Privacy Policy AR666 – Malaysia Personal Data Protection

AR666 is an online betting platform built to serve Malaysian players. As a platform that handles members' financial and personal information, AR666 understands that the responsibility to protect that data is a significant trust. This Privacy Policy was written not merely to satisfy legal requirements — but because we genuinely believe every AR666 member deserves to know exactly what happens to their personal information, from the moment they register to the moment they decide to leave our platform.

This AR666 Privacy Policy is prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, the principal legislation governing the collection, use and disclosure of individuals' personal data in Malaysia. AR666 acts as a "data processor" as defined under the PDPA and adheres to the seven data protection principles set out in the Act — namely the General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle, and Access Principle.

We also keep abreast of evolving international data protection standards and continually strive to align our practices with industry best-practice guidelines, even where they exceed the minimum requirements under Malaysian law. This is how AR666 demonstrates that the trust of our members is a business value we take seriously.

AR666 collects various types of personal data depending on how you interact with our platform. Below is a summary of the data categories we collect:

AR666 never collect sensitive data such as biometric data, medical records, religious beliefs, or political affiliations. We also do not collect credit or debit card numbers directly — all financial transactions are handled by registered third-party payment providers that comply with PCI DSS standards.

AR666 collects your personal data through several different channels:

• During account registration: You provide your identity and contact information directly when completing the registration form.
• During the KYC (Know Your Customer) process: When you are required to verify your identity prior to processing certain withdrawals, you may be asked to upload a copy of your MyKad or other supporting documents.
• When making a deposit or withdrawal: Payment method information is collected when you conduct financial transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX.
• While using the platform: Activity data such as betting records, games played, and session durations are collected automatically by AR666's systems.
• Through cookies and similar technologies: Technical data is collected automatically when you access the AR666 website or app (see Section 9 for further details).
• Through communications with the support team: When you contact AR666 via live chat, email or WhatsApp, records of those communications are retained for quality assurance and issue resolution purposes.
• From third-party sources: In certain cases involving identity verification or fraud prevention, AR666 may receive information from authorised third-party verification service providers.

AR666 only uses your personal data for legitimate and reasonable purposes as described below. We do not use your data for any other purpose without first informing you and obtaining your consent where required:

• Account management: Registering, verifying, maintaining, and managing your AR666 account.
• Transaction processing: Processing financial deposits and withdrawals via your chosen Malaysian payment method.
• Service delivery: Grants access to all AR666 betting products – sports, casino, poker, and more – according to your VIP tier and eligibility.
• Security and fraud prevention: Detect and prevent fraudulent activity, money laundering, multi-account abuse, and other security threats.
• Legal compliance: Meeting compliance obligations under Malaysia's PDPA, anti-money laundering laws, and directives from competent authorities.
• Customer support: Providing assistance, resolving complaints, and ensuring a satisfactory user experience.
• VIP Rewards Program: Calculating and managing your VIP points, daily rebates, and related rewards based on your gaming activity.
• Marketing communications: Sending promotional information, bonuses, and relevant offers – only if you have given consent to receive such communications and have not since withdrawn that consent.
• Analytics and improvement: Analysing aggregated platform usage patterns to improve AR666's products, features and overall user experience.

Every use of your data is underpinned by a valid legal basis under the PDPA — whether that is your explicit consent, the necessity to perform our service contract with you, a legal obligation binding on AR666, or AR666's legitimate interests that do not override your fundamental rights.

AR666 never sells, rents or trades members' personal data to any third party for their own marketing purposes. This is a foundational principle we do not compromise on. However, there are limited circumstances in which AR666 needs to share your data with the following parties:

• Payment service providers: Required transaction information is shared with Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX providers solely for the purpose of processing your deposits and withdrawals. All such providers are bound by strict confidentiality agreements.
• Identity verification service providers: During the KYC process, identity information may be shared with approved registered verification providers to authenticate your documents.
• Game providers: Some game data may be shared with third-party game providers that supply slots, Live Casino, or poker to the AR666 platform, strictly for the technical management of those games.
• Legal authorities: AR666 will disclose the required data to the police, courts, anti-corruption commission, or other Malaysian regulatory bodies when mandated by law or a valid court order.
• Parties involved in corporate restructuring: In the event that AR666 is involved in a merger, acquisition, or asset sale, member data may be transferred to the relevant entity as part of that transaction, provided the recipient adheres to equivalent privacy standards.

AR666 continually invests in security infrastructure to ensure members' personal and financial data is protected to the highest practicable standard. The key security measures we employ include:

• 256-bit SSL/TLS Encryption: All communications between your device and AR666's servers are encrypted using 256-bit SSL/TLS protocol. This means that even if your data is intercepted in transit, it cannot be read by any unauthorised party.
• Data encryption at rest: Sensitive personal data and financial information stored in the ar666 database are encrypted using industry-standard encryption, not stored in plain text.
• Tiered access controls: Only AR666 staff with a legitimate business need are permitted to access members' personal data. Access is controlled through a multi-factor authentication system and is audited on a regular basis.
• 24/7 security monitoring: A threat monitoring system operates around the clock to detect and respond to suspicious activity, intrusion attempts, and security anomalies in real time.
• Environment segregation: Production data (actual member data) is kept entirely separate from development and testing environments. No real personal data is used in non-production environments.
• Regular security assessments: AR666 undergoes penetration testing and security audits conducted by independent parties on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident response plan: AR666 has a comprehensive security incident response plan in place. In the event of a data breach affecting members, AR666 is committed to notifying impacted members and the relevant authorities within the timeframes required under Malaysian law.

