Privacy Policy

Introduction

This Privacy Policy ("Policy") sets out the data protection practices of KU9 ("KU9", "we", "us", "our"), the operator of the online gaming platform accessible at ku9.casa. KU9 provides online casino games, sports betting, live dealer tables, slots, and associated gaming services primarily to users resident in Malaysia.

We understand that your personal information is important. This Policy explains in clear terms: what categories of personal data KU9 collects from you; the purposes for which that data is processed; the legal grounds on which processing is based; with whom data may be shared; how long we retain it; and the rights available to you as a data subject.

This Policy applies to all personal data collected through the KU9 website, mobile interfaces, customer support interactions, payment processing flows, and any other service channel through which KU9 obtains personal information about you. It should be read in conjunction with KU9's Terms & Conditions.

By registering a KU9 account or continuing to use the platform after the effective date of this Policy, you acknowledge that you have read and understood its contents. If you do not agree with how KU9 processes personal data as described herein, you must not use the platform.

Definitions

The following terms carry the meanings assigned to them below throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including but not limited to name, identification number, contact details, financial data, location data, and online identifiers.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Controller" — KU9, the entity that determines the purposes and means of the processing of personal data collected through the platform.
• "Processor" — any third party that processes personal data on behalf of KU9 under contractual obligation, such as payment service providers and KYC verification partners.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for one or more specified purposes.
• "KYC" — Know Your Customer, the identity verification process required by KU9 prior to processing certain account activities, particularly first withdrawals.
• "Cookies" — small text files placed on a user's device by the KU9 platform or its authorised third-party service providers for purposes of session management, analytics, or preference storage.

Personal Data We Collect

KU9 collects personal data through multiple channels: directly from you when you register, verify your identity, make deposits or withdrawals, contact support, or participate in promotions; automatically from your device and browser as you use the platform; and, where applicable, from authorised third-party verification services.

The following table summarises the categories of personal data we collect and the primary sources of each:

How We Process Your Data

KU9 processes personal data for the following purposes:

4.1 Account Registration and Management

Personal data is used to create and manage your KU9 account, verify your identity, enforce the platform's minimum age requirement of 21 years, process your login sessions, and administer your account settings and preferences.

4.2 Payment Processing

Financial data and associated identity information are processed to execute deposits and withdrawals in MYR via Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency assets including BTC and USDT. Transaction records are maintained for financial reconciliation and regulatory compliance purposes.

4.3 Anti-Money Laundering and Fraud Prevention

KU9 is required by applicable regulatory frameworks to monitor transactions for indicators of money laundering, fraud, and other financial crimes. Personal data including identity documentation, transaction history, and IP address information may be processed for this purpose, and relevant data may be reported to regulatory authorities where legally required.

4.4 Customer Support

Communication data from live chat, email, and support tickets is processed to respond to your enquiries, resolve account issues, and improve the quality of our support services. Support interaction records may be retained for training and quality assurance purposes.

4.5 Responsible Gambling Monitoring

Usage data and behavioural patterns are analysed to identify potential indicators of problem gambling behaviour. This processing supports KU9's responsible gambling programme and may result in proactive outreach or the application of account limits where KU9 considers this appropriate in the interests of player welfare.

4.6 Marketing Communications

With your consent, contact data and marketing preference data are used to send promotional communications about KU9 offers, bonuses, and platform updates. You may withdraw consent and unsubscribe from marketing communications at any time through your account settings. Withdrawal of marketing consent does not affect the processing of data for other purposes.

4.7 Platform Security and Technical Operations

Technical data is processed to maintain platform security, detect and prevent unauthorised access, investigate security incidents, and optimise platform performance for Malaysian users across all devices and networks.

Legal Basis for Processing

KU9 processes personal data only where a valid legal basis exists. The applicable legal bases are:

• Contractual necessity — processing required to fulfil our contractual obligations to you under the Terms & Conditions, including account management, payment processing, and game provision.
• Legal obligation — processing required to comply with applicable laws and regulations, including anti-money laundering obligations, age verification requirements, and regulatory reporting duties.
• Legitimate interests — processing carried out for purposes that are necessary for KU9's legitimate business interests, including fraud prevention, platform security, and responsible gambling monitoring, provided these interests are not overridden by your fundamental rights and freedoms.
• Consent — processing of your data for direct marketing communications, where we have obtained your explicit opt-in consent prior to sending such communications.

Data Sharing with Third Parties

KU9 does not sell, rent, or trade personal data to third parties for their own commercial or marketing purposes. Personal data is shared with external parties only in the following circumstances:

6.1 Authorised Service Providers

KU9 engages third-party processors to support platform operations, including payment gateway providers (processing transactions via Maybank, CIMB, FPX, DuitNow, e-wallets), KYC and identity verification service providers, cloud hosting infrastructure providers, customer support platform providers, and analytics service providers. All such processors are bound by contractual data processing agreements that restrict their use of personal data to the specific purposes for which it was shared.

