Privacy Policy — m9wim Data Practices

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "m9wim", "we", "us", "our" — the operator of the m9wim Platform at m9wim.net.
• "Platform" — the m9wim website, all associated sub-domains, mobile-optimised pages, and any service delivered under the m9wim brand.
• "Member", "you", "your" — any individual who registers for, accesses, or uses the Platform in any capacity.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including name, email address, date of birth, government-issued identity number, financial account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transmission, and deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. m9wim acts as Data Controller in respect of all Member Personal Data collected through the Platform.
• "Third-Party Processor" — any external service provider engaged by m9wim to process Personal Data on m9wim's behalf, subject to contractual data protection obligations.
• "KYC" — Know Your Customer, the identity and age verification process required to confirm a Member's eligibility and identity.
• "Cookie" — a small text file placed on your device by the Platform to support functionality, analytics, and personalisation.

2. Data We Collect

2.1 m9wim collects Personal Data across two broad categories: data you provide directly and data collected automatically during your use of the Platform.

Data You Provide Directly

• Registration data: full legal name, date of birth, residential address (including city — Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, or elsewhere in Indonesia), email address, and phone number.
• KYC documents: scanned or photographed copies of your national identity card (KTP), passport, or driving licence; and proof-of-address documents where requested.
• Financial data: bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, or other supported institutions), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction records including deposit and withdrawal amounts denominated in Indonesian Rupiah (IDR).
• Communications data: the content of messages, live-chat transcripts, and emails you send to the m9wim support team.
• Responsible gaming data: deposit limits, self-exclusion preferences, and cooling-off requests you submit through your Account dashboard.

Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device model, screen resolution, and time-zone setting.
• Usage data: pages visited, features used, games played, wagers placed (amount, market, time), session duration, and navigation path through the Platform.
• Cookie and tracking data: session identifiers, preference cookies, and analytics data — described in full in section 9.
• Geolocation data: approximate location derived from your IP address, used to apply jurisdiction restrictions and tailor payment method displays for Indonesian users.

3. How Data Is Collected

3.1 Personal Data is collected through the following channels:

• Account registration form — completed voluntarily when you create a Member account on the Platform.
• KYC verification process — document uploads submitted by you to satisfy identity and age verification requirements before your first withdrawal.
• Deposit and withdrawal transactions — payment details captured automatically when you initiate a transaction via local bank transfer or e-wallet.
• Support interactions — information shared with the support team via live chat, email, or any other contact channel.
• Platform activity — automated collection of technical and usage data as described in section 2 above, via server logs, cookies, and similar technologies.
• Third-party identity verification services — where m9wim uses a licensed KYC provider to validate the authenticity of identity documents, that provider may supply verification results back to m9wim.

4. Purpose of Processing

4.1 m9wim processes your Personal Data for the following purposes:

Purpose	Data Categories Used
Account creation and authentication	Registration data, technical data
Identity and age verification (KYC)	KYC documents, registration data
Processing deposits and withdrawals	Financial data, registration data
Delivering platform services (gaming, sportsbook, casino)	Usage data, technical data
Fraud prevention and anti-money laundering compliance	All categories as required
Responsible gaming tool management	Responsible gaming data, usage data
Customer support and dispute resolution	Communications data, registration data, financial data
Platform analytics and performance optimisation	Usage data, cookie data, technical data
Marketing communications (where you have opted in)	Registration data, usage data
Legal and regulatory compliance	All categories as required by applicable law

4.2 m9wim does not use your Personal Data for purposes incompatible with those listed above. Where a new purpose arises, we will update this Privacy Policy and notify you before the new processing begins.

5. Legal Basis for Processing

5.1 m9wim processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: processing required to perform our obligations under the Member agreement with you — including operating your Account, processing transactions, and delivering gaming services.
• Legal obligation: processing necessary to comply with applicable anti-money laundering regulations, licensing conditions, and lawful orders from regulatory or law enforcement authorities.
• Legitimate interests: processing carried out for fraud prevention, platform security, analytics, and the protection of other Members' interests, provided that such interests are not overridden by your privacy rights.
• Consent: processing for direct marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time by contacting [email protected] or using the unsubscribe link in any marketing email.

6. Data Sharing

6.1 m9wim does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Data is shared with external parties only in the following circumstances:

• Payment processors: your financial data is transmitted to the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute your deposit or withdrawal request.
• KYC and identity verification providers: identity documents are shared with licensed third-party verification services to confirm your eligibility and prevent fraud. These providers process data solely on m9wim's instructions and are contractually prohibited from using it for any other purpose.
• Game and platform technology providers: usage data necessary to deliver casino games and sportsbook functionality may be shared with licensed game studios and platform software providers (such as Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft) under strict data processing agreements.
• Analytics and performance tools: aggregated, anonymised usage data may be processed by third-party analytics tools to help us understand Platform performance and improve the user experience. No personally identifiable information is shared with analytics providers in a form that can be linked back to an individual Member.
• Legal and regulatory authorities: m9wim will disclose Personal Data to law enforcement, regulatory bodies, or courts when required to do so by a lawful order, subpoena, or applicable regulation. Where legally permissible, we will notify you before complying with such a request.
• Corporate restructuring: in the event of a merger, acquisition, or sale of substantially all of m9wim's assets, your Personal Data may be transferred to the acquiring entity. You will be notified of any such transfer and the applicable privacy terms before the transfer takes effect.

6.2 All Third-Party Processors engaged by m9wim are bound by contractual data protection obligations that are at least as protective as those described in this Privacy Policy.

