Privacy Policy A66 Group – How We Protect Malaysian Players' Data

This Privacy Policy ("Policy") is published by A66 Group ("we", "Platform") and applies to all individuals who register, browse, or use our online betting platform at a66group.best, including all related services such as Sports Betting, Live Casino, lottery, e-sports, and poker.

A66 Group operates with the understanding that the trust of Malaysian players is our most valuable asset. That trust can only be built on full transparency about how we handle the data you entrust to us. For this reason, this Privacy Policy is written in plain, accessible language — not confusing legal jargon — so every member can genuinely understand their rights and choices.

This Policy covers all personal data collected through our web platform, mobile application (where available), email and WhatsApp communications, and interactions with the A66 Group customer support team. It does not cover third-party websites that may be linked from our platform.

A66 group collects various categories of personal information depending on how you interact with our platform. Below is a full list of the data we may collect:

Personal Identification Information:

• Full name as shown on your Malaysian MyKad or passport;
• Malaysian Identity Card number (MyKad number) for identity verification purposes;
• Date of birth — to verify that you are 18 years of age or older;
• Current residential address in Malaysia;
• An active Malaysian mobile phone number;
• An active, reachable email address.

Financial Information:

• E-wallet account name (Touch 'n Go, GrabPay, Boost, ShopeePay) used for deposits and withdrawals;
• Malaysian bank account number registered for withdrawals via FPX;
• Records of all deposit and withdrawal transactions in MYR;
• Account balance history and financial activity within the platform.

Platform Usage Data:

• Records of all betting activity, casino gameplay, lottery tickets purchased, and poker sessions;
• Login history including date, time, and IP address;
• Device type, operating system and browser used;
• Usage data on platform features and navigation patterns.

A66 group collects personal data through several distinct channels. Understanding these channels helps you make more informed decisions about the information you share with us:

• Registration Form: Information you provide directly when registering a new account with a66 group — this is our primary source of data;
• Identity Verification (KYC): Documents you upload during the Know Your Customer process, such as your MyKad image or bank statement;
• Financial Transactions: Data collected automatically when you make a deposit via Touch 'n Go, GrabPay, Boost, DuitNow, FPX, or Maybank2u;
• Platform Usage: Data recorded automatically as you use the platform — including bets placed, games played, and features used;
• Support Communications: Information you provide when contacting the a66 group support team via Live Chat, WhatsApp, or email;
• Cookies & Tracking Technologies: Technical data collected automatically through your browser – see Section 7 for more details;
• General Information: In certain cases, publicly available information relevant for identity verification or security purposes.

A66 group does not purchase data lists or obtain your personal information from data brokers or third-party sources for marketing purposes. All data we hold has been provided directly by you or generated through your own use of our platform.

A66 Group uses collected personal data solely for legitimate purposes necessary to operate the platform. Below is a complete and transparent data usage table:

A66 group will not use your data for any purpose beyond those listed above without first obtaining your renewed consent. If you no longer wish to receive marketing communications from a66 group, you may unsubscribe at any time via the link provided in any of our emails, or by contacting our support team.

A66 group understands that you want to know exactly who may have access to your data. We do not sell or rent your personal data. However, there are limited situations where sharing data with certain parties is necessary to operate the platform:

• Payment Service Providers: Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX and Malaysian banks that process your financial transactions. They receive only the data necessary to complete the relevant transaction;
• Technology Service Providers: Companies that provide a66 group's technical infrastructure — such as cloud computing services, email delivery, and customer support systems. All such providers are bound by strict data protection agreements;
• Game Providers: Companies that supply casino and poker game content to a66 group may receive technical data necessary to verify game fairness and resolve disputes;
• Legal Authority: a66 group will disclose required data to Malaysian authorities (police, courts, tax agencies) when mandated by law or a valid court order. We will notify you of any such disclosure unless prohibited by law from doing so;
• Independent Audit Body: Audit firms that review A66 Group's RNG systems and security may access anonymised data for fairness verification purposes.

A66 group employs multiple layers of technical and procedural security to protect member personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All communications between the platform and your device are protected with the highest level of encryption used in the financial industry;
• Static Data Encryption: Sensitive data stored in a66 group databases — including MyKad numbers and financial details — is stored in encrypted format using industry-standard encryption algorithms;
• Multi-Layer Access Control: a66 group servers are protected by multi-layered firewalls, intrusion detection systems, and role-based access controls;
• Two-Factor Authentication: a66 group's internal systems require two-factor authentication for all staff accessing member data;
• Regular Security Audits: Security testing and vulnerability audits are conducted regularly by both our internal security team and independent external auditors;
• Secure Data Backup: Data is backed up regularly to a secure, separate location to ensure continuity of service.

