Privacy Policy — c9vip

01 Scope & Data Controller

This Privacy Policy applies to all personal data processed by c9vip in connection with your use of the website at https://c9vip.app and all associated services, features, games, promotional communications, and customer support interactions (collectively, the "Platform").

c9vip acts as the data controller with respect to personal data collected through the Platform. As data controller, c9vip determines the purposes and means of processing your personal data and is responsible for ensuring that processing activities are conducted in accordance with this Privacy Policy and applicable data protection standards.

This Policy applies to all registered users of the Platform, as well as to visitors who browse the Platform without registering an account. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

02 Data We Collect

2.1 Data You Provide Directly

When you register an account, complete KYC verification, make a transaction, or contact our support team, you provide us with personal data. This includes:

Data Category	Specific Data Points	When Collected
Identity Data	Full legal name, date of birth, gender, nationality, Indonesian National Identity Card (KTP) number or passport number	Registration & KYC verification
Contact Data	Email address, Indonesian mobile number	Registration
Financial Data	Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP), e-wallet identifiers (DANA, OVO, GoPay, ShopeePay, LinkAja), transaction history, IDR Wallet balance	Deposits, withdrawals & KYC
Document Data	Scanned or photographed copies of KTP, passport, SIM (driver's license), and proof of payment method ownership	KYC verification
Communication Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions

2.2 Data Collected Automatically

When you access the Platform — whether logged in or as an anonymous visitor — certain technical data is collected automatically by our systems:

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile, tablet, desktop), screen resolution, and unique device identifiers.
• Usage Data: Pages visited, time spent on each page, clickstream data, game sessions initiated, betting history, search queries entered within the Platform, and features interacted with.
• Location Data: Approximate geographic location derived from your IP address. We do not collect precise GPS location data.
• Session Data: Login timestamps, session duration, logout events, and concurrent session indicators used for security monitoring.

2.3 Data from Third Parties

In limited circumstances, c9vip may receive personal data about you from third-party sources, including identity verification service providers during KYC processing, payment processors confirming transaction authenticity, fraud prevention agencies cross-referencing known risk indicators, and game studios reporting in-game behaviour relevant to platform integrity. All such third-party sources are contractually obligated to share data with c9vip only on a lawful basis.

03 Legal Basis for Processing

c9vip processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing required to register your account, process deposits and withdrawals in IDR, settle bets, and provide customer support — all of which form part of the contractual relationship between you and c9vip.
• Legal Obligation: Processing required to comply with anti-money laundering (AML) obligations, KYC regulatory requirements, age verification mandates, and any lawful requests from competent regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out in furtherance of c9vip's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improvement of Platform features — provided these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for direct marketing communications, personalised promotional offers, and non-essential analytics cookies, where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

04 How We Use Your Data

c9vip uses the personal data we collect for the following purposes:

• Account Management: Creating and maintaining your c9vip account, verifying your identity, processing your KYC documentation, and managing your IDR Wallet.
• Transaction Processing: Facilitating deposits from and withdrawals to your registered bank account or e-wallet — including BCA, BRI, BNI, Mandiri, DANA, OVO, GoPay, ShopeePay, and LinkAja — in Indonesian Rupiah (IDR).
• Platform Delivery: Providing access to sportsbook markets (including BRI Liga 1, EPL, Champions League, and other competitions), casino games, slots, Mahjong, and scratch card products.
• Fraud & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, identity theft, account takeover, and other forms of platform abuse.
• Responsible Gaming: Monitoring betting behaviour patterns to identify potential problem gambling indicators, applying self-exclusion restrictions, and enforcing deposit and loss limits set by you or by our platform safeguards.
• Communications: Sending transactional notifications (deposit confirmations, withdrawal processing updates, security alerts), and — where you have provided consent — promotional communications about bonuses, seasonal offers (such as Idul Fitri promotions or Independence Day campaigns), and new game launches.
• Analytics & Improvement: Analysing aggregated, anonymised usage patterns to improve Platform performance, user experience, and game content selection.
• Legal Compliance: Meeting our obligations under applicable AML, KYC, and data protection regulations as required by our international gaming licence and applicable law.

05 Data Sharing & International Transfers

5.1 Categories of Recipients

c9vip does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share your personal data only with the following categories of recipients, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: Indonesian banks and e-wallet providers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, DANA, OVO, GoPay, ShopeePay, LinkAja) to process deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and AML service providers who verify the authenticity of identity documents and screen against sanctions and politically exposed persons (PEP) lists.
• Game Studios: Licensed software providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft, and others) who operate individual games on the Platform. These providers may receive session identifiers and game outcome data required to deliver the game service.
• Fraud Prevention Services: Specialised agencies that help us detect and prevent suspicious activity, chargebacks, and account takeover attempts.
• IT Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity vendors who process data on our behalf under strict data processing agreements.
• Legal & Regulatory Authorities: Competent authorities, courts, regulators, or law enforcement bodies when required to do so by a valid legal instrument or court order.

