arr66 Privacy Policy

arr66 ("arr66," "we," "us," "our") operates the online gaming platform accessible at arr66.net (the "Platform") and associated mobile applications. arr66 is committed to protecting the privacy and personal data of all individuals who interact with the Platform, whether as registered Players or as visitors.

This Privacy Policy ("Policy") describes what personal data arr66 collects, the purposes for which it is processed, the legal bases relied upon, how it is stored and secured, the circumstances in which it may be shared with third parties, how long it is retained, and the rights you have in respect of your personal data.

This Policy applies to all personal data processed by arr66 in connection with the operation of the Platform and the delivery of gaming, betting, payment, support, and related services to Malaysian users and other eligible players.

arr66 collects the following categories of personal data from Players and Platform visitors:

2.1 Identity Data: Full legal name, date of birth, gender, nationality, and government-issued identification document details (such as Malaysian MyKad number or passport number) provided during account registration or identity verification.

2.2 Contact Data: Email address, mobile telephone number, and residential address (including city, state, and postcode within Malaysia).

2.3 Account Data: arr66 username, encrypted password credentials, account creation date, account status, and any communication preferences set by the Player.

2.4 Financial Data: Payment method details used for deposits and withdrawals — including Touch 'n Go eWallet identifiers, DuitNow account references, FPX transaction references, and bank account details associated with Malaysian banking platforms (Maybank, CIMB, Public Bank, Hong Leong Connect). arr66 does not store full payment card numbers.

2.5 Transaction Data: Details of all deposits, withdrawals, bonuses credited, wagering activity, game results, and account balance history associated with your arr66 Account.

2.6 Technical Data: IP address, device type, operating system, browser type and version, mobile device identifiers, and time zone settings collected automatically when you access the arr66 Platform.

2.7 Usage Data: Information about how you interact with the arr66 Platform, including pages visited, games played, session duration, bet frequency, and feature usage patterns.

2.8 Communications Data: Records of communications between you and arr66 customer support, including live chat transcripts, email correspondence, and any feedback or complaints submitted.

2.9 Verification Data: Copies of identity documents, selfie photographs, and proof of address documentation submitted during Know Your Customer (KYC) verification or enhanced due diligence procedures.

arr66 collects personal data through the following means:

• Direct collection: Data you voluntarily provide when registering an arr66 Account, completing identity verification, making a deposit or withdrawal, contacting customer support, or responding to a promotion.
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access the arr66 Platform.
• Third-party sources: Data received from payment processors, identity verification service providers, fraud detection services, and analytics partners engaged by arr66 — limited to data necessary for the purposes described in this Policy.
• Publicly available sources: In limited circumstances, data from publicly accessible registries or databases where necessary for compliance or fraud prevention purposes.

arr66 uses the personal data it collects for the following purposes:

• To create, manage, and maintain your arr66 Account;
• To verify your identity and age (21+) as required for responsible gaming compliance and regulatory obligations;
• To process deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, and other accepted Malaysian payment methods;
• To deliver the gaming, betting, and related Services you access through the arr66 Platform;
• To detect, prevent, and investigate fraudulent activity, money laundering, bonus abuse, and other prohibited conduct;
• To comply with applicable legal and regulatory obligations, including anti-money laundering (AML) and counter-terrorism financing (CTF) requirements;
• To provide customer support and respond to queries, complaints, and disputes;
• To send service-related communications, including account notifications, security alerts, and policy updates;
• To send promotional communications (where you have consented to receive them or where permitted under applicable law), including information about arr66 bonuses, new games, and platform updates;
• To analyse Platform usage patterns and improve the arr66 user experience;
• To enforce the arr66 Terms & Conditions and other applicable policies;
• To monitor compliance with responsible gaming commitments, including the application of deposit limits and self-exclusion measures.

arr66 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the arr66 Terms & Conditions — including account management, payment processing, and game delivery;
• Legal obligation: Processing required to comply with applicable laws and regulations, including identity verification, AML/CTF obligations, and age restriction enforcement;
• Legitimate interests: Processing for fraud prevention, platform security, product improvement, and responsible gaming monitoring, where such interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing communications and non-essential cookies, where your consent has been freely given and is capable of being withdrawn at any time.

arr66 does not sell your personal data to third parties. arr66 may share personal data in the following circumstances:

• Service providers: Third-party vendors engaged by arr66 to provide payment processing, identity verification, fraud detection, IT infrastructure, customer support tooling, and data analytics services — each subject to contractual data protection obligations;
• Game providers: Licensed game software providers whose titles are available on the arr66 Platform, where limited technical data is shared for game delivery and audit purposes;
• Regulatory and law enforcement bodies: Where arr66 is required by law, court order, or regulatory direction to disclose personal data;
• Responsible gaming organisations: In limited circumstances, where mandatory self-exclusion schemes or inter-operator exclusion programmes require the sharing of Player data for the purpose of enforcing self-exclusion;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the arr66 business, subject to appropriate confidentiality and data protection safeguards.

