Privacy Policy — How juta9 Collects, Uses & Protects Your Data

01 Introduction & Scope

This Privacy Policy ("Policy") applies to all personal data processed by juta9 ("juta9", "we", "us", "our") in connection with the juta9 platform accessible at juta9.app, including all associated sub-domains, mobile browser experiences, and related services (collectively, the "Platform").

This Policy applies to all registered members, prospective users who browse the Platform without registering, and any individual whose personal data is processed by juta9 in connection with the Platform. By using the juta9 Platform or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with juta9's Terms & Conditions and Responsible Gaming Policy.

02 Data Controller

juta9 is the data controller in respect of personal data collected and processed through the Platform. As data controller, juta9 determines the purposes for which and the means by which personal data is processed.

For all data protection inquiries, requests to exercise your rights, or privacy-related complaints, you may contact juta9 at:

juta9 will acknowledge data subject requests within 5 business days and respond substantively within 30 calendar days of receipt.

03 Personal Data We Collect

The categories of personal data that juta9 collects and processes in connection with the Platform are set out in the table below. Not all categories are collected from every user — the specific data collected depends on whether you register an account, complete KYC verification, make deposits or withdrawals, or simply browse the Platform.

juta9 does not collect sensitive personal data (such as biometric data beyond what is voluntarily used for device-level authentication, racial or ethnic origin, or health data) except where strictly required for legal compliance.

04 How We Collect Personal Data

juta9 collects personal data through the following methods:

• Direct provision by you: Information you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal request, completing a bonus claim form, or contacting customer support.
• Automated technical collection: Device and technical data collected automatically when you access the Platform, including via cookies, session tokens, server logs, and analytics tools. See Section 7 for full cookie details.
• Third-party payment providers: Financial verification data received from payment processors (including FPX, Touch 'n Go eWallet, Boost, GrabPay, and Malaysian bank partners) when you initiate a transaction on juta9.
• Identity verification partners: Identity and document verification data received from KYC service providers engaged by juta9 to verify the identity and age of registered Users.
• Fraud prevention services: Risk indicators and device intelligence data received from fraud prevention and anti-money-laundering service providers.

05 Purposes of Processing & Legal Bases

juta9 processes your personal data only for specified, explicit, and legitimate purposes. The following table sets out the primary processing purposes and the legal basis relied upon for each:

Where juta9 relies on your consent as the legal basis for processing (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

06 Data Sharing & Disclosure

juta9 does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances and only to the extent strictly necessary:

• Payment processors: Transaction data is shared with Malaysian payment processors (FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow) solely for the purpose of processing your financial transactions.
• KYC and identity verification providers: Identity documents and personal data necessary for age and identity verification are shared with accredited KYC service providers engaged by juta9.
• Fraud prevention and AML services: Risk and transaction data may be shared with fraud prevention and anti-money-laundering screening services to detect and prevent financial crime.
• Game content providers: Anonymised or pseudonymised gameplay data may be shared with third-party game providers for the purposes of game performance and fairness monitoring.
• Legal and regulatory authorities: Personal data may be disclosed to applicable regulatory, law enforcement, or judicial authorities where required by law or in response to a valid legal process.
• Corporate transactions: In the event of a merger, acquisition, or asset sale involving juta9, personal data may be transferred as part of that transaction, subject to equivalent data protection obligations being assumed by the acquiring entity.

07 Cookies & Tracking Technologies

juta9 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that enable certain Platform functions and provide us with information about how the Platform is used.

The categories of cookies used by juta9 are as follows:

• Essential Cookies: Strictly necessary for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing identifiers. These cannot be disabled without preventing Platform use.
• Functional Cookies: Enable personalisation features such as language preferences, remembered login identifiers (where you select "Remember Me"), and game lobby layout preferences.
• Analytics Cookies: Used to understand how Users navigate the Platform, which games are most frequently accessed, and where technical errors occur. Data is aggregated and anonymised where possible.
• Security Cookies: Used for device fingerprinting, fraud detection, and the detection of unusual login activity to protect your Account.

You may manage non-essential cookies through your browser settings. Disabling analytics or functional cookies will not prevent you from accessing juta9, but may affect the personalisation features of the Platform.

