Privacy Policy —joya9 Malaysia

joya9 ("the Platform", "we", "our", "us") operates the website at https://joya9.cam and provides English-language information, guides and account services primarily for users based in Malaysia. As part of operating the Platform, joya9 collects and processes certain personal information from registered Account Holders and visitors.

This Privacy Policy applies to all personal data collected through your use of the joya9 website, whether accessed from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam or any other location. It covers data gathered through account registration, Know Your Customer (KYC) verification, transaction processing, customer support interactions and standard website analytics.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which form part of the complete agreement between you and joya9.

In this Privacy Policy, the following terms carry the meanings below:

• "Personal Data" — any information that identifies, or could reasonably identify, a natural person, including name, email address, telephone number, date of birth, IP address and payment details.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure or destruction.
• "Data Controller" — joya9, as the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" — any third-party service provider that processes Personal Data on behalf of joya9 under a written data processing agreement.
• "Account Holder" / "User" / "You" — any individual who registers an Account on or accesses the joya9 Platform.
• "KYC" — Know Your Customer; the identity and age-verification process conducted in accordance with applicable regulations.
• "Cookie" — a small text file placed on your device by the Platform for purposes including session management, analytics and preference storage.

3.1 — Registration Data

When you register an Account, joya9 collects:

• Full legal name and date of birth
• Email address and telephone number
• Residential address (including postcode and state within Malaysia)
• Username and encrypted account credentials
• Nationality and country of residence

3.2 — KYC Verification Data

To comply with age-verification and anti-money-laundering obligations, joya9 may collect copies of identity documents including a Malaysian MyKad, driving licence or passport, as well as proof-of-address documents such as utility bills or bank statements dated within the preceding three months.

3.3 — Financial Transaction Data

joya9 records deposit and withdrawal transactions to maintain accurate Account Balances, satisfy financial reporting obligations and investigate disputed transactions. Payment method metadata — such as the last four digits of a bank account linked to a DuitNow or FPX transfer, or an eWallet identifier for Touch'n Go, Boost or GrabPay — may be retained as payment record reference. Full card or banking credentials are never stored by joya9 directly and are handled exclusively by certified payment processors.

3.4 — Technical & Device Data

When you browse joya9, our servers and analytics tools may automatically collect:

• IP address and approximate geolocation
• Browser type, version and language settings
• Operating system and device type
• Pages visited, session duration and click-path data
• Referal source (the URL from which you arrived at joya9)

3.5 — Support Communications

When you contact joya9 customer support by email or in-platform messaging, the content of your enquiry, account details referenced and any attachments submitted are retained in our support records. These records are used to resolve your enquiry, train support staff and identify recurring issues.

joya9 processes your Personal Data only where a valid legal basis exists. The following table summarises the primary processing activities and their corresponding legal bases:

5.1 — Types of Cookies Used

• Strictly Necessary Cookies — essential for the Platform to function, including session authentication and security tokens. These cannot be disabled without impairing core functionality.
• Analytics Cookies — used to collect aggregated statistics about how users interact with joya9 pages, helping us identify performance issues and improve navigation.
• Preference Cookies — store user interface settings such as language preference, display theme and notification choices between sessions.
• Marketing Cookies — where consent is obtained, used to measure the effectiveness of promotional communications and tailor relevant content where permissible.

5.2 — Cookie Consent & Control

On your first visit to joya9, a cookie consent notice will present your choices regarding non-essential cookies. Strictly necessary cookies do not require consent. You may withdraw consent or manage cookie preferences at any time through your browser settings. Note that disabling certain cookies may affect Platform functionality, session continuity or your personalisation experience.

6.1 — Service Providers

joya9 engages third-party Data Processors to support Platform operations, including payment gateway providers (who process FPX, DuitNow, Maybank, CIMB and eWallet transactions), identity verification services, fraud-detection providers and cloud hosting infrastructure. All Data Processors are bound by contractual obligations consistent with this Privacy Policy and may process Personal Data only for the stated, limited purpose.

6.2 — Regulatory & Legal Disclosure

joya9 may disclose Personal Data to relevant regulatory authorities, law enforcement agencies or courts where required by applicable law, court order, or regulatory directive. Such disclosure will be limited to the minimum information necessary to satisfy the legal requirement.

