Privacy Policy

This Privacy Policy ("Policy") applies to all personal data processed by m9win in connection with the operation of the Platform at https://m9win.vu and any associated mobile-optimised interfaces, customer support channels, and marketing communications. It applies to all registered players, prospective players who have commenced but not completed registration, and visitors who interact with the Platform without creating an account.

m9win is committed to processing personal data lawfully, fairly, and transparently. This Policy has been drafted to meet the standards of internationally recognised data protection frameworks and reflects m9win's commitment to the privacy expectations of players located in Indonesia and across the region.

By registering an account on the m9win Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you should not register an account or continue to use the Platform. This Policy should be read alongside the m9win Terms & Conditions, which govern the overall player-operator relationship.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, IP address, device identifier, payment account details, and behavioural data linked to an identifiable individual.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, m9win.
• "Data Processor" means any third party that processes Personal Data on behalf of and under the instructions of m9win (e.g., payment processors, identity verification providers).
• "Platform" means the m9win website at https://m9win.vu, including all gaming products, account management tools, and customer support interfaces.
• "Player" / "You" means any individual who has registered, is registering, or is otherwise interacting with the m9win Platform.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.

The Data Controller responsible for personal data processed in connection with the m9win Platform is the internationally licensed gaming entity operating the Platform under the m9win brand. All data subject requests, privacy enquiries, and regulatory correspondence relating to data protection should be directed to the m9win Data Protection contact provided in Clause 16 of this Policy.

Where m9win engages third-party Data Processors — such as payment processing partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja, or identity verification service providers — those third parties act solely under m9win's instructions and are bound by written data processing agreements. m9win retains responsibility as Data Controller for ensuring that all processing undertaken by Data Processors meets the standards required by this Policy.

m9win collects the following categories of personal data:

m9win does not collect special category personal data (such as racial origin, religious beliefs, health data, or biometric data) except to the extent that identity documents submitted for KYC purposes may incidentally reveal such information. Where this occurs, such information is not extracted, stored separately, or used for any purpose other than verifying the authenticity of the submitted document.

m9win collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting a complaint.
• Automated Technical Collection: Technical and behavioural data collected automatically through cookies, server logs, and platform analytics tools as you interact with the Platform. This includes IP address, device fingerprint, and session activity.
• Payment Partners: Confirmation data received from payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, CIMB Niaga) to verify the success and authenticity of deposit and withdrawal transactions.
• Identity Verification Providers: Results and risk scores returned by third-party KYC and anti-fraud service providers where m9win uses automated or assisted document verification.
• Fraud Prevention Databases: Where required for responsible gaming or AML compliance, m9win may verify player data against industry-standard fraud and self-exclusion registers. No data is added to external registers without a lawful basis.

m9win processes personal data only where there is a lawful basis for doing so. The following table summarises the primary processing purposes and their corresponding legal bases:

Where m9win relies on legitimate interests as a legal basis, we have assessed that our interests do not override your fundamental rights and freedoms. Where processing is based on consent, you retain the right to withdraw that consent at any time without penalty, as described in Clause 12.

m9win does not sell, rent, or otherwise share personal data with third parties for their own independent marketing or commercial purposes. Personal data is shared only in the following circumstances:

• Payment Processors: To execute deposit and withdrawal transactions, m9win shares relevant identity and payment data with partner banks and e-wallet providers including BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja. These partners act as independent controllers for transactions within their own systems.
• KYC & Identity Verification Providers: Submitted identity documents and personal details are shared with third-party verification service providers solely for the purpose of completing the KYC process. These providers are contractually prohibited from using the data for any other purpose.
• Gaming Software Providers: Technical session data and anonymised gameplay metrics may be shared with game studios (such as Pragmatic Play, Evolution Gaming, and Spribe) for the purpose of technical support, game integrity verification, and dispute resolution.
• Regulatory & Law Enforcement Authorities: m9win will disclose personal data to relevant regulatory authorities, law enforcement bodies, or courts where required to do so by applicable law or a valid legal order. m9win will notify affected players of such disclosures where legally permitted.
• Professional Advisers: Legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of m9win's business or assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected players will be notified prior to such a transfer.

m9win operates globally and may process or store personal data on servers located outside Indonesia. When personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applicable in Indonesia, m9win implements appropriate safeguards, which may include:

• Contractual clauses that legally bind the recipient to protect personal data to the standards required by this Policy.
• Transfers to entities certified under recognised international data protection frameworks.
• End-to-end encryption of data in transit and at rest, such that even if intercepted during transfer, the data remains inaccessible to unauthorised parties.

