Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how spa09 ("spa09", "we", "us", "our") collects, processes, stores, and protects personal data provided by or obtained about users ("you", "your", "Player", "Data Subject") of the spa09 platform accessible at https://spa09.cam.

spa09 recognises that personal data is a matter of significant trust. We take our data protection obligations seriously and process personal data only where we have a lawful basis to do so, in accordance with applicable international data protection standards.

By registering an account, accessing the spa09 platform, or otherwise providing your personal data to us, you acknowledge that you have read and understood this Policy. Where consent is our lawful basis for processing, your continued use of the platform constitutes that consent. You may withdraw consent at any time, subject to the limitations set out in Section 11 of this Policy.

2 Definitions

The following definitions apply throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, identification number, IP address, and financial information.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, spa09.
• "Data Processor" means a third party that processes personal data on behalf of spa09 under written instruction and data processing agreements.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification process mandated by our licensing obligations and anti-money laundering requirements.
• "Cookies" means small text files placed on your device by the spa09 platform to facilitate functionality, analytics, and personalisation.

3 Data Controller

spa09 acts as the Data Controller in respect of personal data collected through the https://spa09.cam platform. As Data Controller, spa09 is responsible for determining the purposes for which and the manner in which personal data is processed.

For all data protection enquiries, rights requests, or complaints relating to this Policy, you may contact spa09's designated data protection contact at:

4 Personal Data We Collect

spa09 collects personal data through several channels: directly from you when you register or interact with the platform; automatically as you use the platform; and from third parties such as payment processors and KYC verification services.

4.1 Data Collected Directly From You

4.2 Data Collected Automatically

When you access the spa09 platform, we automatically collect certain technical and behavioural data, including:

• Internet Protocol (IP) address and approximate geolocation derived therefrom
• Device type, operating system, browser type and version
• Pages viewed, features accessed, time spent on pages, click-path data
• Session duration and login timestamps
• Wagering activity, game session data, and betting patterns (for fraud detection and responsible gambling monitoring)

4.3 Data Received From Third Parties

spa09 may receive personal data about you from the following third-party sources:

• Payment service providers — including operators of Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Boost, and GrabPay — for the purpose of verifying transaction authenticity and processing deposits and withdrawals
• KYC verification services — third-party identity verification partners used to confirm identity documents and screen against sanctions lists
• Fraud detection services — providers that flag potentially fraudulent account activity based on device fingerprinting and behavioural analytics

5 Purpose & Legal Basis for Processing

spa09 processes personal data only where a clear lawful basis exists. The following table sets out our primary processing purposes and the corresponding legal basis for each:

Where spa09 relies on legitimate interests as a lawful basis, we have assessed that those interests are not overridden by your rights and interests as a data subject. You may object to processing based on legitimate interests by contacting us as set out in Section 15.

6 Data Sharing & Disclosure

spa09 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data only in the following circumstances:

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers to assist in operating the platform. These providers process personal data strictly on our instructions under contractual data processing agreements. Categories of processors include:

• Payment processing infrastructure providers
• Third-party KYC and identity verification services
• Cloud hosting and server infrastructure providers
• Customer support platform operators
• Fraud detection and cybersecurity service providers
• Analytics providers (data shared in pseudonymised or aggregated form where possible)

6.2 Legal and Regulatory Disclosure

spa09 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, a valid legal order, or as necessary to protect the rights, property, or safety of spa09, its players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or transfer of all or part of spa09's business, personal data held by spa09 may be transferred to the acquiring entity, subject to the same or equivalent data protection standards described in this Policy. Affected players will be notified in advance of any such transfer.

7 International Data Transfers

As an internationally licensed platform, spa09 may transfer personal data to recipients located in countries outside Malaysia. Such transfers may occur when data is processed by our cloud infrastructure, KYC verification partners, or other service providers operating in different jurisdictions.

Where personal data is transferred internationally, spa09 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by relevant data protection authorities
• Data processing agreements requiring recipients to uphold equivalent data protection standards
• Transfers to jurisdictions recognised as providing adequate levels of data protection

You may request details of the specific safeguards applied to any international transfer of your personal data by contacting [email protected].

8 Data Retention

spa09 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law or our licensing obligations.

Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in accordance with anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, as required under applicable financial regulations.
• KYC documentation: Retained for a minimum of 5 years following account closure or the completion of the KYC process, whichever is later.
• Customer support communications: Retained for 3 years following the closure of the relevant support case.
• Marketing preferences and consent records: Retained until consent is withdrawn and for 2 years thereafter as evidence of prior consent.
• Technical and analytical logs: Typically retained for 12 months in identifiable form, after which they are anonymised or deleted.

Following expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures.

9 Data Security

spa09 implements comprehensive technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the spa09 platform
• Encryption of sensitive personal data and financial information at rest
• Multi-factor authentication options for player accounts
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Continuous monitoring for suspicious access patterns and potential security incidents
• Regular security assessments and penetration testing by independent third parties
• Staff training on data protection obligations and security practices

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that poses a material risk to your rights and freedoms, spa09 will notify you and relevant supervisory authorities within the timeframes required by applicable law.

10 Cookies & Tracking Technologies

spa09 uses cookies and similar tracking technologies to operate and improve the platform, remember your preferences, and analyse usage patterns. By continuing to use the spa09 platform, you consent to our use of cookies as described in this section.

10.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential to the operation of the platform. These enable core functions such as session authentication, security, and load balancing. They cannot be disabled without significantly affecting platform functionality.
• Functional Cookies: Used to remember your preferences, language settings, and personalisation choices to enhance your experience on the platform.
• Analytical Cookies: Used to collect anonymised or pseudonymised data about how players use the platform, which pages are visited most frequently, and where errors occur. This information helps us improve platform performance and usability.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and other security threats.

10.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to refuse or delete cookies. However, please note that disabling certain cookies may impair your ability to use some features of the spa09 platform. Detailed instructions for managing cookies are available in your browser's help documentation.

11 Your Data Subject Rights

Subject to applicable law and certain exceptions, you hold the following rights in respect of your personal data held by spa09. To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Rights Request". We will respond within 30 calendar days.

Please note that certain rights are subject to legal limitations. For example, we may be required by law to retain certain data even following an erasure request. We will always explain the reason for any such limitation when responding to your request.

12 Minors & Age Verification

The spa09 platform is strictly intended for persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is mandatory as part of the KYC process for all accounts, and any account found to have been registered by a person under 21 will be immediately closed.

If you are a parent or guardian and believe that a minor has registered an account on spa09, please contact us immediately at [email protected]. We will take prompt action to close the account, refund any deposits, and securely delete the associated personal data.

13 Third-Party Links

The spa09 platform does not contain links to external third-party websites. This Policy applies exclusively to data processed by spa09 through the https://spa09.cam platform. If in the future any third-party content is incorporated, those third parties' own privacy policies will govern their data processing, and spa09 accepts no responsibility for those practices.

14 Changes to This Privacy Policy

spa09 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is stated at the top of this document.

Where material changes are made to this Policy — particularly changes that affect the rights of data subjects or expand the categories of data collected or the purposes for which data is processed — spa09 will notify registered players via email to the address held on account, or via a prominent notice on the platform, at least 14 days prior to the changes taking effect.

Your continued use of the platform following notification of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the platform and may request account closure as described in our Terms & Conditions.

15 Contact Us

For all privacy-related enquiries, data subject rights requests, or complaints regarding this Privacy Policy, please contact spa09 using the details below. Please include your registered account email address and a clear description of your request to enable efficient handling.