Privacy Policy

This Privacy Policy ("Policy") is issued by max39 ("the Platform", "we", "us", "our") and applies to all personal data collected from users ("you", "your", "the Player") through the max39 website at https://max39.cam, including all associated mobile applications, services, games, sports betting markets, customer support channels, and any other digital touchpoints operated by max39.

max39 takes its obligations as a data controller seriously. We are committed to handling your personal data lawfully, fairly, and transparently. This Policy is designed to give you a clear and complete picture of our data practices so that you can make informed decisions about your use of the Platform.

By registering an account, accessing the Platform, or submitting personal information to max39 in any form, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any aspect of this Policy, you should not use the Platform.

This Policy is effective as of 1 January 2026. We will notify registered Players of any material changes by email or by posting a prominent notice on the Platform.

For the purposes of this Policy, the following terms carry the meanings set out below:

max39 collects personal data through several distinct channels. The categories of data we collect, and the primary channel through which each is collected, are set out below.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number, residential address, and username selected at the time of account creation.
• Identity verification documents: Copies of government-issued photographic identification (e.g., Malaysian MyKad or passport) and proof of residential address submitted as part of our KYC process.
• Financial data: Payment method details necessary to process deposits and withdrawals, including bank account identifiers (where applicable), e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay, etc.), and cryptocurrency wallet addresses. max39 does not store full card numbers; payment card data is handled exclusively by our certified payment service providers.
• Support communications: Records of any messages, complaints, chat transcripts, or other correspondence you submit to our customer support team.
• Responsible gambling declarations: Any self-assessments, self-exclusion requests, deposit limit settings, or other inputs you make through the Platform's responsible gambling tools.

3.2 Data Collected Automatically

• Technical identifiers: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, games played, bets placed, session duration, click-stream data, and navigation paths within the Platform.
• Transaction data: Records of all deposits, withdrawals, wagers, bonus claims, and account balance movements.
• Geolocation data: Approximate geographic location derived from your IP address, used to enforce jurisdictional access controls. max39 does not collect precise GPS-level location data.
• Cookie and tracking data: Data collected via cookies, web beacons, and similar technologies, as described in Section 9 of this Policy.

3.3 Data Received from Third Parties

• Identity verification services: Confirmation and risk-scoring data from third-party KYC and AML screening providers engaged by max39.
• Payment processors: Transaction confirmation and fraud-screening signals from payment service providers including those facilitating DuitNow, FPX, and e-wallet transactions.
• Fraud prevention databases: Data from industry-standard fraud and problem gambling databases where max39 is authorised to access such information for player protection purposes.

max39 uses the personal data it collects for the following purposes:

max39 does not engage in automated individual decision-making — including profiling — that produces legal or similarly significant effects on Players, without first providing you with the ability to request human review of that decision.

max39 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to register your account, verify your identity, process payments, and deliver the gaming and betting services you have requested is necessary for the performance of our contract with you.
• Legal obligation: Processing required to comply with KYC, AML, responsible gambling, and data retention obligations imposed by applicable laws and our licensing authority.
• Legitimate interests: Processing undertaken for fraud prevention, platform security, dispute resolution, and aggregate service analytics, where those interests are not overridden by your data protection rights. You may object to processing on this basis; see Section 11.
• Consent: Processing for direct marketing communications (including promotional emails about new games, bonuses, and Liga Super Malaysia or EPL betting offers) is conducted only where you have given explicit, freely withdrawable consent. You may withdraw consent at any time by contacting our support team or updating your communication preferences in your account settings.

max39 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following limited and controlled circumstances:

• Payment service providers: Entities facilitating DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency payment processing receive the minimum data necessary to execute and verify transactions.
• Identity verification and AML screening providers: Third-party KYC and fraud-screening services receive identity data to enable regulatory-compliant age and identity verification.
• Game software providers: Where a game is provided by a third-party software supplier, that supplier may receive technical session data (e.g., a pseudonymous session token) to manage game state. These providers do not receive your full identity data.
• IT infrastructure and hosting providers: Entities providing cloud hosting, database, and network infrastructure services to max39, operating under strict data processing agreements.
• Regulatory and law enforcement authorities: Where max39 is required by law, court order, or regulatory direction to disclose personal data. Where legally permissible, we will notify you of such a request before complying.
• Responsible gambling bodies: In certain circumstances, and in accordance with our licensing obligations, max39 may be required to report player data to designated responsible gambling or self-exclusion registers.

max39 operates in a global digital environment. Certain service providers and technical infrastructure partners may be located in jurisdictions outside Malaysia. Where your personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable in your jurisdiction, max39 will implement appropriate safeguards to protect your data, which may include:

• Standard contractual clauses approved by the relevant data protection authority;
• Binding corporate rules where the transfer is within a corporate group; or
• Other legally recognised transfer mechanisms as appropriate to the circumstances.

