Privacy Policy

This Privacy Policy ("Policy") is published by Vuabai9 ("the Platform", "we", "us", "our") and governs the collection, processing, storage, and disclosure of personal data belonging to all individuals ("you", "the Player", "the User") who access or use the Vuabai9 online casino and sports betting platform available at https://vuabai9.cam, including any associated mobile interfaces or software applications (collectively, "the Services").

Vuabai9 is committed to protecting the privacy and personal data of every player who uses our platform. We recognise that players from across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — entrust us with sensitive information when they register, deposit, and engage with our gaming services. This Policy explains in plain terms what data we collect, the legal basis on which we process it, how it is stored, with whom it may be shared, and what rights you hold over your own data.

By accessing the Vuabai9 platform, creating an Account, or using the Services in any capacity, you acknowledge that you have read and understood this Privacy Policy and that you consent to the data practices described herein. This Policy should be read in conjunction with our Terms & Conditions, which govern the overall relationship between you and Vuabai9.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, either directly or in combination with other available data. This includes names, identity document numbers, email addresses, phone numbers, IP addresses, and financial account details.
• "Processing" means any operation performed on personal data, whether automated or manual, including collection, recording, storage, retrieval, use, disclosure, transmission, combination, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Vuabai9 is the Data Controller in respect of all personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of Vuabai9, under a binding contractual obligation and in accordance with Vuabai9's instructions.
• "KYC Data" means identity verification documents and information collected as part of the Know Your Customer compliance process, including government-issued identification, proof of address, and selfie photographs.
• "Cookies" means small text files placed on your device by the Vuabai9 platform for functional and analytical purposes, as further described in Section 9 of this Policy.
• "Account" means the registered user profile created by a Player through which all gaming, transaction, and communication activities on the platform are conducted.

Vuabai9 collects personal data across several categories, depending on the nature of your interaction with the platform. The following table provides a structured overview of the categories of data we collect and, for each category, the primary purpose for which it is collected:

We do not intentionally collect special categories of sensitive personal data (such as biometric data, health data, or political opinions) beyond what is strictly necessary for identity verification purposes. Any KYC documents containing incidental sensitive information are processed solely for identity verification and are not further analysed for those sensitive data fields.

Vuabai9 collects personal data through the following channels and mechanisms:

• Direct Collection: Information you voluntarily provide during account registration, KYC verification, deposit and withdrawal requests, customer support interactions, and any promotional form submissions.
• Automated Technical Collection: Data collected automatically when you access and use the platform, including IP addresses, device identifiers, browser fingerprints, session timestamps, and click-path analytics via server logs and cookies.
• Payment Service Providers: Limited transactional data returned by Malaysian payment gateways — including DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, and GrabPay — to confirm deposit receipt and facilitate withdrawals. We receive only the minimum data required for payment reconciliation; full financial account credentials are processed by the respective payment provider and are not stored by Vuabai9.
• Third-Party Verification Services: Identity verification and anti-fraud screening services may return supplementary data points (such as sanctions list check results) used for compliance purposes only.

Vuabai9 uses the personal data we collect for the following specific purposes. We process each category of data only to the extent necessary for the stated purpose, in accordance with the principle of data minimisation:

• Account Management: Creating, maintaining, authenticating, and closing your Account; enabling login and session management; enforcing account security policies including the single-account rule.
• Service Delivery: Providing access to casino games, sports betting markets (including Liga Super Malaysia, EPL, UFC, and other covered events), live dealer tables, and all other features of the Vuabai9 platform.
• Payment Processing: Facilitating deposits and withdrawals in Malaysian Ringgit (MYR) via supported payment methods; reconciling transactions; investigating disputed or delayed payments.
• Identity Verification and Regulatory Compliance: Verifying player age (21+), identity, and residency as required by applicable compliance obligations; maintaining records required for anti-money laundering (AML) and Know Your Customer (KYC) compliance.
• Fraud Prevention and Security: Detecting and preventing fraudulent activity, unauthorised access, multi-accounting, and misuse of bonus systems; monitoring for anomalous betting patterns.
• Responsible Gambling Monitoring: Monitoring player activity to identify patterns consistent with problem gambling; applying deposit limits, session controls, and self-exclusion flags in accordance with player requests and our Responsible Gambling obligations.
• Customer Support: Responding to support queries, resolving disputes, maintaining records of interactions for quality assurance and training purposes.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, design, and features of the Vuabai9 platform. No individual player is identifiable from this aggregated data.
• Marketing Communications: Sending promotional emails, in-platform notifications, and offers where you have given explicit consent to receive such communications. You may withdraw consent at any time through your Account Settings.

Vuabai9 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil the contractual obligations arising from our Terms & Conditions, including account management, service delivery, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, identity verification requirements, and record-keeping mandates.
• Legitimate Interests: Processing carried out in furtherance of Vuabai9's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and analytics — provided that these interests are not overridden by your own privacy rights.
• Consent: Processing activities for which you have given specific, informed, and freely given consent, including the sending of marketing communications and the setting of non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Vuabai9 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We may share personal data with third parties only in the following limited and controlled circumstances:

• Payment Processors: We share the minimum necessary financial reference data with our Malaysian payment partners — including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect — to process deposit and withdrawal transactions. These providers are bound by their own data protection obligations and applicable Malaysian financial regulations.
• KYC and Identity Verification Providers: We may engage specialist third-party identity verification services to assist with KYC document review and sanctions screening. All such providers are contractually bound to process data solely for verification purposes and under strict confidentiality obligations.
• Game Content Providers: Where necessary for the delivery of specific games, limited session identifiers may be shared with third-party game providers. These providers do not receive personally identifiable player data beyond what is strictly required for game functionality.
• Analytics and Infrastructure Providers: Anonymised or pseudonymised technical data may be processed by cloud infrastructure and analytics service providers operating under data processing agreements with Vuabai9.
• Legal Disclosure: We may disclose personal data to law enforcement authorities, regulatory bodies, or courts of competent jurisdiction where required by applicable law, a valid legal order, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Vuabai9, its players, or third parties.