7. Data Retention

7.1 m9wim retains Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

Data Category	Retention Period
Account registration data	Duration of active Account, plus 5 years after closure
KYC documents	Duration of active Account, plus 5 years after closure
Financial transaction records	Minimum 7 years (anti-money laundering compliance)
Support and communications data	3 years from the date of the communication
Usage and analytics data	24 months from collection, then anonymised
Cookie data	Session cookies expire on browser close; persistent cookies per the schedule in section 9
Marketing consent records	Until consent is withdrawn, plus 3 years as evidence of consent

7.2 At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not technically feasible (for example, data held in encrypted backup archives), m9wim will isolate that data from further active processing until deletion is possible.

8. Security Measures

8.1 m9wim implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• TLS/SSL encryption: all data transmitted between your device and the Platform is encrypted using current Transport Layer Security (TLS) protocols, indicated by the HTTPS prefix in your browser address bar.
• Encryption at rest: sensitive data stored on m9wim servers — including KYC documents and financial account identifiers — is encrypted using AES-256 or equivalent industry-standard algorithms.
• Access controls: access to Personal Data is restricted on a strict need-to-know basis. Staff and contractors who handle Member data undergo background screening and receive regular data security training.
• Two-factor authentication: m9wim supports and encourages two-factor authentication (2FA) for Member Accounts to reduce the risk of unauthorised access.
• Penetration testing and vulnerability management: the Platform undergoes periodic security assessments by qualified independent security professionals. Identified vulnerabilities are remediated according to their severity rating.
• Incident response: m9wim maintains a formal data breach incident response procedure. In the event of a confirmed breach affecting Member Personal Data, affected Members will be notified within a reasonable timeframe in accordance with applicable reporting obligations.

8.2 While m9wim takes all reasonable precautions, no online system is completely immune to security risks. You are responsible for keeping your Account credentials confidential and for using strong, unique passwords. If you suspect your Account has been compromised, contact [email protected] immediately.

9. Cookies & Tracking Technologies

9.1 The Platform uses cookies and similar tracking technologies to provide core functionality, remember your preferences, analyse usage patterns, and support responsible gaming features. The following cookie categories are in use:

Cookie Type	Purpose	Duration
Strictly Necessary	Session management, authentication, security tokens, responsible gaming limit enforcement	Session (expires on browser close)
Functional	Language preference, saved payment method display, game lobby layout settings	Up to 12 months
Analytics	Aggregated page-view and navigation statistics to improve Platform performance	Up to 24 months
Marketing	Attribution tracking for promotional campaigns (only where you have opted in to marketing communications)	Up to 90 days

9.2 Strictly necessary cookies cannot be disabled, as they are required for the Platform to function correctly. You may manage functional, analytics, and marketing cookies through your browser settings. Note that disabling functional cookies may impair your experience on the Platform.

9.3 m9wim does not use fingerprinting techniques or cross-site tracking technologies that follow you to third-party websites outside the m9wim domain.

10. Your Data Rights

10.1 As a Member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your Account. m9wim will respond within 30 days of a verified request.

10.2 Please note that certain rights are subject to legal exceptions. For example, m9wim cannot erase financial transaction records during the mandatory 7-year anti-money laundering retention period, even upon request. Where a right cannot be fulfilled in full, m9wim will explain the specific legal basis for the limitation in its response.

11. Minors and the 21+ Requirement

11.1 The Platform is strictly intended for adults aged 21 and above. m9wim does not knowingly collect Personal Data from persons under the age of 21. Age is verified as part of the KYC process for all Members. Where m9wim discovers that a Member is under 21, the Account will be closed immediately, all Personal Data collected will be securely deleted (subject only to any legal obligation to retain evidence of the underage access incident), and any Balance will be refunded to the originating payment method.

11.2 If you have reason to believe that a minor has registered or is using the Platform, please report this immediately to [email protected]. m9wim will investigate and take appropriate action within 48 hours WIB of receiving a verified report.

12. International Data Transfers

12.1 m9wim operates as an internationally licensed platform. Personal Data collected from Indonesian Members may be transferred to and processed on servers located outside Indonesia, in the jurisdiction where m9wim holds its operating licence and where its technology infrastructure is hosted.

12.2 Where Personal Data is transferred internationally, m9wim ensures that equivalent data protection standards are applied through one or more of the following safeguards: contractual data protection clauses with the receiving entity; transfer to a jurisdiction that maintains an adequate level of data protection as recognised by international standards; or other legally recognised transfer mechanisms.

12.3 Specific data shared with Indonesian payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) remains within Indonesian banking infrastructure and is subject to applicable Indonesian data and financial regulations.

13. Amendments to This Policy

13.1 m9wim reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The most current version will always be published at m9wim.net/privacy-policy with the updated effective date shown at the top of the page.

13.2 Where changes are material — for example, a new category of data being collected, a new sharing arrangement with a third party, or a change to your rights — m9wim will notify registered Members via their registered email address or via an in-platform notification at least 14 days before the changes take effect.

13.3 Continued use of the Platform after the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the amended Policy, you should cease using the Platform and request Account closure by contacting [email protected].

14. Contact & Complaints

14.1 For any question, concern, or request relating to this Privacy Policy or the processing of your Personal Data, please contact the m9wim data team using the details below:

14.2 If you are not satisfied with m9wim's response to a privacy complaint, you may escalate by marking a follow-up email "Formal Privacy Complaint". m9wim's compliance team will review escalated complaints at a senior level and provide a final decision within 14 calendar days of the escalation being logged.

14.3 m9wim is committed to resolving all privacy concerns promptly and fairly. We treat every data enquiry with the same seriousness we apply to platform security — because protecting your information is fundamental to the trust you place in m9wim as a platform.