Data Protection Document

Privacy Policy 66aa — Malaysia User Data Protection

Your privacy is not just a priority — it is our responsibility. Find out exactly how 66aa collects, stores, protects, and uses your personal information.

Updated: January 2026
Our Privacy Commitment
256-bit SSL encryption for all data.
Data is not sold to third parties
Full rights to access and delete your data belong entirely to you
Servers protected with industry-grade security.
Full compliance with Malaysia's PDPA.

The Six Pillars of 66aa Data Protection

The 66aa Privacy Policy is built on six solid principles that ensure your personal data remains secure, controlled, and respected at all times.

🔐
End-to-End Encryption

All data transmitted between your device and 66aa servers is protected by 256-bit SSL encryption. No sensitive information can be read by any third party while in transit.

🚫
No Data Sales

66aa has never and will never sell, rent, or trade your personal information to any third party for marketing or commercial purposes without your consent.

👤
Full User Control

You have the full right to access, correct, transfer, or request deletion of your personal data at any time through our 24/7 support channels.

🏛️
Malaysia PDPA Compliance

The entire 66aa privacy policy and data handling practices are designed to fully comply with Malaysia's Personal Data Protection Act (PDPA) 2010, without any exceptions.

🗄️
Secure Data Storage

Your data is stored in certified data centres with strict physical and digital access controls. Multi-layered backup systems ensure your data is never lost due to technical failure.

🔍
Full Transparency

We clearly disclose the types of data collected, the reasons it is collected, how it is used, and how long it is retained. There is no hidden agenda in the way 66aa handles your data.


This Privacy Policy describes the personal data handling practices of 66aa. By using our platform, you agree to the terms stated herein. This policy should be read together with Terms and Conditions us.

1 Introduction

66aa understands that your trust is the foundation of our relationship. When you register and use 66aa services, you entrust us with your personal information — and we take this responsibility very seriously.

This Privacy Policy is written in plain language because we believe every user deserves to know exactly what happens to their data. We hide nothing behind complex legal language. If you have any questions after reading this document, our support team is always ready to help.

This document explains what data we collect when you register, make a deposit, play, or simply browse the 66aa platform, how that data is used, who it may be shared with under certain circumstances, and the rights you hold as the owner of your own data.

2 Personal Data We Collect

66aa collects your personal data through various means — directly when you fill in information, automatically when you use the platform, and in some cases, through trusted third parties such as payment processors.

Data You Provide Directly

  • Registration information: Full name, phone number, email address, date of birth, and password.
  • Identity verification (KYC) information: Copy of MyKad or passport, proof of address, and bank statement.
  • Payment information: Bank account number, eWallet phone number (for transaction purposes only).
  • Communications: Messages you send to our support team via live chat or email.

Data Collected Automatically

  • Technical data: IP address, browser type, operating system, and screen resolution
  • Activity data: Pages visited, games played, session duration, and navigation patterns
  • Device data: Unique device identifier when accessing via mobile app.
  • Location data: Approximate location based on IP address for geo-compliance purposes
We do not store credit or debit card information directly. All payments are processed through PCI-DSS certified payment gateways that handle such sensitive information without it passing through 66aa's servers.

Below is a summary of the data types, purposes of collection, and relevant legal bases:

Data Type Primary Purpose Legal Basis
Identity Information Account registration, age verification, KYC. Legal Compliance
Contact Information Service communications, account notifications Contract Performance
Transaction Data Deposit processing, withdrawals, financial records. Contract Performance + Legal
Technical Data Security, fraud detection, platform improvements Legitimate interest
Usage Data Experience personalization and game recommendations. Legitimate interest + consent
Marketing Data Promotional offers and relevant bonuses. Explicit consent

3 How We Use Your Data

Every use of your personal data by 66aa has a clear and lawful purpose. We do not use your data for any purpose other than those stated below, unless you provide additional consent.

  • Account Management: Creating and maintaining your account, processing registration and login securely.
  • Transaction Processing: Processing deposits, withdrawals, bonuses, and all financial transactions on the platform.
  • Identity Verification: Carrying out KYC procedures and age verification as required by law
  • Fraud Prevention: Detecting and blocking suspicious activity, money laundering, and multi-account abuse.
  • Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance
  • Platform Improvements: Analyzing usage patterns to improve design, speed, and user experience.
  • Marketing communications: Sending promotional offers, exclusive bonuses, and the latest updates — only if you have given your consent.
  • Legal Compliance: Fulfilling reporting obligations and responding to requests from lawful authorities.

4 Data Sharing and Disclosure

66aa does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, there are limited situations where your data may be shared with other parties for legitimate reasons:

Trusted Service Providers

We work with a number of third-party service providers that help operate the platform, including payment processors (DuitNow, FPX, eWallet), server hosting providers, customer service platforms, and identity verification service providers. All such providers are bound by strict confidentiality agreements and are only permitted to use your data for the specific purposes defined.

Legal Obligation

66aa may be required to disclose certain information to government authorities, regulatory bodies, or courts when required by applicable Malaysian law, including financial crime investigations or valid legal proceedings.

Protection of Rights and Safety

In situations where there is a serious threat to the safety of other users or the integrity of the platform, 66aa reserves the right to share the necessary information to prevent such harm.

66aa has never and will never share your data with marketing companies, data brokers, or any party that would use it to send you third-party advertisements.

5 Cookies and Tracking Technologies

The 66aa platform uses cookies and similar technologies to enhance your experience, ensure login session security, and understand how users interact with our platform.

Types of Cookies Used

  • Essential cookies: Required for the platform to function properly — including login verification and session security. These cookies cannot be disabled.
  • Performance cookies: Collecting anonymized data on how users interact with the platform to help us improve functionality and speed.
  • Functional cookies: Saving your preferences such as language and display settings for future sessions.
  • Analytics cookies: Helps us understand which pages are visited most often and where users encounter issues.

