ar66 Privacy Policy – How We Protect Your Personal Data

1. Data Controller

ar66 (referred to in this Privacy Policy as "ar66", "we", "us", or "our") is the data controller responsible for the personal information collected through the ar66 Platform at ar66.win and all associated services.

For the purposes of applicable data protection legislation, ar66's operating entity, registered under its international gaming authority licence, determines the means and purposes of processing personal data submitted by Members and visitors to the ar66 Platform.

If you have any questions or requests regarding this Privacy Policy or the handling of your personal data, please contact ar66's Data Protection team using the contact details set out in Section 14 of this document.

2. Personal Data We Collect

ar66 collects the following categories of personal data from Members and Platform visitors:

• Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification number (Malaysian IC number, passport number, or equivalent).
• Contact Data: Email address, mobile phone number, and residential address (including city, state, and postcode within Malaysia or internationally).
• Financial Data: Payment method details necessary to process deposits and withdrawals, including e-wallet identifiers (Touch 'n Go eWallet, Boost), bank account details (Maybank, CIMB, Public Bank), and cryptocurrency wallet addresses where applicable. Full payment card numbers are not stored by ar66.
• Account Data: Username, encrypted password, account preferences, game history, transaction history, bonus balances, wagering records, and session logs.
• Technical Data: IP address, browser type and version, operating system, device identifiers, referring URLs, and platform interaction data collected via cookies and similar technologies.
• Communications Data: Records of your interactions with ar66 support, including live chat transcripts, email correspondence, and any feedback or complaints submitted.
• Responsible Gaming Data: Deposit limits, loss limits, self-exclusion elections, and any vulnerability disclosures made in connection with ar66's responsible gaming programme.

3. How We Collect Personal Data

ar66 collects personal data through the following channels:

• Direct submission: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically as you browse and interact with the ar66 Platform, including via cookies, web beacons, and server logs.
• Third-party sources: Identity and address verification data obtained from licensed KYC and anti-money laundering (AML) verification providers to confirm the accuracy of information you have provided. ar66 may also receive data from payment processors to confirm transaction completion.

4. How We Use Your Personal Data

ar66 uses personal data for the following purposes:

• To register and maintain your Member Account and verify your identity in accordance with KYC and AML obligations;
• To process deposits, withdrawals, and other financial transactions on the ar66 Platform;
• To provide and operate the ar66 gaming and sportsbook services you have requested;
• To manage and administer bonus and promotional offers, including verifying eligibility and tracking wagering requirement progress;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activity in accordance with our Terms & Conditions;
• To communicate with you regarding your Account, transactions, security alerts, and policy updates;
• To send marketing communications where you have provided consent or where we have a legitimate interest in doing so, with opt-out available at any time;
• To operate our responsible gaming programme, including monitoring for indicators of problem gambling and administering self-exclusion requests;
• To comply with legal and regulatory obligations imposed by ar66's gaming licence and applicable laws;
• To improve and personalise the ar66 Platform experience through analysis of usage data.

5. Legal Basis for Processing

ar66 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between ar66 and the Member, including Account management, game provision, and transaction processing.
• Legal obligation: Processing required to comply with KYC, AML, and other regulatory obligations under ar66's gaming licence and applicable law.
• Legitimate interests: Processing for fraud prevention, platform security, service improvement, and responsible gaming monitoring, where our interests are not overridden by your data protection rights.
• Consent: Marketing communications and non-essential cookies, where your explicit consent has been obtained. Consent may be withdrawn at any time without affecting prior processing.

6. Data Sharing & Third Parties

ar66 does not sell your personal data to third parties. We share personal data only in the following limited circumstances:

• Service providers: Licensed third-party suppliers engaged by ar66 to provide KYC verification, payment processing, fraud detection, IT infrastructure, customer support tools, and marketing platforms. Such providers are contractually bound to process data only on ar66's instructions and to appropriate data protection standards.
• Gaming providers: Game content providers (e.g., Pragmatic Play, PG Soft, Evolution) may receive limited technical data necessary to deliver their games through the ar66 Platform. Game providers are not permitted to use this data for independent marketing purposes.
• Regulatory and law enforcement authorities: Where required by ar66's gaming licence, court order, or applicable law, ar66 will disclose personal data to competent authorities. ar66 will notify the affected Member of any such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of ar66's business assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7. Cookies & Tracking Technologies

ar66 uses cookies and similar technologies on the Platform to:

• Maintain your logged-in session and remember your preferences;
• Analyse Platform traffic and usage patterns to improve performance;
• Detect and prevent fraudulent activity;
• Deliver relevant promotional content where consent has been provided.

