Privacy Policy – How ob9my Protects Your Data

1. Introduction

ob9my ("we", "us", "our") operates the online gaming platform accessible at ob9my.app ("the Platform"). This Privacy Policy ("Policy") describes how ob9my collects, processes, stores, and protects personal data provided by or collected about users ("you", "the Player") in connection with your use of the Platform.

By registering an account or continuing to use the ob9my Platform, you acknowledge that you have read, understood, and agree to the practices described in this Policy. This Policy should be read together with ob9my's Terms & Conditions, which govern your use of the Platform.

ob9my is committed to handling your personal data responsibly and in accordance with applicable data protection principles, including those consistent with international standards for data privacy in the online gaming industry.

2. Personal Data We Collect

ob9my collects personal data through several channels — directly from you during registration and account use, automatically through your interactions with the Platform, and occasionally from third-party verification or payment service providers.

ob9my does not collect sensitive categories of personal data (such as racial or ethnic origin, religious beliefs, or biometric data) except where strictly required for identity verification purposes, in which case such data is handled with additional safeguards.

3. How ob9my Uses Your Personal Data

ob9my processes your personal data only for defined, legitimate purposes. The primary purposes for which ob9my uses your data are as follows:

• Account Management: To register and maintain your ob9my account, verify your identity and age (21+ requirement), and manage your account security including two-factor authentication.
• Service Delivery: To process deposits and withdrawals via Touch 'n Go eWallet, Boost, DuitNow, FPX, and other approved Malaysian payment methods; to provide access to games, sportsbook, and lottery services.
• Legal & Regulatory Compliance: To comply with applicable anti-money laundering (AML) and know-your-customer (KYC) obligations, including verifying source of funds where required, and to fulfil any reporting obligations to competent authorities.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour and to enforce responsible gaming controls including self-exclusion and deposit limits at the player's request.
• Platform Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, collusion, and other prohibited conduct.
• Communications: To send transactional messages (account notifications, deposit confirmations, withdrawal updates), respond to support enquiries, and — with your consent — send promotional communications about ob9my offers and new products.
• Platform Improvement: To analyse usage data in aggregated and anonymised form to improve the ob9my Platform's performance, user experience, and game selection.

4. Legal Basis for Processing

ob9my processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contract Performance: Processing necessary to provide the ob9my services you have contracted for, including account management, payment processing, and game access.
• Legal Obligation: Processing required to comply with AML, KYC, age verification, and other regulatory requirements applicable to ob9my's operating jurisdiction.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and product analytics, where such interests are not overridden by your data protection rights.
• Consent: Processing for optional communications such as promotional emails or push notifications, which you may withdraw at any time via account settings or by contacting ob9my support.

5. Sharing of Personal Data

ob9my shares your personal data only with categories of recipients who have a legitimate need to receive it in connection with the services provided to you. These recipients include:

• Payment Processors: Providers such as Touch 'n Go, Boost, GrabPay, DuitNow, and FPX-connected Malaysian banks receive the minimum personal and financial data necessary to process your transactions.
• Identity Verification Providers: Third-party KYC and age verification services receive the identity documents and data necessary to complete mandatory verification checks.
• Game Providers: Certified game studios (such as those providing live casino, slots, and sportsbook content to ob9my) may receive a player identifier and session token necessary to initialise and authenticate your gaming sessions.
• Fraud & Security Services: ob9my may share technical and account data with specialist fraud prevention and cybersecurity service providers for platform protection purposes.
• Regulatory & Law Enforcement Authorities: ob9my will disclose personal data to competent authorities where required by law, court order, or regulatory direction without prior notice to you where legally prohibited from doing so.
• Professional Advisers: Legal, accounting, and auditing advisers bound by professional confidentiality obligations may receive limited personal data in the course of providing their services to ob9my.

All third-party data recipients are contractually required to process your data only for the purposes specified, to maintain appropriate security standards, and not to share it further without ob9my's authorisation.

6. Cookies & Tracking Technologies

ob9my uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device. ob9my uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function, including session authentication tokens and security cookies. These cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data on how players use the ob9my Platform — which pages are visited most, where users drop off, and how features perform — to guide platform improvements.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and last-used payment method to improve your experience on return visits.

You may manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect the performance and functionality of the ob9my Platform. The Platform does not use third-party advertising or cross-site tracking cookies.

7. Data Security

ob9my implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit TLS/SSL encryption on all data in transit between your device and ob9my servers
• Encryption of sensitive data at rest within ob9my's database infrastructure
• One-way cryptographic hashing of account passwords — ob9my staff cannot view your password in plain text
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis
• Continuous monitoring for anomalous access patterns and data breach indicators
• Regular security assessments and penetration testing of the ob9my Platform

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ob9my will notify affected players promptly in accordance with applicable data protection obligations.

8. Data Retention

ob9my retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy applicable legal, regulatory, accounting, and reporting requirements. The general principles ob9my applies are:

• Account data is retained for the duration of your ob9my account and for a minimum of five (5) years following account closure, to comply with AML and gaming regulatory record-keeping obligations.
• Transaction and financial records are retained for a minimum of seven (7) years in accordance with standard financial record-keeping practice.
• Communication records including support chat transcripts are retained for three (3) years from the date of the interaction.
• Technical and usage data collected for analytics is retained in anonymised or aggregated form and does not identify individual players.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Your Data Rights

Subject to applicable laws and regulatory obligations, you have the following rights in respect of your personal data held by ob9my:

• Right of Access: You may request a copy of the personal data ob9my holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where ob9my no longer has a legitimate basis for retaining it. Note that regulatory retention obligations may prevent full erasure in some cases.
• Right to Restriction: You may request that ob9my restrict processing of your personal data in certain circumstances, for example while a data accuracy dispute is being resolved.
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to ob9my, for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests. ob9my will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as promotional communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact ob9my's data team via the support email listed in the footer of this page. ob9my will respond to verified requests within 30 days. Identity verification will be required before acting on access or erasure requests.

10. Children's Privacy

The ob9my Platform is strictly for adults aged 21 and above. ob9my does not knowingly collect, process, or store personal data relating to individuals under the age of 21. If ob9my becomes aware that personal data has been submitted by or on behalf of an individual under 21, that data will be deleted and the associated account closed immediately.

If you are a parent or guardian and believe a minor has accessed the ob9my Platform and provided personal data, please contact ob9my support immediately so that the account can be reviewed and the data removed.

11. International Data Transfers

ob9my operates infrastructure and engages service providers located in various jurisdictions. Where your personal data is transferred outside of Malaysia to countries that may not have equivalent data protection standards, ob9my ensures that appropriate safeguards are in place — such as contractual clauses requiring the recipient to protect the data to an equivalent standard — before any such transfer takes place.

12. Changes to This Privacy Policy

ob9my reserves the right to update this Privacy Policy at any time. When material changes are made, ob9my will notify registered players via the email address on file or via an in-platform notification prior to the changes taking effect. The "Last updated" date at the top of this page will be revised to reflect the most recent version.

Your continued use of the ob9my Platform following notification of policy changes constitutes your acknowledgement of the revised Policy. If you disagree with any changes, you should cease using the Platform and contact support to close your account.

13. Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or ob9my's data practices, please contact the ob9my data and privacy team via the support email address listed in the footer of this page. ob9my's customer support team is available 24/7 via live chat on the Platform for general account enquiries.

ob9my will acknowledge all formal privacy-related written requests within 48 hours and provide a substantive response within 30 calendar days. Where a request requires additional verification or involves a complex assessment, ob9my will inform you of the extended timeline and the reason for the delay.