5.2 International Data Transfers

Some of c9vip's service providers are located outside Indonesia. Where personal data is transferred internationally, c9vip ensures that appropriate safeguards are in place — including standard contractual clauses, data processing agreements requiring equivalent levels of protection, and in applicable cases, adequacy decisions recognised by the relevant supervisory authority. By using the Platform, you acknowledge that your data may be processed in jurisdictions outside Indonesia in the manner described in this Policy.

06 Cookies & Tracking Technologies

6.1 What We Use

The c9vip Platform uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate core platform functions and, where you have consented, to improve your experience and deliver relevant promotional content. The categories of cookies we deploy are as follows:

Cookie Type	Purpose	Consent Required
Strictly Necessary	Session management, authentication, security tokens, fraud prevention, load balancing	No — essential for Platform operation
Functional	Remembering your language preference, display settings, and recently played games	No — required for basic personalisation
Analytics	Aggregated data on page visits, session duration, and feature usage to improve Platform performance	Yes — opt-in consent required
Marketing	Personalised promotional content, bonus offer targeting, and re-engagement campaigns	Yes — opt-in consent required

6.2 Managing Cookies

You can manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to refuse or delete cookies. Note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging in or placing bets. Disabling analytics and marketing cookies will not affect your ability to use the Platform's core features.

07 Data Retention

c9vip retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention guidelines apply:

• Account Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, to comply with AML record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with applicable AML regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Communication Records: Live chat transcripts and support email correspondence are retained for two (2) years from the date of the interaction.
• Marketing Consent Records: Retained until you withdraw consent, plus an additional period to demonstrate compliance with consent obligations.
• Technical & Usage Logs: Retained for up to twelve (12) months, after which they are anonymised or deleted.

When retention periods expire, personal data is securely deleted or anonymised using industry-standard data destruction methods. Anonymised data may be retained indefinitely for statistical and analytical purposes.

08 Data Security

c9vip implements a layered security architecture to protect your personal data from unauthorised access, loss, alteration, and disclosure. Key security measures include:

• Encryption in Transit: All data exchanged between your device and the c9vip Platform is encrypted using TLS 1.3, the current industry-leading transport security protocol.
• Encryption at Rest: Sensitive personal data — including KYC documents and financial records — is stored in encrypted form on our servers using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis within c9vip. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Password Security: User passwords are stored as salted hashes. c9vip staff cannot view or retrieve your plain-text password under any circumstance.
• Two-Factor Authentication: c9vip offers two-factor authentication (2FA) for account login as an additional layer of protection. We strongly encourage all users to enable this feature.
• Penetration Testing: The Platform undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities proactively.

09 Your Rights

As a user of the c9vip Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request".

c9vip will respond to all verified data rights requests within 30 calendar days. Where a request is complex or high in volume, we may extend this period by a further 30 days with prior written notice to you.

10 Minors & Age Policy

11 Third-Party Services

The c9vip Platform integrates games and services provided by licensed third-party studios, including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. When you launch a game provided by a third-party studio, certain session data — such as your anonymised player ID and game outcome history — may be processed by that studio's servers to deliver the game experience. These studios operate under their own privacy policies and are bound by contractual data processing obligations with c9vip.

The c9vip Platform does not contain links to external third-party websites beyond those necessary to deliver the Platform's own services. We are not responsible for the privacy practices of any third-party website that you may navigate to independently.

12 AML & KYC Obligations

As an internationally licensed online betting operator, c9vip is subject to anti-money laundering (AML) and counter-terrorist financing (CTF) obligations. These regulatory requirements mandate that we:

• Verify the identity and age of all registered users before permitting deposits, withdrawals, or betting activity above prescribed thresholds.
• Maintain records of identity verification and transaction history for a minimum of five years.
• Monitor transactions for patterns consistent with money laundering, structuring, or other financial crime indicators.
• Report suspicious activity to the appropriate regulatory or law enforcement authority as required by applicable law, without prior notification to the account holder.
• Screen users against international sanctions lists, PEP (Politically Exposed Person) databases, and adverse media sources on an ongoing basis.

The collection and retention of KYC documentation and transaction records for these purposes is carried out under a legal obligation and cannot be refused or restricted by the exercise of a data subject right. c9vip will not notify you if a suspicious activity report has been filed, as doing so could constitute a criminal offence under applicable AML legislation.

13 Policy Amendments

c9vip reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, or applicable legal requirements. Where changes are material — meaning they affect your rights or how your personal data is used in a significant way — we will notify you via email to your registered address and display a prominent notice on the Platform at least 7 days before the updated Policy takes effect.

The version of this Privacy Policy published at https://c9vip.app/privacy-policy is the current and authoritative version at all times. The "Last Updated" date at the top of this page reflects when the most recent revision was made. We recommend reviewing this Policy periodically to stay informed about how c9vip protects your data.

14 Contact & Complaints

If you have any questions, concerns, or complaints about how c9vip handles your personal data, or if you wish to exercise any of your data rights, please contact us through the following channel:

This Privacy Policy was last reviewed and updated in January 2026. The version published at https://c9vip.app/privacy-policy is the current authoritative version. Prior versions are available upon request from our support team.