The security of financial data is treated as a top priority at Vuabai9. When you make a deposit using any of our supported Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, or Hong Leong Connect — the actual payment credentials (such as bank account numbers, e-wallet PINs, or card numbers) are processed directly by the respective payment provider and are never transmitted to or stored by Vuabai9's systems.

What Vuabai9 does retain is a transaction reference record that includes the transaction amount in MYR, the timestamp, the payment method type (e.g., "Touch 'n Go eWallet"), and a truncated or tokenised reference identifier provided by the payment gateway. This data is retained for the purposes of deposit reconciliation, withdrawal processing, and financial dispute resolution.

All financial transaction records are stored in encrypted format and retained for a minimum of five (5) years in compliance with applicable record-keeping obligations. Access to financial transaction records is restricted to authorised finance and compliance personnel only.

Vuabai9 uses cookies and similar tracking technologies on our platform. A cookie is a small text file placed on your device when you visit our website. Cookies enable the platform to recognise your device, maintain your login session, and deliver a consistent user experience. We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load-balancing cookies. No consent is required for these cookies as they are required for the delivery of the service you have requested.
• Performance and Analytics Cookies: These cookies collect anonymised data about how players use the platform — such as which pages are visited most frequently and whether any pages return errors. This data is used to improve the platform's performance and user experience. These cookies do not identify individual players.
• Functional Cookies: These cookies remember your preferences — such as language settings, interface layout choices, and recently viewed game categories — to deliver a more personalised experience on return visits.

Vuabai9 does not use third-party advertising cookies or cross-site tracking technologies that would allow third-party advertisers to build a profile of your browsing behaviour across the internet. You may manage or disable non-essential cookies through your browser's settings. Please note that disabling certain cookies may impair some functionality of the platform.

Vuabai9 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and Registration Data: Retained for the duration of the active Account relationship, plus a minimum of five (5) years following account closure, to satisfy regulatory compliance and dispute resolution obligations.
• KYC Identity Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in compliance with anti-money laundering record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming Activity Logs: Retained for a minimum of three (3) years from the date of the relevant gaming session, for dispute resolution and responsible gambling monitoring purposes.
• Customer Support Communications: Retained for two (2) years from the date of the relevant interaction, unless the subject matter relates to an ongoing dispute or formal complaint.
• Marketing Preferences: Opt-in and opt-out records are retained for the lifetime of the Account and for three (3) years following account closure, as evidence of consent status.

At the end of any applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes, as it can no longer be used to identify any individual.

Vuabai9 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• AES-256 encryption of all personal data at rest within our database infrastructure.
• TLS 1.3 encryption for all data transmitted between your browser or device and the Vuabai9 platform.
• Passwords stored exclusively as salted cryptographic hashes — never in plain text. Vuabai9 staff cannot view your password under any circumstances.
• Regular independent security audits and penetration testing conducted by qualified third-party cybersecurity firms.
• Strict role-based access controls ensuring that personal data is accessible only to personnel who require it for their specific job function.
• Comprehensive internal data handling training for all personnel who interact with personal data.
• Incident response procedures including prompt internal escalation, containment, and remediation protocols in the event of a data security incident.

In the event of a data security incident that affects your personal data in a manner likely to result in a risk to your rights and freedoms, Vuabai9 will notify affected players promptly via the registered email address on their Account, and will take all reasonable steps to mitigate the impact of the incident.

As a Vuabai9 player, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via live chat or email. We will acknowledge your request within 5 business days and aim to complete all requests within 30 calendar days, subject to verification of your identity and any legally permitted extensions.

Please note that certain rights are subject to limitations where Vuabai9 has a legal obligation to retain data — for example, KYC documents and financial transaction records must be retained for the periods described in Section 10 regardless of a deletion request.

Vuabai9 is strictly an adult platform. The Services are intended exclusively for individuals aged 21 years and above. Vuabai9 does not knowingly collect or process personal data relating to individuals under the age of 21.

Our KYC verification process is specifically designed to confirm that every registered player meets the minimum age requirement before being permitted to deposit or play. Any Account found to have been created by a person under the age of 21 will be immediately closed and all associated funds forfeited, in accordance with our Terms & Conditions and applicable law.

If you have reason to believe that a person under the age of 21 has registered an Account on our platform or that any personal data of a person under 21 has been collected by us, please contact our support team immediately so that we may take prompt remedial action.

Vuabai9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. The most current version of this Policy will always be available at https://vuabai9.cam/privacy-policy, with the "Last Updated" date at the top reflecting the date of the most recent revision.

Where changes to this Policy are material — particularly those affecting how we use your personal data or the rights you hold — we will notify registered players via in-platform notification or email to their registered address at least seven (7) calendar days prior to the revised Policy taking effect. Non-material changes (such as typographical corrections or clarifications that do not alter the substance of any provision) may take effect immediately upon publication.

Your continued use of the Vuabai9 platform following notification of any amendment to this Policy will be taken as your acceptance of the revised terms. If you do not accept the revised Policy, you should contact customer support to discuss account closure options.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your personal data by Vuabai9, please contact our dedicated support team through any of the following channels. We take all privacy enquiries seriously and aim to respond promptly and thoroughly.

When submitting a data access or deletion request by email, please include your registered Account username or email address and a brief description of your request so that we can process it efficiently. We may require additional identity verification before actioning data access requests to ensure that personal data is only disclosed to the verified Account holder.