Privacy Policy

01 Introduction

This Privacy Policy ("Policy") is issued by a666 ("a666", "we", "us", or "our"), the operator of the online gambling and sports betting platform accessible at https://a666.casa (the "Platform").

This Policy describes how a666 collects, uses, stores, discloses, and protects personal data that you ("Player", "User", or "you") provide to us — or that we collect about you — when you access or use the Platform, including when you register an account, make a deposit or withdrawal, claim a bonus, or contact our support team.

a666 is committed to protecting your privacy and processing your personal data in a transparent, fair, and lawful manner. This Policy is intended to give you a clear understanding of your rights and our obligations so that you can make an informed decision about using the Platform.

By accessing or using the a666 Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must discontinue use of the Platform. This Policy should be read in conjunction with our Terms & Conditions.

02 Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Account" — a registered user account on the a666 Platform.
• "Cookie" — a small data file stored on your device by your web browser at the instruction of the Platform.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For this Platform, a666 acts as Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, under contractual instruction.
• "KYC" — Know Your Customer; the identity verification process required before full account functionality is enabled.
• "Personal Data" — any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Platform" — the a666 website, mobile site, and all associated services at https://a666.casa.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "You", "Player", "User" — any individual who accesses, registers on, or uses the Platform.

03 Personal Data We Collect

a666 collects only the personal data that is necessary for the purposes described in this Policy. The categories of data we may collect include:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (for age verification — players must be 21 or above);
• Email address;
• Residential address;
• Phone number (where voluntarily provided).

3.2 Identification & KYC Documents

• Copy of government-issued photo ID (e.g., Malaysian MyKad, passport);
• Proof of address documents (e.g., utility bill, bank statement);
• Payment method verification documents where required.

3.3 Financial & Transaction Data

• Deposit and withdrawal history;
• Payment method details (e.g., eWallet account reference, bank account name — we do not store full card numbers or CVV codes);
• Transaction amounts, timestamps, and reference identifiers.

3.4 Account Activity Data

• Betting history, game preferences, and wagering patterns;
• Bonus claims, promotion interactions, and loyalty programme activity;
• Support correspondence and live chat transcripts.

3.5 Technical & Usage Data

• IP address and approximate geolocation (country/city level only);
• Device type, operating system, and browser type;
• Session duration, page views, and navigation patterns;
• Log files and error reports generated during Platform use.

04 How Personal Data Is Collected

We collect personal data through the following means:

Collection Method	Examples
Direct submission by you	Account registration form, KYC document upload, contact form, live chat messages
Automated technical collection	Cookies, server logs, session tracking, device fingerprinting for fraud detection
Payment processing partners	Transaction confirmation data from DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank
Third-party identity verification	KYC verification services that cross-reference submitted documents against official databases
Fraud and security screening	Risk scoring services that analyse transaction patterns against known fraud indicators

05 Purposes of Data Processing

a666 processes your personal data for the following specific purposes:

1. Account Management: To create, operate, and maintain your player account, including identity verification and authentication.
2. KYC Compliance: To verify your identity and age (21+) as required for responsible gambling compliance and anti-money laundering (AML) obligations.
3. Transaction Processing: To process deposits and withdrawals via supported Malaysian payment methods, including DuitNow, FPX, eWallets, and bank transfers.
4. Responsible Gambling: To monitor betting patterns, apply player-requested limits, and identify indicators of problem gambling behaviour that may require intervention.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, money laundering, and bonus abuse.
6. Customer Support: To respond to enquiries, resolve complaints, and maintain correspondence records.
7. Legal and Regulatory Compliance: To meet our obligations under applicable laws and regulations, including record-keeping requirements for financial transactions.
8. Platform Improvement: To analyse usage patterns and technical performance data to improve the Platform's functionality, user experience, and reliability.
9. Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have not opted out. You may unsubscribe from marketing communications at any time via your account settings or by contacting support.

06 Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

• Contract Performance: Processing necessary to provide the services described in our Terms & Conditions, including account operation and payment processing.
• Legal Obligation: Processing required to comply with applicable laws, including KYC verification, AML screening, and transaction record-keeping.
• Legitimate Interests: Processing necessary for our legitimate business interests — including fraud prevention, platform security, and service improvement — where those interests are not overridden by your privacy rights.
• Consent: Where we rely on consent — for example, for non-essential marketing communications — you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

07 Data Sharing & Disclosure

a666 does not sell, rent, or trade your personal data to third parties. We share data only in the following limited and controlled circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf under binding data processing agreements. These include:

• Payment processing partners (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB);
• KYC and identity verification service providers;
• Fraud detection and risk management platforms;
• Customer support software providers;
• Analytics and platform performance monitoring tools.

