Privacy Policy

This Privacy Policy (hereinafter "Policy") sets out the principles and practices governing the collection, use, storage, sharing, and protection of personal data by Crown9 (hereinafter "Crown9", "we", "us", or "our") in connection with the operation of the online gaming platform accessible at https://crown9.cam and all associated subdomains and services (collectively, the "Platform").

Crown9 operates an online casino and sports betting platform specifically designed for Malaysian players, offering services denominated in Malaysian Ringgit (MYR) with full support for Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank online banking, Hong Leong Connect, DuitNow, and FPX.

In the course of providing these services, Crown9 necessarily collects certain personal data from registered users and platform visitors. This Policy is intended to inform you clearly and transparently of exactly what data we collect, why we collect it, how we use it, and what rights you have over it.

Crown9 is committed to handling your personal data responsibly, proportionately, and in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifier, or one or more factors specific to the physical, economic, cultural, or social identity of that person.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. Crown9 is the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of Crown9 pursuant to Crown9's instructions and under contractual data processing agreements.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Cookies" means small text files stored on a user's device by a web browser at the instruction of a website, used to maintain session state, user preferences, or analytical tracking.
• "KYC" (Know Your Customer) means the identity and age verification process required before a user may transact financially on the Platform.
• "Third Party" means any natural or legal person other than Crown9, the registered User, or Crown9's authorised Data Processors.

Crown9 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, Crown9 determines the purpose and manner in which Personal Data is processed and is responsible for ensuring that Processing activities meet the standards set out in this Policy.

Crown9 operates the Platform under international gaming licensing. The Platform is hosted on infrastructure utilising internationally recognised cloud service providers subject to contractual data processing obligations.

Crown9 does not appoint a formal Data Protection Officer (DPO) under the licensing framework applicable to its operations; however, Crown9's support function handles all data subject requests and privacy complaints and escalates matters of significance to senior management.

Crown9 collects Personal Data through several distinct channels. We describe these below, along with the specific categories of data collected through each channel.

4.1 Registration Data

When you create a Crown9 account, we collect the following information which you provide directly:

• Full legal name (as it appears on your government-issued ID);
• Date of birth (for 21+ age verification purposes);
• Residential address (including city and postcode — e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru);
• Email address;
• Phone number;
• Chosen username and password (password stored as a one-way cryptographic hash — never in plain text);
• Preferred currency (MYR by default for Malaysian users).

4.2 KYC Verification Data

Before processing your first withdrawal, Crown9 requires identity verification documentation, which may include:

• Copy of a valid government-issued photo ID (Malaysian MyKad, passport, or driving licence);
• Proof of residential address (utility bill, bank statement, or official letter — not older than three months);
• Confirmation that the payment method used for deposits is registered in your name;
• Source of funds documentation in applicable circumstances.

4.3 Financial Transaction Data

When you make deposits or withdrawals, Crown9 records:

• Payment method type (e.g., Touch 'n Go eWallet, Maybank2u, DuitNow, FPX, BTC, USDT);
• Transaction reference numbers issued by the payment processor;
• Deposit and withdrawal amounts in MYR;
• Transaction timestamps;
• Partial payment identifier information (e.g., last four digits of a bank account number where applicable) — full payment credentials are never stored by Crown9.

4.4 Platform Usage Data

When you use the Platform, Crown9 automatically collects:

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Pages visited, session duration, and navigation paths;
• Game activity records (games played, amounts wagered, outcomes) for account management, dispute resolution, and responsible gambling monitoring purposes;
• Login timestamps and session activity logs.

4.5 Support Communication Data

When you contact Crown9 via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution reached, to maintain service quality and to handle any disputes or complaints.

4.6 Data Not Collected

Crown9 processes Personal Data on the following legal bases, depending on the specific processing activity:

Crown9 uses the Personal Data described in Section 4 for the following specific purposes:

1. Account Management: To create, verify, maintain, and service your Crown9 account, including password reset, account recovery, and the application of responsible gambling tools such as deposit limits, loss limits, and self-exclusion requests;
2. Payment Processing: To facilitate MYR deposits and withdrawals via Malaysian payment methods, to verify that payments originate from accounts registered in your name, and to maintain auditable transaction records;
3. KYC and Compliance: To verify your identity and age (21+ minimum), to conduct anti-money laundering (AML) screening, and to comply with applicable licensing obligations, including the reporting of suspicious transactions to regulatory authorities where required by law;
4. Customer Support: To respond to your queries, resolve complaints, and maintain records of support interactions for quality assurance and dispute resolution purposes;
5. Platform Security: To detect, investigate, and prevent fraud, money laundering, multiple account operation, and other prohibited activities as defined in the Crown9 Terms & Conditions;
6. Personalisation: To tailor your Platform experience based on your preferences, game history, and VIP tier status, including delivering relevant promotional offers to users who have opted in to marketing communications;
7. Analytics: To understand how users interact with the Platform in aggregate, identify technical issues, and improve Crown9's product and user experience over time;
8. Legal Compliance: To retain records as required by applicable licensing conditions, and to respond to lawful requests from regulatory or law enforcement authorities.

Crown9 does not sell your personal data to third parties under any circumstances.

Crown9 shares your Personal Data only in the following limited and defined circumstances:

7.1 Payment Processors

When you make a deposit or withdrawal, Crown9 necessarily transmits relevant transaction data to the applicable payment processor (e.g., Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, FPX, or cryptocurrency wallet processors). These processors receive only the data necessary to execute the transaction and operate under their own privacy policies and applicable Malaysian financial regulations.