Data Retention Period: a66 group retains members' personal data for as long as their account remains active, and for a defined period after account closure — depending on the data category and applicable legal requirements. Financial transaction records are typically kept for 7 years, as required under Malaysia's anti-money laundering regulations. Once the relevant retention period has lapsed, data will be securely deleted or anonymised.

The a66 group platform uses cookies and similar tracking technologies to enhance your experience and help us understand how the platform is being used. Below is an explanation of the types of technologies involved:

• Essential Cookies (Required): These cookies are required for the platform to function – including login session cookies that keep you signed in, security cookies that detect suspicious activity, and technical cookies for platform performance. These cookies cannot be disabled;
• Functional Cookies: Cookies that remember your preferences — such as interface language, display settings, and game preferences — to improve your experience. You can disable these cookies, though some platform features may not function as intended;
• Analytics Cookies: a66 group uses internal analytics tools to understand platform usage patterns on an aggregated and anonymised basis — this helps us improve the platform over time. This information does not identify you personally;
• Local Storage: The A66 Group platform also uses browser local storage to save interface preferences and temporary session data, improving the speed and responsiveness of the platform on your device.

You can manage your cookie settings through your browser at any time. However, disabling all cookies may affect the functionality of the A66 Group platform. For more information on managing cookies, refer to the help section of your browser.

As A66 Group involves financial transactions in MYR, we apply additional security measures to protect members' financial data — an area we consider the most critical from a privacy and security standpoint.

When you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks, and other banks), you will be redirected to the secure interface of the respective payment provider. A66 Group never stores your e-wallet or bank account password – the entire authentication process takes place within the payment provider's secure environment.

To guard against money laundering and financial fraud, a66 group conducts AML (Anti-Money Laundering) checks that may require verification of additional financial information. Data collected during this process is used solely for legal compliance purposes and is not shared for any other reason unless directed by a competent authority in Malaysia.

A66 group recognises and respects your rights regarding personal data. You may exercise the following rights at any time by contacting our team:

• Right to Access: You have the right to receive a copy of the personal data we hold about you. This request will be processed within 30 business days;
• Right to Rectification: If the data A66 Group holds about you is inaccurate or outdated, you have the right to request a correction. Basic details such as phone number and address can be updated directly through your account settings;
• Right to Erasure: Under certain circumstances, you have the right to request that we delete your personal data — subject to any applicable legal data retention requirements;
• Right to Object: You have the right to object to the processing of your data for specific purposes such as marketing communications. You can unsubscribe from marketing immediately via the link in any email or by contacting support;
• Right to Restriction: In certain circumstances, you may request A66 Group to temporarily restrict the processing of your data while an issue is being resolved;
• Right to Data Portability: You have the right to receive a copy of your personal data in a machine-readable format (CSV or JSON) for transfer to another platform should you close your A66 Group account.

To exercise any of the rights listed above, contact the A66 Group privacy team by email at support@a66group.best with the subject line "Privacy Rights Request", specifying the particular right you wish to exercise along with sufficient information for us to verify your identity. We will acknowledge your request within 5 business days and aim to resolve it within 30 days.

The A66 Group platform is exclusively restricted to individuals aged 18 and above. A66 Group does not knowingly collect or process any personal data from individuals under the age of 18.

If you believe A66 Group may have collected data from someone under the age of 18, please contact us immediately at support@a66group.best. We will investigate and delete any relevant data as promptly as possible once confirmed.

A66 group applies a strict age verification process during registration, including MyKad number checks and, in certain cases, requests for additional supporting documents. Accounts suspected of being used by underage individuals will be suspended immediately pending investigation.

A66 group reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to how we protect your data. The "Last Updated" date at the top of this page indicates when the Policy was last revised.

When we make material changes to this Privacy Policy — changes that significantly affect how your data is collected, used or shared — we will:

• Sending a notification to your registered email address at least 14 days before the changes take effect;
• Displaying a clear notice on the A66 Group platform's main page;
• Updating the "Last Updated" date at the top of this page.

Your continued use of the a66 group platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data as described in Section 9.

If you have any questions or concerns, or wish to exercise your privacy rights regarding personal data held by A66 Group, please contact us through the following channels:

• Privacy Email: support@a66group.best – use the subject line "Privacy Enquiry" or "Privacy Rights Request" so your message can be processed more quickly;
• Live Chat: Click the chat icon at the bottom right of the A66 Group platform — available 24 hours a day, 7 days a week in Bahasa Malaysia;
• WhatsApp Business: The official A66 Group number listed on the platform – our team will respond within 30 minutes during peak hours and within 2 hours at all other times.

A66 Group takes every privacy enquiry and complaint seriously. We are committed to providing an initial response to all privacy enquiries within 5 business days and resolving them within 30 days. If you are not satisfied with our response, you have the right to refer your complaint to the relevant data protection enforcement authority in Malaysia.