Privacy Policy
GD9Club is committed to protecting the privacy and security of every player's personal data. This Privacy Policy explains what we collect, why we collect it, how we use it, and the rights you hold over your information.
How We Protect Your Data
These six principles underpin every data-related decision GD9Club makes. Full details are set out in the policy sections below.
Encrypted Data Storage
All personal data held by GD9Club — including Malaysian IC numbers, payment details, and account credentials — is stored using industry-standard AES-256 encryption at rest and TLS 1.3 in transit.
No Third-Party Data Sales
GD9Club does not sell, rent, or trade your personal information to any third party for their own marketing purposes. Your data belongs to you — we treat it as a custodian, not as a commercial asset.
Minimum Data Collection
We collect only the personal data that is strictly necessary for account operation, payment processing, identity verification (KYC), and compliance with our international licensing obligations. Nothing more.
Full User Rights
You have the right to access, correct, port, and request deletion of your personal data at any time. Marketing preferences can be updated from within your Account settings. Requests are processed within 30 days.
Transparent Cookie Use
GD9Club uses cookies for session management, fraud detection, and Platform performance analytics only. We do not use advertising trackers or cross-site profiling cookies. Cookie preferences can be managed via your browser settings.
Defined Retention Periods
Personal data is retained only for as long as it is necessary for the purposes for which it was collected, or as required by our licensing obligations. KYC documents are retained for a minimum of five years following account closure.
Introduction
This Privacy Policy (hereinafter "Policy") issued by GD9Club (hereinafter "GD9Club", "we", "us", "our") and describes the manner in which we collect, use, disclose, store, and protect personal data relating to users of the GD9Club Platform, accessible at gd9club.cam (hereinafter "Platform").
GD9Club operates as a licensed online gaming platform serving players across Malaysia, including players based in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other cities and regions throughout the country. In providing these services, we process personal data responsibly and in accordance with the principles set out in this Policy and the obligations imposed by our international gaming licence.
This Policy applies to all personal data processed by GD9Club in connection with the Platform, including data collected via the website, mobile interface, live chat, email, and payment processing channels. By creating a GD9Club Account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
This Policy should be read together with our Terms & Conditions, which are available at gd9club.cam/terms-conditions.
Definitions
For the purposes of this Policy, the following terms shall have the meanings ascribed below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including but not limited to name, identity number, contact details, financial information, device identifiers, and behavioural data collected in connection with use of the Platform. |
| "Processing" | Any operation performed on Personal Data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction. |
| "Data Controller" | GD9Club, which determines the purposes and means of processing your Personal Data. |
| "Data Processor" | A third party that processes Personal Data on GD9Club's behalf and under GD9Club's instructions, such as payment gateway providers, cloud infrastructure vendors, and KYC verification service providers. |
| "KYC Data" | Identity and address verification documents submitted by a Player as part of the Know Your Customer process, including copies of Malaysian IC (MyKad), passport, driver's license, and proof of address documents. |
| "Sensitive Data" | A subset of Personal Data that by its nature warants enhanced protection, including government-issued identity numbers and financial account details. |
Personal Data We Collect
GD9Club collects Personal Data in the following categories. We collect only what is necessary for each stated purpose — we do not collect data speculatively or in excess of operational requirements.
| Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, Malaysian IC number or passport number | Account registration, KYC verification, age verification |
| Contact Data | Email address, mobile phone number, residential address (city, state, postcode) | Account communication, support verification notifications |
| Financial Data | Payment method details (e.g., Touch 'n Go eWallet account reference, DuitNow identifier, bank account details for FPX/Maybank/CIMB/Public Bank/Hong Leong), transaction history | Deposit and withdrawal processing, fraud prevention, AML compliance |
| KYC Documents | Scanned or photographed copies of identity documents, proof of address, selfie verification | Regulatory KYC compliance, withdrawal authorisation |
| Technical Data | IP address, device type, browser type and version, operating system, session token, geolocation (country/city level) | Platform security, fraud detection, jurisdictional compliance |
| Usage Data | Game history, betting patterns, session duration, login timestamps, pages visited | Responsible gambling monitoring, product improvement, bonus eligibility determination |
| Communications Data | Live chat transcripts, support email correspondence, feedback submissions | Support delivery, dispute resolution, quality assurance |
How We Collect Personal Data
GD9Club collects Personal Data through the following channels:
- Direct Collection: Information you provide when registering an Account, completing KYC verification, submitting a support request, or corresponding with GD9Club by any means.
- Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, session data, and cookies. See Section 10 for full cookie information.
- Payment Processing Partners: Transaction reference data received from payment processors when you make a deposit or receive a withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or Malaysian bank transfer services.
- Third-Party Identity Verification: Where GD9Club uses a third-party KYC service provider to assist with identity document verification, that provider may return verification status data and document authenticity signals to GD9Club.
- Fraud Prevention Services: Data received from third-party fraud detection and device fingerprinting services used to protect the Platform and its users against fraudulent activity.
