Privacy Policy

This Privacy Policy ("Policy") is published by ivip9 ("Company", "we", "us", "our") and applies to all users ("User", "you", "your") of the website located at https://ivip9.casa and all associated applications, services, and features operated under the ivip9 brand (collectively, the "Platform").

ivip9 is committed to protecting your personal data in accordance with applicable data protection principles and laws. This Policy sets out in full and transparent terms the categories of personal data we collect from you, the purposes for which that data is processed, the legal bases on which we rely to process it, how long we retain it, and the rights you have in respect of it.

By accessing the Platform, creating an account, or making use of any ivip9 service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must discontinue use of the Platform.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, location data, or any factor specific to the physical, economic, or social identity of that person.
• "Data Controller" — ivip9, which determines the purposes and means of processing your personal data.
• "Data Processor" — any third party that processes personal data on behalf of ivip9 pursuant to a lawful agreement and the instructions of ivip9.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure, or combination with other data.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" — identity verification documentation submitted by you in connection with the Know Your Customer compliance process, including government-issued identification documents, proof of address, and selfie images.
• "Usage Data" — data generated automatically by your use of the Platform, including login timestamps, betting history, game interactions, session durations, IP addresses, and device identifiers.
• "Cookie" — a small text file placed on your device by the Platform when you access it, used to store session information, preferences, and analytics data.

ivip9 collects personal data only to the extent necessary for the lawful operation of the Platform and the provision of services to you. The categories of personal data we may collect are set out in the table below:

4.1 Data You Provide Directly

The majority of personal data we hold is provided directly by you during: account registration; KYC identity verification; deposit and withdrawal transactions; completion of responsible gambling tools such as deposit limits or self-exclusion requests; and correspondence with our support team via live chat, WhatsApp, or email.

4.2 Data Collected Automatically

When you access and use the Platform, certain Usage Data is collected automatically through technical means, including: server logs recording your IP address and access timestamps; browser and device fingerprinting data for fraud detection and session security; cookies and similar tracking technologies as described in Section 8 of this Policy.

4.3 Data from Third Parties

In limited circumstances, we may receive personal data about you from trusted third parties, including: payment service providers (e.g., FPX gateway operators, e-wallet providers such as Touch 'n Go, Boost, and GrabPay, and banking institutions including Maybank, CIMB, Public Bank, and Hong Leong) in connection with transaction processing and fraud detection; identity verification service providers used to supplement our KYC process; and fraud prevention and anti-money laundering (AML) screening databases.

ivip9 processes your personal data for the following specific purposes:

• Account Creation and Management: to register, authenticate, and maintain your ivip9 Account, including password reset and access management;
• Service Delivery: to provide the online gaming, sports betting, live dealer, and related services available on the Platform;
• Payment Processing: to process deposits and withdrawals via your chosen payment method, including verification with payment service providers;
• Identity Verification (KYC): to comply with our obligations under applicable anti-money laundering (AML) and know-your-customer (KYC) frameworks, including verification of your identity, age, and source of funds where required;
• Fraud Prevention and Security: to detect, investigate, and prevent fraudulent transactions, unauthorised account access, multi-accounting, and other prohibited conduct;
• Regulatory Compliance: to fulfil our legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and maintain required records;
• Customer Support: to respond to your enquiries and complaints, manage support tickets, and maintain records of correspondence for quality assurance;
• Responsible Gambling: to operate deposit limits, loss limits, session reminders, self-exclusion tools, and to monitor patterns of play that may indicate problem gambling;
• Platform Improvement: to analyse usage patterns, diagnose technical issues, and develop new features for the benefit of Malaysian players and our broader user base;
• Marketing Communications: to send promotional offers, bonus notifications, and platform updates — where you have provided your consent to receive such communications, and subject to your right to withdraw that consent at any time.

ivip9 processes your personal data on the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: processing necessary to perform the contract between you and ivip9, including account management, service delivery, and payment processing;
• Legal Obligation: processing required to comply with applicable laws and regulations, including AML obligations, KYC requirements, and responses to lawful authority requests;
• Legitimate Interests: processing carried out in pursuit of legitimate business interests, including fraud detection, platform security, and service improvement — where such interests are not overridden by your fundamental rights and freedoms;
• Consent: processing based on your freely given, specific, informed, and unambiguous consent, including the sending of direct marketing communications and the use of non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

7.1 We Do Not Sell Your Data

ivip9 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is not a product. Any disclosure to third parties occurs only under the circumstances described below.

7.2 Permitted Disclosures

We may share your personal data with the following categories of recipients:

• Payment Service Providers: banks and e-wallet operators (including Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong) for the sole purpose of processing transactions initiated by you;
• Identity Verification Partners: licensed KYC and AML service providers engaged to verify your identity and screen your account against fraud and sanctions databases;
• Game and Software Providers: third-party game providers and platform technology partners who supply the games and software infrastructure that powers the Platform, to the extent necessary for service delivery;
• Regulatory and Law Enforcement Authorities: where required by applicable law, court order, or lawful authority request, including disclosures to financial regulators or law enforcement agencies investigating financial crime;
• Professional Advisors: lawyers, auditors, and other professional advisors engaged under duties of confidentiality in connection with the lawful operation of the Company;
• Business Transfers: in the event of a merger, acquisition, restructuring, or sale of all or substantially all of the Company's assets, your data may be transferred as part of the transaction subject to confidentiality undertakings and notification to you as required by law.