While AR666 takes all reasonable measures, no security system is 100% impenetrable. You also play an important role in protecting your account — keep your password confidential, avoid accessing your AR666 account over public Wi-Fi without a VPN, and contact us immediately if you suspect any unauthorised access.

AR666 does not retain your personal data longer than necessary to fulfil the original purpose of collection or to meet applicable legal requirements. The following is a general guide to our retention periods:

• Active account data: For as long as your account remains active with AR666, we retain all data necessary to manage your account and deliver our services to you.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date, in compliance with financial record-keeping requirements under Malaysian law, including the Companies Act and anti-money laundering regulations.
• KYC and identity verification records: Retained for a minimum of 6 years after account closure, in accordance with Malaysia's anti-money laundering legal requirements.
• Customer support communication data: Retained for 3 years for quality control and dispute resolution purposes.
• Marketing data: Retained until you withdraw your marketing communications consent or close your account.
• Technical and log data: System logs are typically retained for 12 months for security and technical troubleshooting purposes.

Once the retention period has expired and there is no legal requirement to retain the data further, AR666 will securely delete or anonymise your data. Anonymised data (which can no longer be linked to you as an individual) may be retained for analytics and service improvement purposes.

If you close your AR666 account, the deletion of data not required for legal compliance purposes will be initiated within 30 days of the account closure date.

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by AR666. We respect these rights and will process all valid requests within a reasonable timeframe:

AR666 uses cookies and similar tracking technologies to deliver a better user experience, analyse platform performance, and maintain session security. The following are the types of cookies we use:

• Strictly Necessary Cookies: Required for core platform functions such as login authentication, session security, and saving your own cookie preferences. These cookies cannot be disabled without seriously affecting platform functionality.
• Performance Cookies: Collects aggregated data on how visitors use the AR666 platform – including the most frequently visited pages, time spent, and navigation paths. This data is used to improve the platform's design and performance. All data is aggregated and not linked to any individual.
• Functionality Cookies: Remembers your preferences such as language, display settings, and game preferences to deliver a more personalised experience in future sessions.
• Analytics cookies: AR666 uses analytics tools to understand platform usage patterns for service improvement purposes. This data is not sold to third parties.

You can manage or disable cookies through your web browser settings at any time. However, disabling essential cookies may affect your ability to log in or use certain features of the AR666 platform. AR666 respects "Do Not Track" signals sent by your web browser where technically feasible.

The AR666 platform is strictly restricted to individuals who are 18 years of age or older. AR666 does not knowingly collect or process personal data from children or minors. The protection of minors is an absolute priority for AR666 and forms part of our commitment to responsible gambling.

AR666 uses an automated age verification system during registration and reserves the right to request additional proof of age at any time. Should AR666 discover that personal data of an underage individual has been collected without our knowledge, we will take the following steps immediately:

• Suspending the associated account immediately.
• Delete all personal data belonging to that individual from our systems.
• Returning all deposited funds to the original payment method.

Ar666 reserves the right to update or amend this Privacy Policy from time to time in line with changes in law, technology, or our business practices. Any updates will be published on this page with a revised "Last updated" date.

For amendments that materially affect how we handle your personal data, AR666 will provide clear notice at least 14 days before the changes take effect, via your registered email or an in-platform notification. This gives you sufficient time to review the changes and make an informed decision about whether you wish to continue using the platform.

Continued use of the AR666 platform after any amendment takes effect will be considered acceptance of the revised privacy terms. It is each member's responsibility to review this page periodically. If you do not agree with the changes, you have the right to close your account without penalty before the amendment's effective date.

If you have any questions, concerns, or requests regarding this Privacy Policy or how AR666 handles your personal data, please do not hesitate to reach out to us:

• Privacy email: support@ar666.best – Please mark the email subject as "Privacy Enquiry" to ensure it reaches the right team.
• Live Chat: Available 24/7 via the live chat icon within the AR666 platform.
• WhatsApp: Available via the WhatsApp button within your member account.

AR666 is committed to responding to all privacy enquiries within 5 business days. For formal requests such as data access, correction or deletion, processing may take up to 21 business days depending on the complexity of the request. We will keep you updated on the progress of your request if additional time is needed.

If you are dissatisfied with how AR666 handles your personal data or with our response to your complaint, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia under the Ministry of Communications and Digital.

This AR666 Privacy Policy is written in Bahasa Melayu as the official language in accordance with Malaysia's PDPA. In the event of any inconsistency between a translation of this document in another language and the Bahasa Melayu version, the Bahasa Melayu version shall prevail. This Policy is governed by the laws of Malaysia.