7.2 KYC Verification Providers

Crown9 uses regulated third-party identity verification service providers to conduct KYC checks. These providers receive identity document images and personal details sufficient to verify identity and age, and are bound by contractual data processing agreements with Crown9.

7.3 Game Software Providers

Game software studios whose titles are available on Crown9 may receive session-level data (e.g., bet amounts, game outcomes) necessary to operate their games and maintain game integrity. No directly identifying personal information beyond an anonymised player reference ID is shared with game studios.

7.4 Technology and Infrastructure Providers

Crown9 uses cloud infrastructure, cybersecurity, and analytics service providers who may process personal data on Crown9's behalf as Data Processors under contractual arrangements that include data protection obligations consistent with this Policy.

7.5 Regulatory and Law Enforcement Authorities

Crown9 will disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required by law, by our international licensing obligations, or pursuant to a valid legal order. Crown9 will notify affected users of such disclosures where legally permitted to do so.

7.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Crown9's business assets, Personal Data held by Crown9 may be transferred as part of that transaction. Users will be notified of any such transfer via a prominent notice on the Platform, and the acquiring entity will be required to honour the commitments in this Policy.

Crown9 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by our international licensing obligations. The following retention periods apply as a general guide:

Following the expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in a manner that prevents re-identification. Crown9 conducts periodic data retention reviews to ensure compliance with this schedule.

Crown9 implements technical and organisational measures designed to protect Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and Crown9's servers is encrypted using 256-bit TLS/SSL protocols — the same standard used by international banking institutions;
• Encryption at Rest: Sensitive stored data, including KYC documents and financial records, is encrypted at rest using AES-256 encryption;
• Access Controls: Access to Personal Data is restricted on a need-to-know basis to authorised Crown9 personnel. Role-based access controls limit the scope of data accessible to any individual employee;
• Password Security: User passwords are stored as one-way cryptographic hashes using industry-standard hashing algorithms. Crown9 staff cannot read your password in plain text;
• Two-Factor Authentication (2FA): Crown9 offers 2FA for account login to provide an additional layer of protection against unauthorised account access;
• Security Monitoring: Crown9 maintains continuous monitoring of Platform activity to detect and respond to security anomalies and suspicious behaviour;
• Penetration Testing: Regular security reviews and penetration testing are conducted by Crown9's technical team to identify and remediate potential vulnerabilities.

In the event of a data breach that is likely to result in a high risk to the rights and freedoms of affected users, Crown9 will notify those users without undue delay, and will report to relevant regulatory authorities as required by applicable law.

Crown9 uses cookies and similar technologies to provide and improve the Platform. The following categories of cookies are in use:

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly. Instructions for managing cookies are available in the help documentation of all major browsers (Chrome, Firefox, Safari, Edge).

Crown9 does not use web beacons, pixel tags, or fingerprinting technologies beyond what is described in this section.

Crown9 operates as an international platform, and some of the third-party service providers used by Crown9 (including cloud infrastructure providers, KYC verification platforms, and game software providers) may be located outside Malaysia or the licensing jurisdiction applicable to Crown9's operations.

Where Personal Data is transferred to service providers outside the country in which it was collected, Crown9 ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements imposing data protection obligations on recipient parties;
• Transfers only to service providers that operate to internationally recognised data protection standards;
• Regular review of third-party data handling practices.

Crown9 does not transfer Personal Data to any country or entity for purposes beyond those described in this Policy.

Subject to applicable law and the legitimate retention obligations described in Section 8, you have the following rights in respect of the Personal Data that Crown9 holds about you. You may exercise any of these rights by contacting Crown9 support as described in Section 15.

Where Crown9 discovers or has reason to believe that an account has been registered by, or is being used by, a person under the age of 21, Crown9 will immediately:

• Suspend the account pending investigation;
• Delete any Personal Data collected in connection with that account where there is no overriding legal obligation to retain it;
• Return any real-money deposits to the originating payment method where lawfully possible;
• Permanently close the account.

If you are a parent or guardian and believe that a minor in your care has registered a Crown9 account, please contact our support team immediately via the details in Section 15. We will treat such reports as a high priority and respond within 24 hours.

Crown9 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or changes in the services we offer. Where changes are material — meaning they substantially alter your rights or our data processing activities — Crown9 will:

• Update the "Last Updated" date shown at the top of this page;
• Post a prominent notice on the Crown9 Platform;
• Where reasonably practicable, send notification to your registered email address at least 14 days before the changes take effect.

Your continued use of the Crown9 Platform following the effective date of any updated Policy constitutes acknowledgement of the changes. If you disagree with any material changes, you may close your account in accordance with Crown9's Terms & Conditions.

We encourage you to review this page periodically to stay informed about how Crown9 protects your personal data.

For any questions, concerns, or requests relating to this Privacy Policy or Crown9's processing of your Personal Data — including data subject rights requests, consent withdrawal, or privacy complaints — please contact our team through the channels below:

• Support Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the Crown9 Platform
• Response Commitment: Privacy-related queries — particularly data subject rights requests — will receive an acknowledgement within 5 business days and a substantive response within 30 days

When submitting a data subject rights request, please include your full name, registered email address, and a description of the specific right you wish to exercise. Crown9 may request proof of identity before processing certain requests to protect against fraudulent access to another person's data.