You may request further information about the safeguards in place for a specific international transfer by contacting our support team at the details provided in Section 14 of this Policy.

max39 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted using industry-standard methods or irreversibly anonymised such that you can no longer be identified from the remaining data.

max39 uses cookies and similar tracking technologies (including web beacons and local storage) on the Platform. Cookies are small data files placed on your device that enable certain Platform features to function correctly and allow us to understand how the Platform is being used.

9.1 Categories of Cookies We Use

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable core features such as user authentication, session maintenance, and security controls. These cookies do not require your consent and cannot be disabled while you use the Platform.
• Functional cookies: These cookies remember your preferences (such as language settings and game display options) to personalise your experience. They are set only with your consent.
• Analytical cookies: These cookies collect aggregate, anonymised data about how Players use the Platform — which pages are visited most frequently, which games are most popular, and where users encounter errors. This data is used solely to improve the Platform. Analytical cookies are set only with your consent.
• Session integrity cookies: Short-lived cookies used to maintain the continuity of your active gaming or betting session. These are deleted when you close your browser.

You can manage your cookie preferences through the cookie consent panel available on the Platform. You may also manage cookies through your browser settings, though disabling strictly necessary cookies will impair the Platform's ability to function correctly.

max39 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your device and the max39 Platform is encrypted using current TLS standards.
• AES-256 encryption at rest: Personal and financial data stored in our databases is encrypted using AES-256, the same standard employed by major banking institutions.
• Two-factor authentication (2FA): Available for all Player accounts and mandatory for administrative access to our internal systems.
• Role-based access controls: Access to personal data within max39's internal systems is restricted on a strict need-to-know basis, with access logs maintained and reviewed regularly.
• Regular security audits: The Platform undergoes periodic penetration testing and vulnerability assessments conducted by independent security specialists.
• Incident response procedures: max39 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify affected individuals and, where required, the relevant supervisory authority, within applicable statutory timeframes.

Subject to applicable law and any overriding legitimate interests or legal obligations, you hold the following rights in relation to your personal data held by max39. To exercise any of these rights, please contact us at the details set out in Section 14.

• Right of access: You may request a copy of the personal data max39 holds about you, together with information about how that data is used and shared.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected or completed without undue delay.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to legal or regulatory retention obligations that may require us to retain certain data.
• Right to restriction of processing: You may request that we temporarily restrict processing of your personal data — for example, while you contest the accuracy of the data or the legitimacy of our processing.
• Right to data portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests (including profiling for personalisation purposes) at any time. You may also withdraw consent for marketing communications at any time with immediate effect.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to request human review of any such decision.

max39 will respond to all valid rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 30 days, notifying you of the extension and the reason for it. Processing of rights requests is free of charge for standard requests; we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

The max39 Platform is strictly intended for persons aged 21 years and above. max39 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted at the point of registration and reinforced through our KYC process.

If max39 becomes aware that personal data has been collected from a person under 21 — whether through a failure of our verification process or through other means — we will take immediate steps to delete that data, close the associated account, and, where applicable, return any deposits made (net of any withdrawals already processed).

If you believe that a minor has registered an account on max39, please contact our support team immediately. We treat all such reports as a matter of urgent priority.

max39 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or business operations. When we make material changes to this Policy, we will provide notice to registered Players by:

• Sending an email notification to the address registered on your account; and/or
• Displaying a prominent notice on the Platform prior to the change taking effect.

The updated Policy will always be accessible on this page, with the effective date displayed at the top. We encourage you to review this Policy periodically. Continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or to the exercise of your data subject rights, please contact the max39 data protection team through the following channels:

If you are dissatisfied with how max39 has handled your personal data or a rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We ask that you contact us first to give us the opportunity to address your concerns directly — in most cases we can resolve issues promptly through our internal process.

For issues relating to our responsible gambling practices or self-exclusion procedures, please visit our dedicated Responsible Gambling page.