All service providers are contractually required to process data only for the specified purpose, maintain appropriate technical security measures, and not use your data for their own commercial purposes.

7.2 Legal and Regulatory Disclosure

We may disclose personal data where required by law, court order, or regulatory authority — including in response to lawful requests from law enforcement agencies, financial regulators, or other competent public authorities. We will disclose only the minimum data necessary to satisfy each specific legal obligation.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving a666, personal data held by us may be transferred to the successor entity. You will be notified of any such transfer via the Platform or by email before your data is transferred to and becomes subject to a different privacy policy.

08 Data Retention

a666 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 5 years post-closure	Legal / AML obligation
KYC documents	Duration of account + 5 years post-closure	Legal / AML obligation
Transaction records	7 years from transaction date	Financial record-keeping obligation
Support communications	3 years from last interaction	Legitimate interest (dispute resolution)
Marketing preferences	Until opt-out or account closure	Consent
Technical / session logs	Up to 12 months	Legitimate interest (security)

Where data is retained beyond account closure solely to meet legal obligations, it will be stored securely with access restricted to authorised personnel only.

09 Data Security

a666 implements a multi-layered approach to data security, including:

• Transport Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (256-bit).
• At-Rest Encryption: Sensitive stored data — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorised personnel who require it to perform their job functions, on a strict need-to-know basis.
• Fraud Monitoring: Our security team monitors access logs and transaction patterns 24/7 for indicators of unauthorised access or suspicious activity.
• Regular Security Reviews: Our technical infrastructure undergoes regular internal security reviews to identify and remediate vulnerabilities.

10 Cookies & Tracking Technologies

a666 uses cookies and similar technologies on the Platform. Cookies are small text files stored on your device that allow us to recognise returning visitors, maintain your session state, and analyse Platform usage.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function — including session management, authentication, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences (such as language settings and display options) to improve your experience.
• Analytics Cookies: Collect anonymised data about how players navigate the Platform to help us identify areas for improvement.
• Fraud Prevention Cookies: Used by our security systems to detect and prevent fraudulent account activity and unauthorised access attempts.

10.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies via the browser's privacy or settings menu. Please note that disabling cookies may affect the functionality of the Platform — for example, you may be required to log in again on each visit.

11 International Data Transfers

In the course of operating the Platform, personal data may be transferred to or accessed from locations outside Malaysia — for example, where our technology infrastructure or service providers are based in other jurisdictions. Where such transfers occur, a666 implements appropriate safeguards to ensure that your personal data receives a level of protection consistent with this Policy.

Such safeguards may include contractual data transfer agreements with service providers, requiring them to comply with data protection standards equivalent to those applied within Malaysia.

12 Your Data Rights

Subject to applicable law and our legitimate interests in maintaining accurate records and meeting legal obligations, you have the following rights in respect of your personal data:

1. Right of Access: You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format where technically feasible.
2. Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. Where data accuracy affects account functionality, correction will be prioritised.
3. Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful. Note that certain data must be retained to meet legal obligations and cannot be erased on request alone.
4. Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data held.
5. Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on our legitimate interests, where your interests or rights override ours.
6. Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request that your data be provided in a portable format or transferred directly to another service where technically feasible.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, contact our support team via Live Chat or email. We will acknowledge your request within 5 business days and aim to fulfil it within 14 business days. We may need to verify your identity before processing your request.

13 Minors

The a666 Platform is strictly restricted to persons aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. If you believe that a minor has accessed the Platform and provided personal data, please contact us immediately so that the account can be reviewed and the data deleted as appropriate.

a666 uses identity verification and KYC processes to enforce this age restriction. Any account found to belong to a person under the age of 21 will be immediately suspended, and all funds will be handled in accordance with our Terms & Conditions.

14 Policy Amendments

a666 reserves the right to update or amend this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this document. Where changes are material — meaning they affect your rights or how we use your data in a significant way — we will notify registered players by on-platform notice or email prior to the changes taking effect.

Your continued use of the Platform following the posting of any amended Privacy Policy constitutes your acknowledgment of, and agreement to, the updated terms. If you do not agree with any amendment, you must discontinue use of the Platform and may request closure of your account.

15 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the a666 Data Privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week on the Platform. Average response time: 3–5 minutes.
• Email: [email protected] — email responses within 4 hours.

Support is available in English, Bahasa Melayu, and Mandarin Chinese. Please include "Privacy Request" in the subject line of your email so that it is directed to the appropriate team member.