All third parties engaged by arr66 to process personal data on its behalf are required to process such data only in accordance with arr66's documented instructions and in compliance with applicable data protection law.

arr66 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Strictly necessary for Platform functionality, including session management, login state, and security. These cannot be disabled.
• Analytics cookies: Used to collect aggregated data about how visitors use the arr66 Platform, enabling us to identify areas for improvement. These are deployed only with your consent.
• Preference cookies: Used to remember your Platform settings and preferences across sessions.
• Marketing cookies: Used — where consent has been given — to measure the effectiveness of promotional activity and to personalise content relevant to you as an arr66 player.

You may control non-essential cookies through your browser settings or through any cookie consent mechanism provided on the arr66 Platform. Disabling certain cookies may affect the functionality of parts of the Platform.

arr66 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal or regulatory obligations. Specifically:

• Account data and transaction records are retained for a minimum of five (5) years from the date of account closure, in compliance with AML and financial record-keeping obligations;
• Identity verification documents are retained for a minimum period as required by applicable law from the conclusion of the relevant account relationship;
• Customer support communications are retained for up to three (3) years from the date of the relevant interaction;
• Marketing consent records are retained until consent is withdrawn, plus a reasonable period thereafter for compliance documentation purposes.

Upon expiry of the applicable retention period, arr66 will securely delete or anonymise personal data in accordance with its data destruction procedures.

arr66 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and arr66 servers;
• Encryption of sensitive data at rest, including payment method references and identity document data;
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need;
• Regular security assessments and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for internal system access by arr66 staff.

Notwithstanding these measures, no method of electronic data transmission or storage is entirely immune to risk. arr66 cannot guarantee the absolute security of data transmitted to or from the Platform. Players are encouraged to use strong, unique passwords for their arr66 Accounts and to enable two-factor authentication where available.

Subject to applicable law, you have the following rights in respect of your personal data held by arr66:

• Right of access: To request a copy of the personal data arr66 holds about you;
• Right of rectification: To request correction of inaccurate or incomplete personal data;
• Right of erasure: To request deletion of your personal data, subject to arr66's legal retention obligations;
• Right to restrict processing: To request that arr66 limit the processing of your personal data in certain circumstances;
• Right to data portability: To receive a copy of personal data you have provided to arr66 in a structured, commonly used, machine-readable format;
• Right to object: To object to the processing of your personal data where arr66 relies on legitimate interests as its legal basis;
• Right to withdraw consent: To withdraw consent to marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact arr66 via the live chat on the Platform or by emailing [email protected] (plain text address — not a clickable link). arr66 will respond to verified requests within a reasonable timeframe and in any event within the period required by applicable law.

The arr66 Platform is strictly intended for persons aged 21 years and above. arr66 does not knowingly collect personal data from individuals under the age of 21. If arr66 discovers that personal data has been collected from a minor, the relevant Account will be immediately closed, all associated data will be securely deleted to the extent permitted by applicable law, and any balance will be voided. If you have reason to believe that a minor has registered an arr66 Account, please contact the arr66 support team immediately.

The arr66 Platform integrates with third-party services including payment processors (such as Touch 'n Go eWallet and DuitNow), game software providers, and analytics platforms. When you interact with these integrated services, those third parties may process your data in accordance with their own privacy policies. arr66 is not responsible for the privacy practices of third-party services, though arr66 selects and contractually binds its service providers to appropriate data protection standards.

arr66 reserves the right to amend this Privacy Policy at any time. The most current version will always be published at arr66.net/privacy-policy with the effective date noted at the top of the document. Where material changes are made, arr66 will endeavour to notify registered Players via their registered email address. Continued use of the arr66 Platform following notification of an updated Policy constitutes acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by arr66, please contact us via:

• Live Chat: Available 24/7 on the arr66 Platform after login.
• Support Email: [email protected] (plain text — not a clickable link; please copy this address and email directly).

arr66 aims to acknowledge privacy-related queries within 48 hours and to resolve substantive requests within 30 calendar days, subject to complexity and the need to verify identity before disclosing or modifying personal data.