Privacy Policy

CQ9 Casino Malaysia ("CQ9", "we", "our", "us"), operator of the online gaming platform accessible at https://cq9.cam, is committed to safeguarding the privacy and personal data of all registered members and visitors. This Privacy Policy sets out in clear and transparent terms the categories of personal data we collect, the purposes for which such data is processed, how it is stored and protected, and the rights available to you as a data subject.

This Policy applies to all personal data collected through your use of the CQ9 platform — whether you are browsing as a guest, completing the account registration process, making a deposit via Touch 'n Go eWallet, DuitNow, or any other supported payment method, or contacting our support team. It also covers data collected through our website cookies and analytics technologies.

By creating a CQ9 account or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood how CQ9 handles your personal data. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to request account closure.

The following definitions apply throughout this Privacy Policy:

CQ9 collects personal data only to the extent necessary for the lawful operation of the Platform, the delivery of our services, and compliance with our regulatory and licensing obligations. The categories of personal data we process are as follows:

CQ9 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, or health information, except where health-related information is voluntarily disclosed by a User in the context of a responsible gambling interaction or self-exclusion request.

CQ9 collects personal data through the following channels and mechanisms:

• Account Registration: When you create a CQ9 account, you directly provide identity, contact, and credential information through the registration form.
• KYC Submissions: Document uploads submitted during identity verification are collected and stored in our secure compliance system.
• Deposits and Withdrawals: Financial data is captured when you initiate transactions using DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or any other supported payment method.
• Platform Interactions: Usage data — including bet placement records, game session logs, and navigation patterns — is captured automatically as you interact with the Platform.
• Support Communications: When you contact our support team via live chat or email, the content of those communications is recorded for quality assurance and dispute resolution.
• Cookies and Tracking Technologies: Technical data is collected automatically through cookies and similar technologies when you access the CQ9 website. See Section 10 for full details.
• Third-Party Verification Providers: Where CQ9 engages third-party KYC or fraud detection services, those providers may supply additional data points to supplement our own records.

CQ9 processes your personal data strictly for the following purposes. We do not process personal data in ways that are incompatible with the purposes for which it was originally collected, unless you have provided explicit consent or we are required to do so by law.

• Account Management: To create, maintain, secure, and administer your CQ9 player account, including managing your balance, bonus eligibility, and transaction history.
• Identity Verification (KYC): To verify your identity and confirm eligibility to use the Platform, including the confirmation that you meet the minimum age requirement of 21 years.
• Payment Processing: To facilitate deposits via local Malaysian payment methods and cryptocurrency channels, and to process withdrawal requests to your nominated account.
• Fraud and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and other conduct prohibited by our Terms & Conditions or applicable law.
• Regulatory Compliance: To meet the record-keeping, reporting, and audit requirements imposed by CQ9's international gaming licence and any applicable data protection legislation, including Malaysia's PDPA.
• Customer Support: To respond to your enquiries, resolve disputes, and deliver the service quality you are entitled to expect as a CQ9 member.
• Responsible Gambling: To monitor player behaviour for indicators of problem gambling and to support the delivery of responsible gambling tools including deposit limits, session reminders, and self-exclusion mechanisms.
• Platform Improvement: To analyse aggregated usage data, identify technical issues, and make evidence-based improvements to the CQ9 user experience across desktop and mobile environments.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw this consent at any time.

CQ9 processes your personal data on one or more of the following legal grounds, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and CQ9, including account creation, transaction processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable laws and our international gaming licence obligations, including anti-money laundering (AML) and know-your-customer (KYC) requirements.
• Legitimate Interests: Processing is in the legitimate interests of CQ9 and not overridden by your fundamental rights — for example, fraud detection, security monitoring, and platform analytics.
• Consent: Where processing is based on consent — such as marketing communications — you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

CQ9 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Processors: Financial data is shared with licensed payment service providers — including those facilitating transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — solely to execute the transactions you have initiated.
• KYC and Compliance Providers: Identity documents and verification data may be shared with specialist third-party KYC verification platforms engaged by CQ9 under data processing agreements that bind those providers to equivalent data protection standards.
• Fraud Prevention Partners: Technical and behavioural data may be shared with fraud detection service providers to protect the integrity of the Platform and safeguard all users.
• Regulatory and Law Enforcement Authorities: CQ9 may disclose personal data to competent regulatory bodies, courts, or law enforcement agencies where required to do so by applicable law, court order, or the terms of our gaming licence.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of CQ9's business, personal data held by CQ9 may be transferred to the relevant successor entity, subject to equivalent privacy protections.

