Privacy Policy

9kelap collects personal data through several channels — directly from you during registration and account use, automatically through your device and browser, and from third-party services we engage for identity verification and payment processing.

3.1 — Data Provided Directly by You

• Registration Data: Full name, date of birth, email address, mobile phone number, and chosen username provided when creating your 9kelap account.
• Identity Verification (KYC) Documents: A copy of your government-issued identity document (e.g., MyKad, passport, or driving licence) and a proof of address document, collected to fulfil compliance obligations.
• Payment & Financial Information: Details of the payment method used for deposits and withdrawals — including e-wallet account identifiers (Touch 'n Go, Boost, GrabPay) and bank account numbers (Maybank, CIMB, Public Bank, Hong Leong) — processed to execute your transactions.
• Support Communications: Records of your interactions with our customer support team via live chat or email, including the content of messages submitted to [email protected].
• Voluntary Information: Any additional personal information you choose to provide, such as preferences submitted through account settings or feedback forms.

3.2 — Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL collected automatically when you visit the Platform.
• Usage Data: Pages visited, features accessed, session duration, click paths, game sessions initiated, and wagers placed — used to understand how Members use the Platform and to improve the experience.
• Location Data: Approximate geographic location derived from your IP address, used for jurisdiction compliance checks to verify that you are not accessing the Platform from a restricted territory.
• Cookie Data: Session identifiers, preference tokens, and analytics data stored in your browser. See Section 9 for full details on our cookie practices.

3.3 — Data Received from Third Parties

• Payment Processors: Transaction confirmation data received from payment gateway providers including DuitNow, FPX, and e-wallet operators to verify that deposits have been received and that withdrawals have been delivered.
• Fraud Prevention Services: Risk signals and device fingerprint data received from third-party fraud screening services used to protect the Platform and its Members against fraudulent activity.
• Identity Verification Providers: Confirmation responses from document authentication services engaged to support the KYC process.

The following table summarises the primary purposes for which 9kelap processes your personal data and the corresponding lawful basis for each processing activity:

9kelap processes personal data on the following lawful grounds:

• Contract Performance: Processing that is necessary to deliver the services you have registered for, including account management, game access, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and responding to lawful requests from competent authorities.
• Legitimate Interests: Processing undertaken to serve the legitimate interests of 9kelap, including fraud prevention, platform security, analytics, and responsible gambling monitoring, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for purposes where your explicit, specific consent has been obtained — primarily for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

9kelap does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We share data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Service Providers: We share transactional data with payment processors — including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong — to execute deposit and withdrawal transactions. These processors act as Data Processors under binding data processing agreements.
• Identity Verification & KYC Providers: Your identity documents and personal information are shared with licensed identity verification service providers to fulfil our KYC obligations. These providers process your data on our instructions only.
• Fraud Prevention Partners: Technical data including device identifiers, IP addresses, and behavioural signals may be shared with fraud prevention service providers to detect and prevent fraudulent activity on the Platform.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required or compelled to do so by a valid legal order.
• Group Companies & Technology Partners: We may share data with affiliated entities or technology service providers who assist in operating the Platform, under strict confidentiality obligations.

9kelap retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained throughout the active life of your account and for a period of five (5) years following account closure, to comply with AML record-keeping obligations.
• KYC & Identity Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with anti-money laundering regulations.
• Transaction Records: All deposit and withdrawal records are retained for a minimum of five (5) years for financial compliance purposes.
• Support Communications: Customer support chat logs and email correspondence retained for two (2) years from the date of the interaction, or longer if related to an active dispute.
• Marketing Data: Email addresses held for marketing purposes retained until consent is withdrawn. Upon unsubscription, marketing data is removed within 30 days.
• Cookie & Analytics Data: Session cookies expire at the end of your browser session. Persistent analytical cookies expire after a maximum of 13 months.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised. Whereisation is applied, the resulting data no longer constitutes personal data and may be retained for statistical or analytical purposes indefinitely.

