Privacy Policy — a9today Platform

This Privacy Policy ("Policy") sets out the basis on which a9today ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to users ("you", "User", "Player") of the a9today online gaming and sports betting platform accessible at https://a9today.cam (the "Website").

a9today recognises the importance of privacy to our players across Malaysia, including those in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and Bangsar. We are committed to handling all personal data responsibly, transparently, and in a manner consistent with applicable data protection legislation, including Malaysia's Personal Data Protection Act 2010 (PDPA) and any other relevant regulatory frameworks governing our operations.

By registering an account with a9today, accessing the platform, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with the terms of this Policy, please discontinue use of the platform and contact us to arrange account closure.

The following definitions apply throughout this Privacy Policy:

a9today collects Personal Data across several categories, depending on your level of engagement with the platform. The following table summarises the categories of data we collect and the context in which each is obtained:

We do not collect or store full payment card numbers, CVV codes, or complete bank account numbers. Payment credentials are processed exclusively through PCI-DSS compliant third-party payment processors including those that operate the FPX, Touch 'n Go eWallet, Boost, GrabPay, and DuitNow infrastructure.

a9today collects Personal Data through the following channels:

• Direct Submission: Information you provide when you complete the registration form, submit KYC documents, fill in the cashier, contact support, or respond to surveys and promotions.
• Automated Technical Collection: Data gathered automatically when you access the platform, including IP address, device identifiers, browser fingerprint, session data, and cookies. This collection occurs regardless of whether you are logged in.
• Payment Processors: Confirmation data returned by payment service providers following a successful or failed transaction — for example, a masked bank account identifier or e-wallet reference number confirming a deposit or withdrawal.
• Third-Party Identity Verification: Where a9today uses a third-party KYC or AML verification partner to validate identity documents, the outcome and relevant data points from that verification process are shared back with a9today for compliance record-keeping.
• Publicly Available Sources: In connection with fraud prevention and AML screening, a9today may cross-reference user-submitted information against publicly available government databases, sanctions lists, or politically exposed persons (PEP) registers.

a9today processes Personal Data only where a legitimate purpose and lawful basis exists for doing so. The following table sets out the primary processing purposes and the corresponding legal basis under applicable data protection law:

a9today does not sell, rent, or trade your Personal Data. We may share your data with the following categories of recipients only where necessary and proportionate to the purpose:

• Payment Service Providers: To facilitate deposits and withdrawals via Maybank, CIMB, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and USDT TRC20 processors. These providers receive only the minimum data required to process the transaction.
• KYC and Identity Verification Partners: To validate identity documents and perform AML and PEP screening as required by law. All such partners are contractually bound to process data only on a9today's instructions and to maintain equivalent security standards.
• Fraud Detection and Cybersecurity Providers: Technical partners that assist in identifying suspicious activity, bot traffic, and account security threats. These providers process technical and gameplay data on a pseudonymised basis where possible.
• Regulatory Authorities and Law Enforcement: Where a9today is under a legal obligation to disclose information — for example, in response to a court order, a regulatory investigation, or a mandatory suspicious transaction report under applicable AML legislation.
• Gaming Software and Content Providers: Game studios and live dealer platform operators that deliver content on a9today may receive anonymised or aggregated session data for licensing and compliance purposes. They do not receive personally identifiable information without a separate contractual basis.

a9today retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with a9today's data destruction procedures. Where data is anonymised rather than deleted, the resulting anonymised dataset is no longer considered Personal Data and may be retained for statistical and analytical purposes indefinitely.

a9today implements and maintains a comprehensive set of technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, disclosure, alteration, and destruction. These measures include:

• Encryption in Transit: All data exchanged between your device and the a9today platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• Encryption at Rest: Sensitive Personal Data and KYC documents stored on a9today's servers are encrypted at rest using industry-standard algorithms.
• Access Controls: Access to Personal Data within a9today's internal systems is restricted on a strict need-to-know basis. Employees are granted access only to the data categories relevant to their role, and all access is logged.
• Multi-Factor Authentication: Administrative access to systems holding Personal Data requires multi-factor authentication. We strongly encourage players to enable MFA on their own accounts.
• Regular Security Audits: a9today conducts periodic penetration testing and vulnerability assessments on its platform infrastructure, with findings remediated according to a risk-based prioritisation framework.
• Incident Response: In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, a9today will notify affected users within 72 hours of becoming aware of the breach, and will cooperate fully with relevant regulatory authorities.