CQ9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory and legal obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with your CQ9 account is retained for the duration of your active membership and for a minimum period of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction data — including deposit and withdrawal records — is retained for a minimum of seven (7) years to satisfy audit and compliance obligations under our international gaming licence.
• KYC Documents: Identity verification documents are retained for the period required under applicable licensing regulations, typically five (5) years from the date of submission or from account closure, whichever is later.
• Support Communications: Customer service records are retained for a period of three (3) years from the date of the last interaction, to support ongoing service quality monitoring and dispute resolution.
• Marketing Preferences: Consent records and marketing communication history are retained for the duration of your active membership and for one (1) year following account closure or consent withdrawal.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an individual data subject.

CQ9 implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the CQ9 platform is encrypted in transit using industry-standard Transport Layer Security (TLS) protocols.
• Encrypted Data at Rest: Sensitive data fields — including financial details and identity document files — are encrypted in storage using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted to authorised CQ9 personnel on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
• Multi-Factor Authentication (MFA): Administrative access to CQ9's data infrastructure requires multi-factor authentication. Members are encouraged to enable available authentication options on their own accounts.
• Penetration Testing & Security Audits: CQ9 conducts periodic independent security assessments to identify and remediate vulnerabilities in the Platform's infrastructure.
• Incident Response Procedures: CQ9 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, you will be notified in accordance with applicable legal requirements.

CQ9 uses cookies and similar tracking technologies on the Platform to ensure core functionality, maintain session security, and gather aggregated analytics data that helps us improve the user experience. The types of cookies we deploy are as follows:

You may manage your cookie preferences through your browser's settings. Please note that disabling strictly necessary cookies may impair your ability to log in or use core Platform features. CQ9 does not deploy third-party advertising cookies or cross-site tracking cookies for the purpose of delivering targeted advertisements.

Subject to the legal basis on which your data is being processed and applicable local law, you hold the following rights with respect to your personal data as held by CQ9:

• Right of Access: You may request a copy of the personal data CQ9 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data held in your CQ9 account.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to CQ9's overriding legal retention obligations.
• Right to Restriction: You may request that CQ9 restrict the processing of your personal data in certain circumstances — for example, while a disputed accuracy claim is being resolved.
• Right to Data Portability: You may request that CQ9 provide your personal data in a structured, machine-readable format for transfer to another controller, where technically feasible.
• Right to Object: You may object to the processing of your personal data on grounds of legitimate interests or for direct marketing purposes. Where the objection relates to direct marketing, CQ9 will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please submit a written request to the CQ9 support team at the contact details in Section 15. CQ9 will respond within 30 calendar days of receiving a valid, verifiable request.

CQ9's services are strictly restricted to individuals aged 21 years and above. CQ9 does not knowingly collect, store, or process personal data relating to any individual under the age of 21. Where CQ9 becomes aware that personal data has been submitted by or on behalf of a person under the age of 21, such data will be immediately deleted and the associated account suspended pending review.

If you are a parent or guardian and believe that your child has submitted personal data to CQ9, please contact us immediately using the details in Section 15. We will take prompt action to remove the relevant data and close the account.

CQ9 operates under international online gaming licensing and may process or store personal data on servers located outside of Malaysia. Where personal data is transferred to a jurisdiction that does not offer an equivalent level of data protection to Malaysia's PDPA, CQ9 ensures that appropriate safeguards are in place prior to the transfer. These safeguards may include standard contractual clauses, binding corporate rules, or transfers to jurisdictions recognised as providing adequate data protection.

CQ9 engages only with third-party data processors that have committed, by contract, to data protection standards equivalent to those applied by CQ9 itself. A list of categories of third-party processors engaged by CQ9 is available on request via our support team.

CQ9 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our Platform's features. Where amendments are material — for example, where a new category of data is being collected or a new purpose for processing is introduced — CQ9 will provide advance notice to registered members by email or via an in-platform notification.

The "Last Updated" date displayed at the top of this page indicates when the most recent version of the Policy was published. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you should cease use of the Platform and submit an account closure request.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or wish to raise a concern about how CQ9 handles your personal data, please contact our Data Protection team. We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 calendar days.