Privacy Policy me9 – Your Data Protection

Me9 collects your personal data only when necessary to provide quality, secure, and legally compliant services. The following are the categories of data we collect:

We do not collect information beyond what the platform's operations require. Any data collected is based on the principle of data minimisation — only what is strictly necessary.

Data collected is used exclusively for the following purposes. We do not use your data for any undisclosed purpose without your prior consent:

• Identity Verification & KYC — ensuring every member is a real individual aged 18 or above who is eligible to use the platform.
• Financial Transaction Processing — verifying deposits, processing withdrawals, and resolving any transaction disputes.
• Account Security — detecting suspicious activity, preventing fraud, and protecting your account from unauthorised access.
• Legal Compliance — fulfilling reporting obligations to regulatory authorities and law enforcement agencies as required by Malaysian law.
• Service Communications — sending important notifications related to your account, transactions, and policy updates.
• Product Improvement — analysing aggregated usage patterns (without identifying individuals) to improve the platform experience.
• Responsible gaming — monitoring betting patterns to identify members who may require additional support or protection.

If you have agreed to receive marketing communications, we may send you promotional information related to me9 offers. You may withdraw this consent at any time through your account settings or by contacting our support team.

Me9 does not sell, rent, or trade your personal data to any third parties. However, in certain situations, we are required to share necessary information with the following parties:

• Payment Service Providers — such as FPX, Touch 'n Go eWallet, GrabPay, and Malaysian banks to securely process your financial transactions.
• Identity Verification Providers — authorised KYC companies that assist us in verifying member identities securely and in compliance with the law.
• Technical Infrastructure Providers — hosting and cloud services that store your data to strict security standards and are bound by confidentiality agreements.
• Regulatory Authorities — Bank Negara Malaysia, the Companies Commission of Malaysia, or other enforcement agencies when required by law.
• Fraud prevention body — to report suspected fraud or money laundering activity in order to protect all platform members.

All third parties who receive your data are bound by strict data protection agreements and may only use that information for purposes specified by me9. We conduct regular reviews of all third-party providers to ensure their security standards continue to meet our requirements.

Me9 continuously invests in security infrastructure to ensure your personal data is protected at every stage — during transmission, processing, and storage.

Key security measures we have implemented include:

• 256-bit SSL/TLS Encryption on all communications between your browser/app and the me9 servers.
• Data Encryption at Rest — all sensitive data such as banking information and identity documents are encrypted within our database.
• Role-Based Access Control — me9 staff may only access data required for their specific role, with a full audit trail maintained.
• 24/7 Monitoring — automated threat detection systems that monitor for any unusual activity in real time.
• Regular penetration testing — independent security assessments conducted periodically by third-party experts to identify and address any vulnerabilities.
• Two-Factor Authentication (2FA) — available for all member accounts to provide an additional layer of security during login.

While we take all reasonable steps to protect your data, no system can be guaranteed 100% secure. You are also responsible for keeping your account password safe and not sharing it with anyone.

Me9 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you browse our website.

Types of cookies we use:

• Essential Cookies — required for core platform functions such as login, session verification, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies — collecting data on how you use the platform (pages visited, session duration) to help us improve the user experience.
• Preference Cookies — saving your preferences such as language and display settings so you do not need to reconfigure them each time.
• Analytics Cookies — aggregated and anonymised data is used to understand overall usage patterns for product improvement purposes.

You can manage or delete cookies through your browser settings at any time. However, disabling essential cookies may affect certain features on the me9 platform. Continued use of our platform is considered your consent to the use of cookies in accordance with this policy.

Me9 retains your personal data only for as long as necessary for the purposes stated in this policy, or as required by applicable Malaysian law.

• Active account data — retained for the duration your account is active plus 7 years after account closure, in accordance with Malaysian financial law requirements.
• Financial Transaction Records — retained for a minimum of 7 years in accordance with the Anti-Money Laundering Act 2001.
• KYC Documents — retained for the period stipulated by the relevant regulatory authorities.
• Technical & Security Logs — retained for 90 days for fraud detection and system security purposes, then automatically deleted.
• Marketing data — retained until you withdraw consent, after which it will be deleted within 30 days.

Once the retention period expires, your data will be securely deleted or anonymised. The deletion process follows industry standards to ensure data cannot be recovered.

As a me9 member and an individual whose personal data we process, you have the following rights under Malaysia's Personal Data Protection Act 2010 (PDPA):

Me9 strictly prohibits use of the platform by individuals under 18 years of age. We do not knowingly collect personal data from minors.

If we discover that personal data of a child has been collected without our knowledge, we will:

• Immediately suspending the account in question for investigation.
• Deleting all data associated with the account as quickly as possible.
• Cancelling all related transactions and wins.
• Reporting the case to the relevant authorities if required.

If you have reason to believe that someone under the age of 18 has registered an account on me9, please contact our support team immediately. We take this matter very seriously and will respond promptly.

Me9 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or technological developments.

When a material amendment occurs:

• The "Updated" date at the top of this page will be revised accordingly.
• A notification will be sent to your registered email address at least 14 days before significant changes take effect.
• For minor clarificatory amendments, changes take effect immediately upon publication.

Continued use of the me9 platform after the effective date of any amendment constitutes your acceptance of the revised policy. We encourage you to review this page periodically. If you do not agree with any amendment, you have the right to close your account and request a withdrawal of your balance.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, we are always ready to help.

You may reach the me9 Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly within the me9 platform or mobile app. This is the fastest way to get a response.
• Email: [email protected] — We aim to respond to all privacy enquiries within 2 business days.

For formal complaints related to data protection, you also have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your privacy rights have been violated.