Purposes of Data Processing
GD9Club processes your Personal Data for the following purposes. Each purpose is supported by a specific legal basis, as detailed in Section 6.
- Account Creation and Management: To register your Account, maintain your player profile, and administer your ongoing relationship with GD9Club.
- Identity Verification (KYC): To verify your identity and age in compliance with our international gaming licence obligations and anti-money laundering requirements.
- Payment Processing: To process deposits received via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and other supported payment methods, and to process withdrawal payments to verified accounts.
- Responsible Gambling: To monitor gameplay patterns, identify indicators of problem gambling behaviour, and apply responsible gambling tools including deposit limits, session limits, and self-exclusion where appropriate or requested.
- Fraud Prevention and Security: To detect, prevent, and investigate fraudulent activity, money laundering, account sharing, multi-accounting, and other breaches of our Terms & Conditions.
- Customer Support: To receive, process, and respond to support enquiries submitted via live chat or email.
- Legal and Regulatory Compliance: To fulfil our obligations under our international gaming licence, including record-keeping, reporting, and audit requirements.
- Marketing Communications: To send you promotional communications about GD9Club offers and new features — subject to your marketing preferences as set out in Section 14.
- Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the GD9Club Platform, optimising game performance, and enhancing the user experience for Malaysian players.
Legal Basis for Processing
GD9Club relies on the following legal bases for processing your Personal Data:
- Contract Performance: Processing that is necessary to perform the contract between you and GD9Club — principally, the Terms & Conditions governing your Account. This includes account management, payment processing, and support delivery.
- Legal Obligation: Processing that is required to comply with legal obligations applicable to GD9Club, including KYC, anti-money laundering requirements, and regulatory record-keeping obligations imposed by our international gaming licence.
- Legitimate Interests: Processing carried out in GD9Club's legitimate business interests where those interests are not overridden by your privacy rights — including fraud prevention, security monitoring, and aggregated product analytics.
- Consent: Where we rely on consent as a legal basis — principally for direct marketing communications — you may withdraw your consent at any time by updating your marketing preferences in your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Third-Party Disclosure
GD9Club does not sell, rent, or trade your Personal Data to third parties for their independent marketing or commercial purposes. We may disclose Personal Data to the following categories of recipients only to the extent necessary for the purposes described in this Policy:
- Payment Processors: Payment method providers including Touch 'n Go eWallet, GrabPay, Boost, DuitNow service operators, FPX, Maybank, CIMB, Public Bank, and Hong Leong, solely to process transactions associated with your Account.
- Identity Verification Providers: Third-party KYC and document verification service providers engaged to assist GD9Club in completing identity and age checks in connection with account registration and withdrawal processing.
- Cloud Infrastructure Providers: Hosting and cloud storage service providers that maintain the servers on which GD9Club's Platform and data are hosted, operating under contractual data processing agreements.
- Fraud Detection Services: Third-party fraud prevention and device intelligence providers engaged to detect and prevent fraudulent, money laundering, and multi-accounting activity on the Platform.
- Legal and Regulatory Authorities: Law enforcement agencies, regulatory bodies, and courts of competent jurisdiction, where disclosure is required by applicable law, court order, or regulatory direction.
- Professional Advisers: Legal counsel, auditors, and compliance consultants, subject to confidentiality obligations, where necessary for GD9Club's legal or regulatory compliance.
International Data Transfers
GD9Club is an international gaming platform and, the course of providing its services, may transfer Personal Data to servers and Data Processors located outside Malaysia. Such transfers may be necessary for the operation of the Platform's hosting infrastructure, KYC verification services, and fraud prevention systems.
Where Personal Data is transferred to a third country, GD9Club takes reasonable steps to ensure that the recipient applies level of data protection consistent with the standards set out in this Policy, including by relying on contractual safeguards where appropriate.
By using the GD9Club Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Malaysia for the purposes described in this Policy.
Data Retention
GD9Club retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to any longer retention period required by our licensing obligations or applicable law. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of Account plus 5 years after closure | Licensing obligation / AML compliance |
| KYC Documents | Minimum 5 years from Account closure | Regulatory requirement |
| Financial Transaction Records | 7 years from transaction date | AML / financial record-keeping |
| Support Communications | 3 years from last interaction | Legitimate interest / dispute resolution |
| Technical / Log Data | 12 months from collection | Security monitoring / fraud detection |
| Marketing Preferences | Until consent withdrawn or Account closed | Consent |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with GD9Club's internal data disposal procedures.
Cookies & Tracking Technologies
GD9Club uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device when you visit the Platform. They serve the following functions:
- Strictly Necessary Cookies: Required for the Platform to function correctly, including session authentication, security token management, and load balancing. These cookies cannot be disabled without impairing your ability to use the Platform.
- Functional Cookies: Used to remember your preferences, such as language settings, game lobby layout, and responsible gambling tool configurations, so you do not need to re-enter them on each visit.