6.2 Regulatory and Legal Authorities

KU9 may disclose personal data to relevant regulatory bodies, law enforcement agencies, or other competent authorities where required by applicable law, court order, or regulatory direction — including in connection with anti-money laundering investigations or fraud prevention activities.

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or other corporate restructuring involving KU9, personal data held by KU9 may be transferred to the successor entity. Users will be notified of any such transfer and of any changes to data processing arrangements that result from it.

Data Retention

KU9 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as general guidelines:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping obligations.
• Financial and transaction records: Retained for a minimum of six (6) years following the relevant transaction date, consistent with applicable financial record-keeping requirements.
• KYC documentation: Retained for the period required by applicable regulatory obligations, which is typically not less than five (5) years from the date of verification.
• Customer support communications: Retained for up to three (3) years from the date of the interaction, for quality assurance, dispute resolution, and regulatory reference purposes.
• Technical and usage data (logs): Retained for up to twelve (12) months from the date of collection, except where longer retention is required for security investigation purposes.
• Marketing consent records: Retained for the period of the active account relationship and for a reasonable period following consent withdrawal, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with KU9's data disposal procedures.

Cookies & Tracking Technologies

KU9 uses cookies and similar tracking technologies on the platform to enable core functionality, improve performance, and — with your consent — to collect analytics data about how the platform is used.

8.1 Essential Cookies

These cookies are strictly necessary for the platform to function and cannot be disabled. They include session authentication tokens, security cookies, and load-balancing identifiers. No consent is required for the placement of essential cookies.

8.2 Analytics Cookies

With your consent, KU9 uses analytics cookies to collect anonymised or pseudonymised data about how users interact with the platform — including pages visited, session duration, device type, and geographic region (city level only, e.g., Kuala Lumpur, Petaling Jaya, Shah Alam). This data helps KU9 improve platform design and user experience.

8.3 Preference Cookies

Preference cookies store your platform settings such as language selection and display preferences. These are placed only where necessary for the delivery of a consistent user experience.

8.4 Managing Cookies

You may control cookie preferences through your browser settings. Note that disabling essential cookies may prevent certain platform features from functioning correctly. You may also adjust analytics cookie preferences at any time through the platform's cookie preference centre.

Data Security

KU9 implements comprehensive technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and KU9's servers;
• Encryption of sensitive personal data and financial records stored in KU9's databases at rest;
• Access controls restricting personal data access to authorised personnel on a strict need-to-know basis;
• Regular security assessments, vulnerability scanning, and penetration testing of platform infrastructure;
• Incident response procedures enabling prompt detection, containment, and reporting of any personal data breach;
• Staff training on data protection obligations and information security best practices.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, KU9 will notify affected individuals and relevant authorities in accordance with applicable requirements.

Your Data Subject Rights

Subject to applicable data protection law, you hold the following rights with respect to your personal data processed by KU9. To exercise any of these rights, please contact KU9's support team via live chat or email as described in Section 14 of this Policy.

KU9 will respond to all valid data subject requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, with prior notification. KU9 reserves the right to verify your identity before processing any data subject request.

Protection of Minors

KU9 strictly prohibits the use of its platform by any individual under the age of 21 years. KU9 does not knowingly collect personal data from individuals below this age. The KYC verification process is designed to identify and reject registrations from underage individuals.

If KU9 becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately suspended, all data will be deleted in accordance with applicable law, and any associated balances will be forfeited. If you have reason to believe that a minor has registered an account on the KU9 platform, please contact our support team immediately.

International Data Transfers

KU9's platform infrastructure and certain service providers may be located outside Malaysia. Where personal data is transferred to jurisdictions outside Malaysia, KU9 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that afforded under applicable Malaysian data protection law.

Such safeguards may include: adequacy determinations by relevant authorities confirming an equivalent level of data protection in the recipient country; standard contractual clauses binding the recipient to appropriate data protection obligations; or other legally recognised transfer mechanisms. Details of the safeguards in place for specific international transfers are available on request from KU9's support team.

Policy Amendments

KU9 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform operations. All amendments will be published on this page with an updated effective date. Where changes are material — meaning they substantially affect the way we process your personal data or your rights in relation to that data — KU9 will provide advance notice via email to your registered address and/or a prominent notice on the platform.

Your continued use of the KU9 platform following the effective date of any amended Policy constitutes your acknowledgement of the changes. If you do not agree with any amendment, you may request account closure in accordance with the procedure described in KU9's Terms & Conditions.

Contact Us & Data Protection Enquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or KU9's handling of your personal data, please contact us using the details below. KU9 is committed to resolving privacy-related enquiries promptly and transparently.

When submitting a data subject rights request, please provide sufficient information to enable KU9 to verify your identity and locate the relevant records. KU9 may request supporting documentation before actioning a request. There is no fee for submitting a data subject rights request, unless a request is manifestly unfounded or excessive.