08 Data Security

juta9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit TLS encryption for all data transmitted between your device and the juta9 Platform;
• Encryption of sensitive data fields (including passwords, which are stored as irreversible hashes) at rest;
• Strict role-based access controls limiting employee access to personal data to those with a documented operational need;
• Regular independent penetration testing and security audits of Platform infrastructure;
• Anomaly detection systems that identify and alert on unusual account access patterns;
• Physical security controls at data hosting facilities.

Despite these measures, no system is entirely immune to security incidents. In the event of a data breach that is likely to result in a risk to your rights and freedoms, juta9 will notify affected Users in accordance with applicable legal requirements without undue delay.

09 Data Retention

juta9 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. Key retention periods are as follows:

• Account and identity data: Retained for the duration of the Account and for a minimum of 5 years following Account closure, in accordance with anti-money-laundering legal requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, as required by Malaysian financial record-keeping obligations.
• Gaming and betting logs: Retained for 3 years following the relevant gaming session, or longer where required for dispute resolution or regulatory compliance.
• Customer support communications: Retained for 2 years from the date of the last communication, unless a longer period is required for ongoing dispute resolution.
• Responsible gaming records (including self-exclusion data): Retained for the duration of the self-exclusion and for at least 5 years thereafter to prevent re-registration by excluded individuals.
• Marketing consent records: Retained for the duration of the consent and for 2 years after withdrawal of consent.

Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised.

10 Your Data Subject Rights

Subject to applicable law, you have the following rights in relation to your personal data held by juta9:

• Right of Access: The right to request a copy of the personal data juta9 holds about you and information about how it is processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. You may also update certain account details directly via your juta9 Account Settings.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where juta9 no longer has a lawful basis for processing it. Note that this right is subject to legal retention obligations — juta9 may be required to retain certain data regardless of an erasure request.
• Right to Restriction of Processing: The right to request that juta9 restricts the processing of your personal data in certain circumstances (e.g., while the accuracy of data is being verified).
• Right to Data Portability: The right to receive a structured, machine-readable copy of personal data you have provided to juta9, where processing is based on consent or contract.
• Right to Object: The right to object to processing based on legitimate interests, including profiling for marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact juta9 at [email protected] with the subject line "Data Subject Request". We will verify your identity before processing any request and will respond within 30 calendar days.

11 Children & Minors

The juta9 Platform is strictly for individuals aged 21 and above. juta9 does not knowingly collect personal data from any individual under 21 years of age. Age verification via MyKad KYC is a mandatory step before full Account access is granted.

If juta9 becomes aware that personal data has been collected from a person under the age of 21 without the required verification, the relevant Account will be suspended immediately, the data will be reviewed, and any remaining balance will be returned to the deposited source. The personal data of the underage individual will be deleted as soon as it is no longer required for regulatory compliance purposes.

If you are a parent or guardian and believe your child has registered on the juta9 Platform, please contact us immediately at [email protected].

12 Responsible Gaming Data Processing

juta9 processes gaming behaviour data — including bet frequency, session duration, deposit patterns, and game type preferences — for the specific purpose of identifying indicators of potential problem gambling and providing appropriate player protection interventions.

This processing is conducted as part of juta9's responsible gaming obligations. Players who exhibit patterns consistent with problem gambling behaviour may be contacted proactively by juta9's responsible gaming team and offered access to player protection tools including deposit limits, session limits, and self-exclusion.

Responsible gaming data, including self-exclusion records, is processed and retained in accordance with the retention schedule set out in Section 9 of this Policy. This data is never shared with third parties for commercial purposes.

Full details of juta9's responsible gaming tools and commitments are available on the Responsible Gaming page.

13 Third-Party Links

The juta9 Platform may contain references to third-party payment providers or service partners. Where links to third-party websites or services are present, those third parties operate their own independent privacy policies over which juta9 has no control and for which juta9 accepts no responsibility. You are encouraged to review the privacy policies of any third-party service you access in connection with your juta9 account.

14 Amendments to This Policy

juta9 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, the purposes of processing, or your rights — juta9 will provide prior notice via email to your registered address or via a prominent notice on the Platform.

The effective date of the most recent version of this Policy is displayed at the top of this page. Your continued use of the Platform following notification of any amendment constitutes acceptance of the revised Policy. If you do not accept an amendment, you may request account closure by contacting juta9 support.

15 Contact & Complaints

For all privacy-related inquiries, data subject access requests, or concerns about how juta9 handles your personal data, please contact us through either of the following channels:

If you are not satisfied with juta9's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. juta9 is committed to resolving all privacy complaints fairly and transparently, and we take every inquiry seriously.