6.3 — Business Transfers

In the event of a merger, acquisition, or sale of all or part of the joya9 business, Personal Data held by the Platform may form part of the transferred assets. In such circumstances, affected Account Holders will be notified in advance of any material change to the Privacy Policy or data-controller identity.

joya9 retains Personal Data for as long as it is necessary to fulfil the purpose for which it was collected, comply with applicable legal obligations, resolve disputes and enforce our agreements. The following indicative retention periods apply:

• Account & Registration Data — retained for the duration of the active Account and for a minimum of five (5) years following Account closure, in accordance with anti-money-laundering record-keeping obligations.
• KYC Documents — retained for a minimum of five (5) years from the date of the last transaction or Account closure, whichever is later.
• Transaction Records — retained for a minimum of five (5) years from the transaction date.
• Support Communications — retained for up to three (3) years from the date of the final communication in a support thread.
• Analytics & Technical Data — retained in aggregated or pseudonymised form; raw session logs retained for up to twelve (12) months.

Where Personal Data is no longer required, joya9 will take reasonable steps to securely delete or anonymise the data in accordance with standard information-security practices.

joya9 implements a layered security framework designed to protect Personal Data against unauthorised access, disclosure, alteration or destruction. Technical and organisational measures in place include:

• TLS/HTTPS encryption across all Platform pages and API communications;
• Encryption of sensitive data fields at rest, including passwords stored as salted hashes;
• Access controls limiting Personal Data access to authorised personnel on a need-to-know basis;
• Regular security assessments and vulnerability reviews;
• Activity logging and anomaly-detection monitoring on Account access events;
• Secure document upload channels for KYC submissions.

Despite these measures, no data transmission over the internet is entirely risk-free. Users are advised to use strong, unique passwords for their joya9 Account, avoid public or shared Wi-Fi networks when accessing the Platform, and report any suspected unauthorised Account activity to joya9 support without delay.

Subject to applicable law, Account Holders and users may exercise the following rights in respect of their Personal Data held by joya9. Requests should be submitted to [email protected] with sufficient identification to allow joya9 to verify your identity before acting on any request.

• Right of Access — request a copy of the Personal Data joya9 holds about you.
• Right to Rectification — request correction of inaccurate or incomplete Personal Data.
• Right to Erasure — request deletion of Personal Data where retention is no longer justified, subject to legal retention obligations.
• Right to Restriction — request that joya9 limits processing of your data in defined circumstances.
• Right to Data Portability — request a machine-readable copy of Personal Data you have provided to joya9.
• Right to Object — object to processing based on legitimate interests or direct marketing purposes.
• Right to Withdraw Consent — where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

joya9 will respond to verified rights requests within 30 days. Where a request is complex or numerous, this period may be extended by a further 30 days with prior notification. Certain rights may be limited where overiding legal obligations require data retention.

joya9 employs age-verification measures during the registration process and through KYC checks to prevent access by minors. If joya9 discovers or reasonably suspects that Personal Data has been provided by an individual under the age of 21, the associated Account will be suspended immediately, any balance forfeited in accordance with the Terms & Conditions, and the relevant Personal Data deleted or anonymised without undue delay.

If you believe that a minor has registered on joya9, please notify us immediately at [email protected] so that we can take prompt corrective action.

The joya9 Platform may contain references to third-party websites or services for informational context. joya9 is not responsible for the privacy practices, content or data-handling standards of any third-party website. Following a link to an external site will subject you to that site's own privacy policy, which may differ materially from this Policy. We recommend reviewing the privacy policy of any external site you visit before providing any personal information.

joya9 reserves the right to update this Privacy Policy at any time to reflect changes in legal requirements, Platform functionality or our data-processing activities. The revised Policy will be published on this page with an updated review date. Where amendments are material, joya9 will endeavour to notify registered Account Holders by email using the address on file.

Continued use of the Platform following publication of an updated Privacy Policy constitutes your acceptance of those changes. It is your responsibility to review this page periodically. If you do not agree with any revised terms, please contact support to arrange Account closure.

For questions, rights requests or complaints relating to this Privacy Policy or the processing of your Personal Data, please contact joya9 at the following address. All communications will be acknowledged promptly and handled in accordance with applicable data protection obligations.

Support email: [email protected]
Plain text only — not a clickable link. Service hours are in Malaysia Time (MYT).

Please do not attach sensitive identity documents to general email enquiries. Use the secure upload facility within your registered Account for all KYC submissions, and always confirm you are on the correct HTTPS-secured joya9 website before uploading any documents.