Essential cookies (those necessary for the Platform to function) are placed without requiring consent. Non-essential cookies (analytics, preferences, marketing) are only placed where you have provided consent via ar66's cookie consent mechanism.

You may withdraw cookie consent or manage your cookie preferences through your browser settings at any time. Disabling essential cookies may affect Platform functionality, including your ability to remain logged in to your ar66 Account.

8. Data Retention

ar66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of your Account relationship with ar66 and for such additional periods as are required by applicable law and our gaming licence obligations.

Specifically:

• Account and transaction records are retained for a minimum of five (5) years following Account closure, in accordance with AML regulatory requirements;
• Communication records are retained for three (3) years;
• Marketing consent records are retained until consent is withdrawn and for a reasonable period thereafter as evidence of prior consent;
• Technical logs are retained for up to twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

9. Security Measures

ar66 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ar66's servers;
• Encrypted storage of passwords using industry-standard hashing algorithms; passwords are never stored in plain text;
• Two-step verification (2SV) available to all Members as an additional account security layer;
• Restricted internal access to personal data on a need-to-know basis, with role-based access controls;
• Regular security assessments, penetration testing, and vulnerability scanning of the ar66 Platform.

Whilst ar66 takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is completely secure. Members are encouraged to use strong, unique passwords and to enable two-step verification on their ar66 Account.

10. Your Data Protection Rights

Subject to applicable law and certain legal exceptions, you have the following rights in relation to your personal data held by ar66:

• Right of access: To request a copy of the personal data ar66 holds about you;
• Right of rectification: To request correction of inaccurate or incomplete personal data;
• Right of erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ar66's legal retention obligations;
• Right to restrict processing: To request that ar66 limit the processing of your data in certain circumstances;
• Right to data portability: To receive your personal data in a structured, machine-readable format where processing is based on consent or contract;
• Right to object: To object to processing based on legitimate interests, including direct marketing communications.

To exercise any of the above rights, please contact ar66's Data Protection team at the details in Section 14. ar66 will respond to all verified requests within thirty (30) calendar days. Where a request is complex or numerous, we may extend this period by a further thirty (30) days with prior notification.

11. Children's Privacy – 21+ Requirement

The ar66 Platform is strictly intended for adults aged 21 years and above. ar66 does not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not register an Account, access the Platform, or submit any personal information to ar66.

If ar66 becomes aware that personal data has been collected from an individual under the age of 21, such data will be deleted promptly and the associated Account suspended in accordance with ar66's Terms & Conditions. If you believe a person under 21 has submitted data to ar66, please contact support immediately.

12. International Data Transfers

ar66 may transfer personal data to servers and service providers located outside Malaysia in connection with the provision of the Platform's services. Where such transfers occur, ar66 takes appropriate steps to ensure that your personal data receives a level of protection consistent with this Privacy Policy and applicable data protection standards.

Such steps may include entering into data processing agreements with standard contractual clauses, or relying on the recipient country's adequacy determination where applicable. By using the ar66 Platform, you acknowledge that your personal data may be transferred and processed in jurisdictions other than Malaysia.

13. Amendments to This Policy

ar66 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Members via email to the address on file, or via a prominent notice on the ar66 Platform, prior to the change taking effect.

The effective date at the top of this document reflects the most current version. We encourage Members to review this Privacy Policy periodically. Continued use of the ar66 Platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms.

14. Contact & Data Protection Enquiries

For any questions, requests, or complaints regarding this Privacy Policy or ar66's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly through the ar66 Platform
• Email: [email protected]

ar66 aims to acknowledge all data protection enquiries within two (2) business days. Substantive requests will be addressed within thirty (30) calendar days of identity verification. If you are not satisfied with ar66's response to a data protection complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction.