66aa Club Privacy Policy – Personal Data Protection for Malaysian Players

This Privacy Policy is published by 66aa Club, the operator of the online Sports Betting and casino platform at https://66aaclub.xyz. This policy explains how we process your personal information when you register an account, use our services, contact customer support, or browse our website.

The term "personal data" in the context of this policy refers to any information that can be used to identify you, directly or indirectly — including your name, phone number, email address, payment information, and platform usage data.

This Policy applies to all users of the 66aa Club regardless of location, but is specifically designed to meet the needs and expectations of Malaysian players. We assume that you have read and understood this policy before using our platform.

66aa Club collect your personal data through several channels. Below is a full overview of the types of data we collect and how it is obtained:

Data you provide directly:

• Full name as stated on your Malaysian identity card (MyKad).
• An active Malaysian phone number used for account verification and communications.
• Email address for account notifications and official communications.
• Date of birth for minimum age verification of 18 years.
• Payment method information you have registered — including bank account details, and the phone numbers linked to Touch 'n Go eWallet, DuitNow, GrabPay, Boost, or ShopeePay.
• Identity verification documents (a copy of your MyKad or passport) submitted during the KYC (Know Your Customer) process.
• Information you provide when contacting customer support.

Automatically collected data:

• The IP address and device information used to access the platform.
• The type and version of the web browser or mobile application used.
• Activity log data including pages visited, time of visit, and actions performed within the platform.
• General geolocation data based on IP address (not precise GPS location).
• Cookie data and tracking technologies, described in further detail in Section 8.

Transaction and gameplay data:

• Records of all deposits and withdrawals, including dates, amounts in Malaysian Ringgit (RM), and the payment method used.
• Betting history and matches wagered on.
• Promotion and bonus usage records.
• Account balance and credit movements.

66aa Club uses your personal data for clearly defined and legitimate purposes. We do not process your data for any purpose other than those stated below without first obtaining additional consent from you:

• Account Management: Creating, verifying, and maintaining your account on the 66aa Club platform.
• Identity Verification: Verifying that you meet the age and identity eligibility requirements before granting full access to the platform.
• Payment Processing: Processing deposits via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, or ShopeePay, as well as withdrawals of winnings to the same methods.
• Service Delivery: Enables you to access all platform features including Sports Betting, Live Casino, slots, lottery, and virtual sports.
• Account Communications: Sending notifications related to account activity, changes to terms, security information, and important updates relevant to your use of the platform.
• Customer Support: Helping to resolve queries, complaints, and disputes that you raise with our support team.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, multiple account usage, and behaviour that violates the platform's terms.
• Legal Compliance: Fulfilling the legal, regulatory, and compliance obligations applicable to the operation of the platform.
• Platform Enhancements: Analysing aggregated usage patterns to improve the design, performance, and user experience of the 66aa Club platform.
• Marketing Communications: Sending information about promotions, bonuses, and new offers — only where you have given consent for this type of communication during registration or via your account settings.

66aa Club process your personal data on valid legal grounds. Each processing purpose is linked to an appropriate basis:

• Contract Performance: Processing that is necessary to deliver the services you have requested — including account management, payment processing, and the provision of platform features. Without this processing, we are unable to provide 66aa Club's services to you.
• Legitimate Interests: Processing for the purposes of platform security, fraud prevention, service improvement, and risk analysis – where our legitimate interest in operating a safe and responsible platform does not override your privacy rights.
• Legal Obligations: Processing required under Malaysian law or relevant compliance regulations, including identity verification requirements, transaction record retention, and reporting to the relevant authorities when required.
• Consent: Processing for marketing communications and other optional purposes where we rely on your explicit consent. You may withdraw this consent at any time.

66aa Club does not sell your personal data to any third party. However, in the course of operating the platform, we do share certain data with the following categories of third parties where there is a legitimate need:

• Payment Service Providers: Transaction information that must be shared with payment processors to enable deposits via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, and ShopeePay. These providers are bound by strict data security standards.
• Technology Service Providers: Companies that provide the technical infrastructure, cloud services, data analytics, and security tools used to operate the 66aa club platform. All such providers are subject to data protection agreements with us.
• Game Providers: Casino and slots game software providers that need to receive game session data in order to deliver games to you. This sharing is minimal and limited to what is technically necessary.
• Legal Authorities: Malaysian government agencies, law enforcement authorities, or regulatory bodies with the legal authority to request specific data. We only disclose data when required by law and within the scope defined by a valid order or warrant.

In all of the data-sharing scenarios above, we ensure that recipient parties are bound by data protection obligations equivalent to those we uphold. No data is shared for third-party advertising or cross-marketing purposes without your consent.

66aa Club has implemented a range of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All communications between your device and our servers use TLS protocol with 256-bit SSL encryption — the same standard used by Maybank2u, CIMB Clicks, and other major Malaysian financial institutions.
• Storage Encryption: Sensitive data including passwords and financial information is stored in encrypted format in our database. Passwords are never stored in plain text.
• Access Control: Access to members' personal data within our internal systems is restricted to staff who require it to perform their duties, based on the principle of least-privilege.
• Continuous Security Monitoring: Our security team continuously monitors our systems to detect any suspicious activity, intrusion attempts, or anomalies that may indicate a security breach.
• Two-Factor Authentication: A two-factor authentication feature is available to protect your account from unauthorised access even if your password is compromised.
• Security Audits: Our platform and technical infrastructure are subject to regular independent security audits to identify and address potential vulnerabilities.

66aa Club retain your personal data for as long as necessary to fulfil the processing purposes stated in this policy, unless a longer retention period is required or permitted by law.

• Active Account Data: Retained for as long as your account remains active on the 66aa Club platform.
• Data After Account Closure: Financial and identity transaction records are retained for a minimum of 7 years following account closure, as required by applicable Malaysian financial and compliance legislation.
• Customer Support Data: Support communication records are retained for 3 years to allow reference should any subsequent disputes arise.
• Marketing Data: Marketing preference information and communication history are retained for 2 years after you withdraw consent or close your account.
• Technical Log Data: Access logs and technical activity records are retained for 12 months for security and troubleshooting purposes.

Once the mandatory retention period has expired and there is no other legal basis for continued storage, your data will be securely deleted using certified, irreversible data destruction procedures.

Platform 66aa Club uses cookies and similar tracking technologies to enhance your user experience. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session authentication, and security. These cookies cannot be disabled as they are necessary for the platform to function correctly. An example is the session cookie that identifies you as logged in.
• Preference Cookies: Saving your preferences such as language and display settings to make your experience more comfortable on future visits.
• Analytics Cookies: Helping us understand how players use the platform — which pages are visited most frequently, where users drop off during a process, and how long a typical session lasts. This data is used in aggregated form without identifying any individual, for the purpose of platform improvement.
• Security Cookies: Used to detect suspicious activity and protect your account from unauthorized access attempts.

You can manage cookie preferences through your web browser settings. However, disabling essential cookies may affect platform functionality and your ability to log in or transact securely. Visiting the platform 66aa Club using a browser that blocks all cookies may cause some features to not function properly.

As a player 66aa Club, you have the following rights regarding the personal data we hold about you:

In operating the platform 66aa Club, your personal data may be processed by technical service providers operating outside Malaysia. This is because some of the technical infrastructure and cloud services we use have data centres located in other countries.

When this occurs, 66aa Club ensuring that such data transfers are protected through:

• Binding data protection agreements with overseas service providers, ensuring they adhere to standards equivalent to those we follow.
• Use of service providers operating in countries recognised as having an adequate level of data protection.
• Appropriate contractual protection mechanisms for data transfers to other countries.

We make every effort to select service providers with a strong track record in data protection and compliance with relevant international standards.

Platform 66aa Club is an exclusive service for individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18.

If we discover that we have collected personal data from someone under the age of 18, we will take immediate steps to:

• Closing the relevant account immediately.
• Deleting all personal data collected in connection with that account.
• Processing the return of any remaining funds in the account in accordance with the applicable procedures.

If you are a parent or guardian who has become aware that your child under the age of 18 has registered for or is using the platform 66aa Club, please contact us immediately at support@66aaclub.xyz so that prompt action can be taken.

66aa Club reserves the right to amend this Privacy Policy from time to time to reflect changes in how we handle data, new service offerings, or updated legal compliance requirements.

When we make material changes to this policy, we will:

• Updating the "Last Updated" date at the top of this policy.
• Sending notifications to all registered members via email or platform notification within a reasonable period before changes take effect.
• Displaying a clear notice on the platform's home page informing users of the changes.

Continued use of the platform after the effective date of any policy update constitutes your acceptance of the revised terms. If you do not agree with the changes, you may close your account and request data deletion in accordance with the procedures set out in Section 9.

If you have any questions, concerns, or requests regarding this Privacy Policy or how 66aa Club handles your personal data, please contact us through the following channels:

• Email: support@66aaclub.xyz – For personal data rights requests, please use the subject line "Data Privacy Request".
• Live Chat: Available directly on the 66aa club platform 24 hours a day, 7 days a week.

We are committed to responding to all privacy-related enquiries within 3 business days and fulfilling data rights requests within 30 calendar days. If your request is complex or involves a large volume of data, we may require additional time and will notify you of the expected resolution timeline.