7.3 International Data Transfers

Where personal data is transferred to recipients located outside of Malaysia, ivip9 ensures that appropriate safeguards are in place to protect the data in a manner consistent with applicable data protection principles, including the use of standard contractual clauses or equivalent mechanisms where applicable.

ivip9 uses cookies and similar tracking technologies when you access the Platform. Cookies are small text files stored on your device that help us recognise you, remember your preferences, maintain session security, and gather anonymised usage analytics.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. They maintain your login session, prevent cross-site request forgery, and enable core security features. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language selection, display settings, and deposit limit configurations to provide a personalised experience.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, time on site, and features used — to help us improve performance and content.
• Security Cookies: Support fraud detection and multi-accounting prevention by maintaining device fingerprinting data used during login and transaction processing.

8.2 Managing Cookies

You may configure your browser to block or delete cookies. Note that disabling strictly necessary cookies will impair the Platform's functionality and may prevent you from logging in or completing transactions. Analytics and functional cookies can be disabled without affecting core service access.

ivip9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and Identity Data: retained for the duration of your active Account relationship with ivip9, and for a period of not less than five (5) years following Account closure, to meet AML record-keeping obligations;
• KYC Documentation: retained for a minimum of five (5) years from the date of submission, or such longer period as required by applicable financial regulations;
• Transaction Records: all deposit, withdrawal, and wagering transaction records are retained for a minimum of five (5) years from the date of the transaction;
• Support Correspondence: retained for up to three (3) years from the date of the last interaction, to assist with dispute resolution and quality assurance;
• Usage and Analytics Data: typically retained in anonymised or aggregated form for up to two (2) years for platform improvement purposes;
• Marketing Consent Records: retained for the duration of your consent, plus a reasonable period thereafter as evidence of the consent.

Where personal data is no longer required, it is securely deleted or anonymised in a manner that prevents re-identification.

ivip9 implements and maintains appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: all data transmitted between your device and the Platform is encrypted in transit using industry-standard secure socket layer (SSL/TLS) protocols;
• Encryption at Rest: sensitive data, including KYC documents and financial records, is encrypted when stored on our servers;
• Access Controls: access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and two-factor authentication for administrative access;
• Security Monitoring: our infrastructure is subject to continuous security monitoring and regular penetration testing to identify and remediate vulnerabilities;
• Incident Response: ivip9 maintains a data breach response procedure. In the event of a security incident materially affecting your personal data, we will notify affected users and relevant authorities within applicable regulatory timeframes.

While we apply rigorous security measures, no system is entirely impenetrable. You are responsible for maintaining the confidentiality of your own login credentials and for notifying us immediately if you suspect any unauthorised activity on your Account.

Subject to applicable law, you have the following rights in respect of your personal data held by ivip9. Requests to exercise any of these rights should be directed to our support team using the contact details in Section 14.

• Right of Access: you may request a copy of the personal data we hold about you, along with information about how it is processed;
• Right to Rectification: you may request that we correct any inaccurate or incomplete personal data without undue delay;
• Right to Erasure ("Right to be Forgotten"): in certain circumstances you may request that we delete your personal data — note that this right is subject to limitations where retention is required by law (e.g., AML record-keeping obligations);
• Right to Restrict Processing: you may request that we suspend the processing of your data while a dispute is being resolved, or where you contest the accuracy of data we hold;
• Right to Data Portability: where processing is based on your consent or a contract, you may request your personal data in a structured, commonly used, machine-readable format;
• Right to Object: you may object to the processing of your personal data based on our legitimate interests, or for direct marketing purposes;
• Right to Withdraw Consent: where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

We will respond to all verified rights requests within thirty (30) calendar days. In complex or high-volume cases, we may extend this period by a further thirty (30) days with notification to you.

The ivip9 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete the relevant Account and all associated personal data.

If you are a parent or guardian and believe that a person under the age of 21 has registered an Account on ivip9, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

ivip9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The "Last Updated" date at the top of this page will be revised whenever the Policy is materially changed.

Where changes are material and affect how we process your personal data, we will provide prominent notice on the Platform and, where practicable, notify you directly at your registered email address with reasonable advance notice before the changes take effect.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must discontinue use of the Platform and may request Account closure in accordance with our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to report a privacy concern, please contact the ivip9 Data & Privacy support team through the following channels:

• Live Chat: available 24/7 directly from the Platform dashboard — average response time 3–5 minutes;
• Email: [email protected] — please allow up to 24 hours for written enquiries. For data subject requests, please include your full name, registered email, and a clear description of your request;
• WhatsApp: contact details available within the Platform after login.

Our team is available in English, Bahasa Melayu, and Mandarin, seven days a week including public holidays. Whether you are reaching out from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in Malaysia, we will respond in your preferred language.

For verified data subject access requests, we will require confirmation of your identity before processing the request, to protect the security of your data.