD9 will never sell your personal data to third-party advertisers, marketing brokers, or data aggregators. We will never share your gaming history, financial records, or identity documents with employers, government agencies without legal compulsion, or other parties without a legitimate, disclosed purpose.

Section 07

Data Retention

GD9 retains personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected, in compliance with our legal and regulatory obligations. The following retention schedule applies:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 5 years after closure	Regulatory / AML compliance
KYC identity documents	5 years from date of submission	Licensing obligation
Financial transaction records	7 years from transaction date	AML / audit requirements
Gaming activity logs	3 years from last session	Fraud prevention / responsible gambling
Support correspondence	2 years from resolution date	Quality assurance / disputes
Technical / device logs	90 days from collection	Security monitoring
Marketing consent records	Until consent withdrawn + 1 year	Legal evidence of consent

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Section 08

Data Security

GD9 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

Encryption in Transit: All data transmitted between users and the GD9 platform is encrypted using TLS 1.2 or higher. HTTPS is enforced across the entire domain.
Encryption at Rest: Sensitive personal data — including KYC documents and payment method records — is encrypted at rest using AES-256 encryption.
Access Controls: Access to personal data is restricted on a strict need-to-know basis. All internal access is authenticated, logged, and subject to periodic review.
Two-Factor Authentication: GD9 staff with access to personal data systems are required to use multi-factor authentication for all system access.
Intrusion Detection: Automated monitoring systems flag suspicious access patterns, brute force attempts, and unusual data export activities.
Vendor Security Assessments: Third-party service providers are assessed for data security compliance before engagement and periodically thereafter.

Notwithstanding these measures, no method of electronic transmission or data storage is completely secure. GD9 cannot provide an absolute guarantee of security and shall not be liable for security breaches resulting from circumstances outside its reasonable control. In the event of a data breach affecting users, GD9 will notify impacted individuals and relevant authorities in accordance with applicable requirements.

Section 09

Cookies & Tracking Technologies

GD9 uses cookies and similar tracking technologies to operate the platform effectively, analyse usage, and maintain session security. The types of cookies we use are described below:

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your logged-in session, remember your language preference, and ensure platform security functions operate correctly.	Session / up to 24 hours
Performance / Analytics	Collect anonymised data about how users navigate the platform — pages visited, features used, error rates — to guide performance improvements.	Up to 13 months
Functional	Remember user preferences such as game lobby view settings and notification preferences between sessions.	Up to 12 months

GD9 does not use cookies to serve third-party targeted advertising or to build behavioural profiles for sale to marketing platforms. You may manage or disable cookies through your browser settings; however, disabling strictly necessary cookies will impair the functionality of the platform and may prevent you from remaining logged in.

Section 10

International Data Transfers

GD9 operates internationally and may process or store personal data on servers located outside Malaysia. Transfers of personal data to third countries are conducted in accordance with the requirements of our licensing jurisdiction and subject to appropriate safeguards, which may include:

Contractual clauses requiring the receiving party to maintain data protection standards equivalent to those applied by GD9.
Transfers to jurisdictions that have been assessed as providing adequate levels of data protection.
Binding corporate rules where data is transferred within affiliated corporate groups.

By using the GD9 platform and accepting this Privacy Policy, you consent to the transfer of your personal data to servers and processors located outside Malaysia for the purposes described in this Policy.

Section 11

Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by GD9. To exercise any of these rights, please contact our support team via live chat or at [email protected]. We will respond within 30 calendar days.

Right of Access

You may request a copy of all personal data GD9 holds about you, along with information about how it is used, where it is stored, and who it has been shared with. We will provide this information in a clear, readable format within 30 days.

Right to Rectification

If any personal data we hold about you is inaccurate or out of date, you have the right to request that it be corrected. You can update basic account information directly from your account settings; for changes to KYC-verified data, please contact support.

Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Note that certain data must be retained for the periods specified in Section 7 to comply with legal and regulatory obligations — in such cases, deletion will be deferred until the applicable retention period expires.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted directly to another data controller where technically feasible.

Right to Object

You may object to the processing of your personal data where GD9 relies on its legitimate interests as the lawful basis. GD9 will cease such processing unless compelling legitimate grounds exist that override your interests, rights, and freedoms.

Right to Restrict Processing

In certain circumstances — for example, where you have contested the accuracy of your data or objected to its processing — you may request that GD9 restrict processing to storage only while the matter is resolved.

Right to Withdraw Consent

Where processing is based on your consent — such as for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, contact our support team or use the unsubscribe function in any marketing email.

Section 12

Children's Privacy

The GD9 platform is strictly for adults aged 21 years and above. GD9 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process.

If GD9 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the relevant account, delete the associated personal data, and reverse any financial transactions to the originating payment method to the extent technically possible.

If you believe a minor has registered on GD9, please contact our support team immediately at [email protected] so that we may investigate and take appropriate action.

Section 13

Third-Party Links

The GD9 platform may contain references or links to third-party services such as payment processors, e-wallet platforms (including Touch 'n Go eWallet, Boost, GrabPay, and DuitNow), or identity verification providers. When you interact with these third-party services, you leave the GD9 environment and are subject to the privacy policies of those third parties.

GD9 is not responsible for the privacy practices of third-party services and does not endorse or make any representation regarding their data handling practices. We encourage you to review the privacy policies of any third-party services you use in connection with your GD9 account.

Section 14

Policy Updates

GD9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the nature of our services. When material changes are made, we will notify you by:

Sending an email to your registered email address at least seven (7) calendar days before the updated Policy takes effect.
Displaying a prominent notice on the GD9 platform for a minimum of 14 days following the effective date.

Continued use of the GD9 platform following the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with any material change, you have the right to close your account before the effective date without penalty.

The date of the most recent revision is displayed at the top of this page. We recommend reviewing this Policy periodically to stay informed of how GD9 handles your personal data.

Section 15

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or GD9's data processing practices, please contact us through one of the following channels:

Channel	Details
Email	[email protected] — for formal data subject requests, privacy complaints, and legal correspondence. Please include "Privacy Request" in the subject line. Response within 5 business days.
Live Chat	Available 24/7 from the GD9 platform. Supported in English, Bahasa Melayu, and Chinese. Average response time 3–5 minutes. Suitable for general privacy queries and data access requests.
Data Subject Requests	To exercise any of the rights listed in Section 11, please contact us via email or live chat stating your registered email address and the specific right you wish to exercise. We will respond within 30 calendar days.

Your Privacy Matters

GD9 takes every privacy inquiry seriously. If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the relevant supervisory authority in your jurisdiction. For Malaysian users, the Personal Data Protection Department (JPDP) is the designated authority under the Personal Data Protection Act 2010 (PDPA). GD9 acknowledges the relevance of the PDPA to Malaysian users' expectations and endeavours to align its practices accordingly.