9kelap implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

• 256-bit SSL Encryption: All data transmitted between your browser and our servers is encrypted using industry-standard 256-bit SSL/TLS protocols. A valid HTTPS connection is enforced across all pages of the Platform.
• Data Encryption at Rest: Sensitive personal data stored in our databases is encrypted at rest using AES-256 encryption to prevent exposure in the event of any infrastructure breach.
• Two-Factor Authentication (2FA): Available to all Members and strongly encouraged. 2FA adds a second layer of identity verification to protect account access even if login credentials are compromised.
• Access Controls: Access to personal data within our organisation is strictly limited on a need-to-know basis. All staff with data access undergo regular privacy and security training.
• Penetration Testing: Our infrastructure is subject to regular independent security audits and penetration testing to identify and remediate vulnerabilities proactively.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected individuals and relevant authorities within the timeframes required by applicable law.

9kelap uses cookies and similar tracking technologies to enable essential Platform functionality, maintain your session, remember your preferences, and collect aggregate analytics data that helps us understand and improve the user experience.

Categories of cookies we use:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session cookies that maintain your logged-in state, authentication tokens, and security cookies. These cookies cannot be disabled without impairing core Platform functionality.
• Analytics Cookies: Used to collect aggregate, anonymised data on how visitors interact with the Platform — including pages visited, session duration, and navigation paths. This data is used solely to improve the Platform experience.
• Functional / Preference Cookies: Store your language preferences, display settings, and other customisation choices to provide a more personalised experience on return visits.

You may control cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect your ability to use some features of the Platform. Instructions for managing cookies can be found in your browser's help documentation.

As a data subject, you hold a range of rights in relation to the personal data we hold about you.9kelap is committed to facilitating the exercise of these rights in a timely and transparent manner.

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (e.g., AML record-keeping requirements which may prevent full erasure).
• Right to Restrict Processing: You may request that we temporarily restrict the processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of these rights, please submit a written request to our Data Protection contact at [email protected] with the subject line "Data Rights Request". We may require identity verification before processing your request to prevent unauthorised data access.

The 9kelap Platform is strictly intended for adults aged21 years and above. We do not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

During the registration process, all prospective Members are required to confirm that they are of legal gambling age. Where we have reasonable grounds to suspect that an account belongs to an individual under 21, we will immediately suspend the account, withold any balance pending investigation, and initiate enhanced age verification procedures.

If you are a parent or guardian and believe that your child may have registered an account on the 9kelap Platform, please contact us immediately at [email protected]. We will investigate the matter promptly and take appropriate action, including account closure and deletion of the minor's personal data where legally permissible.

We strongly encourage parents and guardians to make use of parental control software to restrict access to online gaming platforms on shared devices.

In the course of operating the Platform, it may be necessary to transfer your personal data to servers or service providers located outside of Malaysia. Where such transfers occur, 9kelap ensures that appropriate safeguards are in place to protect the security and integrity of your data.

Applicable safeguards include but are not limited to: standard contractual clauses incorporated into data processing agreements with international service providers, binding corporate rules where applicable, and adequacy assessments of the recipient country's data protection framework.

Where we engage third-party payment processors such as DuitNow or FPX, these transactions are processed primarily within Malaysia's domestic banking infrastructure and are subject to Bank Negara Malaysia's regulatory oversight.

9kelap reserves the right to update, amend, or replace this Privacy Policy at any time in response to changes in applicable law, our data processing practices, or the services we offer. When material changes are made, we will update the "Last Updated" date displayed at the top of this document and, where practicable, notify active Members via their registered email address or through an in-platform notification.

Your continued use of the Platform following the posting of any amended Privacy Policy constitutes your acceptance of the revised terms. We therefore recommend that you revisit this page periodically to stay informed of any updates. All previous versions of this Policy are available upon request by contacting [email protected].

If you have any questions, concerns, or complaints regarding this Privacy Policy or 9kelap's data processing practices, or if you wish to exercise any of your data subject rights, please contact us using the details below. All data-related inquiries are handled with care and responded to within the timeframes required by applicable law.