9toto Privacy Policy: How We Handle Player Data

What details does 9toto collect from a new account?

When you sign up we ask for what the account actually needs: your full name as printed on your ID, your date of birth to confirm you are 18 or older, a mobile number, and a password you choose yourself.

Once play starts, ordinary activity records join that file. Deposits, bets, game sessions and withdrawal requests are all logged so a balance can be explained line by line if you ever query it. Payment details stay with the provider you select at the cashier — Touch ’n Go eWallet, DuitNow, FPX Online Banking or Bank Transfer.

Where your data goes: storage, partners and transfers

Player records sit on our own servers and are reachable only by staff whose job needs them: the payments desk, the verification team and the technical crew who keep the platform running. Access is logged, so a file opened for no good reason can be traced.

Some work is handled by outside firms. The game studios shown on the lobby pages, including Evolution, Pragmatic Play, PG Soft and Playtech, receive the session data needed to settle a round. Payment providers receive the amount and reference for a deposit. A hosting partner stores backups. None of them receive your password.

We do not sell player lists, and we do not rent them to advertising networks. Records go to a regulator or a bank only when a lawful request arrives, and each request is recorded along with the reason given.

Verification files: what we ask for and who sees them

Before your first withdrawal we ask for one photo ID: a National ID Card (NID), a Passport or a Driving Licence. The name on the document is checked against the name on the account, and review takes about 6 hours once the scan arrives.

The scan lands in a restricted folder that only the verification team can open. It is never passed to a game provider and never attached to a chat message. If a photo is blurred we simply ask for a clearer one rather than closing anything down.

Cookies and device signals on the site

Cookies keep you signed in, remember your language choice and hold the filters you set in the game lobby. Without them the site would ask for your password on every page, which is both annoying and easier to phish.

Analytics cookies show which games load slowly on Malaysian mobile data and where a page breaks. Those numbers are used to repair the platform; they are not used to build a profile for outside advertisers.

You can clear or block cookies from your browser settings. Clearing the session cookie signs you out straight away, and blocking everything may stop the cashier from loading, so keep first-party cookies on if you plan to deposit.

Holding periods: how long a record stays on file

An open account keeps its full history so that any balance can be reconstructed. After a closure request we stop adding to the file, keep the settled record for the period Malaysian record-keeping rules require, and then delete or anonymise it.

Bonus and turnover records are held slightly longer, because a question about wagering — 22 times on bonus funds — can surface months after the promotion has ended and needs the original record to be answered properly.

Your rights over the data we hold

You do not need a lawyer or a form to make a request. Four things can be asked for at any time, and each one is handled by the privacy desk rather than a bot.

What you can ask for

• A copy of your player record, sent as a file through Live Chat
• Correction of a name, mobile number or billing detail
• Removal from SMS and promotion lists, while keeping the account open
• Account closure, with any remaining balance paid to your verified bank account

How to send a request

1. Message from the account itself

   A request sent from another person or a new device cannot be actioned, because we have no way to prove who is asking.

2. Say which request you want

   Name it plainly: copy, correction, opt-out or closure. One line is enough, and it helps if you add the section of this page you are relying on.

3. Clear one identity check

   Usually a photo ID already on file plus the amount of your last deposit. This step protects you if someone else has your login.

4. Get the reply in the same thread

   The answer arrives in the chat you opened, so there is a written trail on both sides if the request is ever revisited.

Keeping an account safe: our side and yours

Traffic to 9toto runs over an encrypted connection, and the login page locks an account after repeated wrong passwords. Staff never ask for a password, an OTP or a full card number in chat, and any message that does is not from us.

On your side, use a password you have not used on another site and avoid public Wi-Fi at the cashier. If a login looks wrong, change the password and open Live Chat; the team can freeze the account while the record is checked, then restore it once you have confirmed the activity.

Revisions: how we flag a policy update

When a rule changes we rewrite the affected section and note the change at the top of it, so regular readers do not have to compare the whole page. Material changes, such as a new verification step or a new data category, are also announced in the account inbox before they take effect.

Questions we get about stored data