You can manage cookie settings through your browser at any time. However, disabling essential cookies may affect the platform's login functionality and security.

6 Data Security

Protecting your data is a core technical priority at 66aa. We continuously invest in security infrastructure to ensure your information remains safe from unauthorised access, breaches, or misuse.

  • Transit Encryption: All communications between you and the 66aa platform are secured by TLS 1.3 with 256-bit SSL encryption.
  • Storage Encryption: Sensitive data is stored in encrypted form using the AES-256 algorithm
  • Access controls: Only authorised staff with a legitimate business need may access user data, and all access is logged
  • Security Auditing: The 66aa system undergoes regular penetration testing and security audits by independent experts.
  • 24/7 Monitoring: Our security team continuously monitors the system to detect any unusual activity.
  • Two-Factor Authentication: Supported for all user accounts as an additional layer of protection
While no system can guarantee 100% absolute security, 66aa implements industry-leading security standards and continually works to reduce risk to the lowest achievable level.

7 Data Retention Period

66aa does not retain your personal data longer than necessary for the purpose it was collected, or longer than required by applicable law.

  • Active account data: Retained for as long as your account remains active on the platform
  • Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's financial regulatory requirements
  • KYC Documents: Retained for 5 years after account closure or the date of the last transaction
  • Support communication logs: Retained for 2 years for reference and dispute resolution purposes
  • Technical log data: Retained for 90 days then automatically deleted
  • Marketing data: Deleted immediately upon withdrawal of your consent

Once the retention period expires, your data will be securely deleted or converted into an anonymised format that cannot be linked back to you.

8 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act (PDPA), you have the following rights regarding your personal data held by 66aa:

Right of Access

You may request a copy of all personal data we hold about you at any time. Such requests will be fulfilled within 21 working days.

Right to Rectification

If the data we hold is inaccurate or out of date, you may request a correction by contacting our support team with the relevant supporting evidence.

Right to Erasure

You may request the deletion of your personal data, subject to legal requirements that oblige us to retain certain records for a specified period.

Right to Restrict Processing

In certain circumstances, you may request that we restrict how we process your data while a dispute or review is in progress.

Right to Data Portability

You may request a copy of your data in a machine-readable format (JSON or CSV) for transfer to another service of your choice.

Right to Object

You may object to the processing of your data for direct marketing purposes at any time. We will immediately stop using your data for that purpose.

To submit any request regarding your data rights, contact us at [email protected] stating your request type and account details. We will respond within 3 business days.

9 Children's Data

The 66aa platform is an online gaming service that for individuals aged 18 and above only. We do not intentionally collect, process or store personal data from minors.

If we suspect that data from a person under the age of 18 has been collected unintentionally, the account in question will be suspended immediately and all related data will be deleted within 72 hours of verification.

If you are a parent or guardian who believes your child has registered on our platform, please contact our support team immediately at [email protected] and we will take action without delay.

10 Amendments to the Privacy Policy

66aa reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements. Each new version will carry a clear update date at the top of this page.

For significant amendments — particularly those affecting how your data is used or shared — we will notify you via an in-platform notification or your registered email at least 14 days before the changes take effect. Continued use of the platform after that date constitutes your acceptance of the updated policy.

We recommend you bookmark this page and review it once every few months. Any material changes will be announced prominently at the top of this page.

11 Contact Us About Privacy

If you have any questions, concerns, or complaints regarding how 66aa handles your personal data, we encourage you to contact us directly through the following channels:

  • Privacy email: [email protected] — include "Privacy Inquiry" in the email subject line
  • 24/7 Live Chat: Directly within the platform — for immediate enquiries.
  • Response time: We are committed to responding to all privacy-related enquiries within 48 business hours

If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) or the relevant regulatory authority in your country.


66aa Privacy Policy FAQ

Answers to the most frequently asked questions about data protection and user privacy on the 66aa platform.

Not at all. 66aa never sells, rents, or trades users' personal data to any third party for marketing or commercial purposes. Your data is only shared with service providers directly involved in operating our platform, and they are bound by strict confidentiality agreements.

You may submit a data access request by contacting the 66aa support team via email at [email protected] with the subject line "Data Access Request". Include your full name and account number to expedite the process. We will respond within 21 working days with a complete copy of your data in an easily readable format.

No. 66aa does not store credit or debit card numbers directly on our servers. All payments are processed through PCI-DSS certified payment gateways such as DuitNow and FPX. We only retain bank account numbers for withdrawal purposes, and this information is encrypted using AES-256.

Yes, you may request deletion of your data. However, certain data is required by Malaysian law to be retained — such as financial transaction records for 7 years and KYC documents for 5 years after account closure. Beyond those legal obligations, we will delete or anonymise your data within 30 days of receiving your request.

66aa implements multiple layers of account protection: password encryption using bcrypt, two-factor authentication (2FA), unusual login monitoring, instant notifications for suspicious activity, and automatic lockout after several failed login attempts. We also conduct regular security audits to detect and address any system vulnerabilities.

When you close your account, personal data not subject to legal retention obligations will be deleted or anonymised within 30 days. Financial transaction records and KYC documents will be retained for the period required by law, then securely deleted thereafter. You may request a report on data still held after account closure.

Play Safely and Confidently on the 66aa Platform

Your data is protected, your identity is secure, and your experience is guaranteed. Register a free account and enjoy the best games alongside over 200,000 active members in Malaysia.

Your data is protected by PDPA 256-bit SSL Encrypted No data sales Full control is yours

Bahasa Melayu