The a9today website uses cookies and similar tracking technologies to support core platform functionality, maintain your session state, and gather analytical data that helps us improve the user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without disrupting core functionality.
• Functional Cookies: Remember your preferences such as preferred language, display settings, and responsible gambling limit configurations. These persist across sessions to avoid the need to re-enter preferences on each visit.
• Analytical Cookies: Collect anonymised or pseudonymised data about how pages are used, which features are most visited, and where users encounter errors. This data is used solely for internal platform improvement and is not linked to your individual identity.
• Anti-Fraud and Security Cookies: Support a9today's fraud-detection systems by maintaining consistency checks across sessions and flagging anomalous browsing behaviour patterns.

a9today does not use third-party advertising or retargeting cookies. We do not share cookie data with external advertising networks or social media platforms for targeting purposes.

You may adjust your browser settings to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies will impair the functionality of the a9today platform, including the ability to log in or maintain a gaming session.

Subject to applicable law and certain regulatory exceptions (for example, where data must be retained for AML compliance), you hold the following rights in respect of your Personal Data held by a9today. All rights may be exercised by contacting our support team via live chat or email at [email protected].

The a9today platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from persons under the age of 21. Our registration process requires users to confirm their date of birth, and this is further verified during KYC.

If a9today discovers that Personal Data has been collected from a person under the age of 21, the associated account will be immediately suspended, all related Personal Data will be securely deleted (subject only to mandatory legal reporting obligations where applicable), and any deposited funds will be returned to the payment method of origin.

If you are a parent or guardian and believe that a minor under your care has registered on the a9today platform, please contact our support team immediately at [email protected] (plain text — not a link) so we can investigate and take appropriate action without delay.

The a9today platform may integrate with or reference third-party services including payment processors (Maybank, CIMB, Touch 'n Go, DuitNow, etc.), game content providers, and identity verification services. While these integrations are essential to platform operations, a9today does not control the privacy practices of third-party service providers beyond the contractual data processing obligations we impose on them.

All third-party processors engaged by a9today are required to:

• Process Personal Data only on a9today's documented instructions and for no independent purpose;
• Maintain technical and organisational security measures at least equivalent to those described in Section 8 of this Policy;
• Refrain from engaging sub-processors without a9today's prior written consent;
• Assist a9today in responding to data subject rights requests where relevant data is held by the processor;
• Delete or return all Personal Data upon termination of the service relationship.

This Policy does not extend to any third-party websites, applications, or services that are not operated by a9today. If you follow a link to a third-party site from any a9today communication, that site's own privacy policy governs the handling of your data on that site.

In order to deliver certain platform services — including live casino streaming, third-party game software, and identity verification — some Personal Data may be transferred to, or accessed from, servers or personnel located outside of Malaysia. Where such transfers occur, a9today ensures that adequate safeguards are in place to protect your data to a standard at least equivalent to the protections afforded under Malaysian law and this Policy.

Safeguards used for cross-border transfers include contractual clauses that bind the recipient to specific data protection standards, and selection of service providers who operate under internationally recognised data protection frameworks. Where technically feasible, a9today prioritises the use of data processing infrastructure located in the Asia-Pacific region to minimise cross-border exposure.

a9today reserves the right to update or amend this Privacy Policy at any time to reflect changes in law, technology, business practices, or platform features. When material changes are made, we will notify registered users by email to their registered address and/or display a prominent notice on the platform at least 14 days before the amended Policy takes effect.

The effective date of the current version of this Policy is clearly stated at the top of this page. Your continued use of the a9today platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not agree with the revised terms, you should cease using the platform and contact us to request account closure before the changes take effect.

Previous versions of this Privacy Policy are retained in our compliance records and may be provided upon written request.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a privacy-related concern that you would like to raise formally, please contact us through the following channels:

We are committed to resolving all privacy concerns promptly and transparently. If you are not satisfied with our response, you retain the right to escalate your concern to the relevant data protection authority in your jurisdiction.