- Analytics Cookies: Used to collect aggregated, anonymised information about how players use the Platform, including page visit frequency and session duration. This data helps us improve Platform performance and user experience. No personally identifiable information is included in analytics reports.
- Security and Fraud Detection Cookies: Used by our fraud prevention systems to detect anomalous behaviour, device spofing, and multi-account activity.
GD9Club does not use third-party advertising cookies, behavioural targeting cookies, or cross-site tracking cookies for the purpose of serving targeted advertisements.
Security Measures
GD9Club implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:
- AES-256 encryption for Personal Data stored on GD9Club servers;
- TLS 1.3 encryption for all data transmitted between your device and the Platform;
- Two-factor authentication (2FA) support for all player accounts;
- Role-based access controls limiting internal staff access to Personal Data on a strict need-to-know basis;
- Regular security audits and penetration testing of Platform infrastructure;
- Automated anomaly detection systems monitoring for unauthorised access attempts and unusual account activity;
- Segregation of player funds from GD9Club's operational accounts.
Notwithstanding these measures, no data transmission over the internet is entirely secure. GD9Club cannot guarantee the absolute security of data transmitted to or from the Platform. In the event of a data security breach that is likely to result in a high risk to your rights, GD9Club will notify affected players without undue delay in accordance with applicable notification obligations.
Your Rights Regarding Personal Data
GD9Club respects your rights in relation to your Personal Data. The following rights are available to all Account holders:
You may request a copy of all Personal Data GD9Club holds about you. We will provide a response within 30 days of receiving a verifiable request.
You may request that we correct inaccurate Personal Data held about you. Basic profile data can be updated directly in your Account settings without contacting support.
You may request deletion of your Personal Data, subject to our legal obligations to retain certain data (e.g., KYC and financial transaction records) under our licensing requirements.
You may request that we provide your Personal Data in a structured, machine-readable format, or transmit it to another controller, where technically feasible.
You may object to processing carried out on the basis of legitimate interests, including profiling. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
You may request that we restrict processing of your data in certain circumstances — for example, while a rectification request is pending or where you have objected to processing under legitimate interests.
To exercise any of these rights, please contact GD9Club support via live chat or email. We will verify your identity before processing any data subject request. We aim to respond to all requests within 30 days. Complex or multiple requests may take up to 90 days, in which case we will notify you of the extension and the reasons for the delay.
Children's Privacy
GD9Club operates exclusively for adults. The Platform is strictly prohibited for persons under 21 years of age. We do not knowingly collect Personal Data from persons under 21.
If GD9Club becomes aware that an Account has been registered by or on behalf of a person under 21, the Account will be immediately suspended, any winings will be voided, and deposited funds will be returned to the originating payment method following verification. Any Personal Data relating to the underage user will be securely deleted as soon as it is no longer needed for the purposes of processing the account closure.
Parents or guardians who believe a minor may have accessed the Platform using their details are encouraged to contact GD9Club support immediately.
Marketing Communications
GD9Club may send you marketing communications about promotions, new games, bonus offers, and other Platform updates where you have provided consent to receive such communications at the time of registration or at later date.
Marketing communications from GD9Club are delivered by email and, where applicable, by in-platform notification. We do not send unsolicited SMS marketing messages.
You may withdraw your consent to receive marketing communications at any time by:
- Updating your communication preferences in the "Account Settings" section of your GD9Club Account; or
- Clicking the "Unsubscribe" link included in any marketing email; or
- Contacting GD9Club support and requesting removal from our marketing list.
Opting out of marketing communications does not affect the delivery of transactional and account-related communications, which form part of the service GD9Club is contractually obligated to provide — such as deposit confirmations, withdrawal notifications, and KYC status updates.
Changes to This Privacy Policy
GD9Club reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or Platform functionality. When material changes are made, we will update the "Last Updated" date at the top of this page and, where required, notify registered players by email or in-platform notification.
We encourage you to review this Policy periodically. Your continued use of the GD9Club Platform following the posting of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with any changes to this Policy, you should cease use of the Platform and may request Account closure in accordance with Section 13 of our Terms & Conditions.
Historical versions of this Privacy Policy are available on request by contacting GD9Club support.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a privacy-related complaint, please contact GD9Club's support team using the details below. All privacy-related enquiries are handled with priority.
Email: [email protected] (plain text only — not a clickable link)
Subject Line: Please use "Privacy Request – [Your Account Username]" for data subject right requests
Response Time: Data subject right requests are acknowledged within 72 hours and completed within 30 days
GD9Club takes all privacy complaints seriously. If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the relevant supervisory authority in the jurisdiction of our licensing authority.
Play at GD9Club with Confidence
Your personal data is protected by AES-256 encryption, never sold to third parties, and processed only for the purposes set out in this Policy. GD9Club is committed to keeping your information safe while delivering Malaysia's best online gaming experience.
GD9Club is strictly for players aged 21 and above. Gambling involves financial risk — please play responsibly.