By registering an account on m9win and providing personal data, you acknowledge and accept that your data may be transferred to, stored, and processed in jurisdictions outside Indonesia as described in this clause.

m9win retains personal data for as long as your account is active and for a defined period thereafter, depending on the category of data and the legal obligations applicable:

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Anonymised or aggregated data that no longer relates to an identifiable individual may be retained indefinitely for analytical and statistical purposes.

m9win implements a multi-layered technical and organisational security programme to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between players' devices and the Platform.
• Encryption of sensitive data fields (including financial account details and identity document content) at rest in the database layer.
• Role-based access controls ensuring that only personnel with a legitimate need can access player personal data, with all access activity logged and auditable.
• Multi-factor authentication for all internal system access by m9win staff.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Real-time fraud detection and account anomaly monitoring to identify and respond to suspicious activity promptly.
• Incident response procedures that include prompt investigation, containment, remediation, and, where required, notification to affected players and relevant authorities.

While m9win takes all reasonable steps to protect your personal data, no method of internet transmission or electronic storage is completely secure. Players are encouraged to protect their own accounts by using a strong, unique password and enabling two-factor authentication. m9win will never request your password via email, live chat, or any other communication channel.

m9win uses cookies — small text files stored on your device — and similar tracking technologies (such as pixel tags and session storage) to deliver and maintain Platform functionality. The following categories of cookies are in use on the Platform:

m9win does not use third-party advertising or retargeting cookies that track players across external websites. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the Platform.

As a player whose personal data is processed by m9win, you hold the following rights, exercisable at any time by contacting the Data Protection contact listed in Clause 16:

m9win will respond to all valid data rights requests within 30 calendar days of receipt. Where a request is particularly complex or numerous, the response period may be extended by up to a further 60 days, in which case you will be informed of the extension and its reasons.

Please note that certain rights are subject to limitations where m9win is required by law to retain or continue processing data — for example, financial transaction records must be retained for a minimum of five years under AML obligations regardless of an erasure request.

The m9win Platform is strictly intended for adults who are 21 years of age or older. m9win does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of the KYC process and m9win employs both automated and manual controls to detect and reject underage registrations.

If m9win becomes aware that personal data has been collected from an individual under the age of 21, the associated account will be immediately suspended, any balance returned to its source, and all personal data relating to that individual permanently deleted without delay. If you have reason to believe that a minor has registered on the Platform, please contact the support team immediately at [email protected].

m9win may send promotional communications — including bonus offers, game launch announcements, seasonal promotions tied to Indonesian holidays such as Idul Fitri, Nyepi, and Chinese New Year (Imlek), and VIP programme updates — via email and SMS to players who have opted in to receive such communications during registration or subsequently through Account Settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in the Notifications section of your Account Settings.
• Clicking the unsubscribe link included in any marketing email.
• Contacting the 24/7 support team via live chat or email and requesting to be removed from all marketing lists.

Withdrawal of marketing consent does not affect the delivery of transactional communications required for account management — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — which are sent regardless of marketing preference settings.

m9win reserves the right to update or revise this Privacy Policy at any time to reflect changes in legal requirements, regulatory guidance, Platform functionality, or data processing practices. The date of the most recent revision is displayed prominently at the top of this document.

Where changes are material — meaning they affect the categories of data collected, the purposes for which data is used, or the rights available to players — m9win will provide advance notice by email to the registered email address on file and/or by displaying a prominent notice on the Platform prior to the changes taking effect.

Continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions. m9win recommends bookmarking this page and reviewing it periodically to stay informed of any updates.

For all privacy-related enquiries, data subject requests, or questions about this Privacy Policy, please contact the m9win Data Protection team using the details below. All privacy correspondence is handled with strict confidentiality and a response will be provided within 30 calendar days of receipt.

For general account support, deposit and withdrawal queries, and technical assistance, the 24/7 live chat service available directly through the Platform is the fastest channel. The Data Protection contact above is intended specifically for privacy, data rights, and compliance correspondence.

m9win is committed to resolving all privacy concerns directly and promptly. Where you remain dissatisfied following m9win's response to a privacy complaint, you may have the right to refer the matter to a relevant supervisory authority or data protection regulator in your jurisdiction.