ar666 Privacy Policy

The data controller responsible for personal data collected through the ar666 platform is ar666, operating ar666.app. As the data controller, ar666 determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with applicable data protection laws.

For all privacy-related enquiries, including requests to exercise your data rights, please contact ar666's data protection team via the email address provided in Section 13 of this Policy.

ar666 collects personal data that is necessary to provide you with a secure, compliant, and personalised gaming experience. The categories of data we collect include:

ar666 does not collect or process sensitive personal data (such as health information, racial or ethnic origin, or religious beliefs) unless explicitly required by applicable law or volunteered by you in the context of a responsible gaming assessment.

ar666 collects personal data through the following channels:

1. Direct collection: Information you provide when registering an ar666 account, completing identity verification, contacting customer support, or submitting responsible gaming requests.
2. Automated collection: Technical and usage data collected automatically when you access the ar666 platform, including via cookies, web beacons, and server logs. This includes your IP address, device fingerprint, and browsing behaviour within the platform.
3. Third-party sources: Identity verification agencies used for KYC (Know Your Customer) and age verification; payment processors handling MYR transactions including local Malaysian banking partners and eWallet providers; and fraud prevention services that cross-reference data against known risk indicators.

ar666 processes your personal data only where a lawful basis exists. The primary purposes and their corresponding legal bases are as follows:

1. Contract performance: Processing necessary to create and manage your ar666 account, process deposits and withdrawals in MYR, and deliver gaming services you have requested.
2. Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, age verification obligations, and reporting duties imposed by applicable gaming and financial laws.
3. Legitimate interests: Fraud detection and prevention; platform security monitoring; responsible gaming controls; internal analytics to improve the ar666 platform; and resolving disputes and complaints.
4. Consent: Marketing communications, personalisation features, and non-essential cookies — where you have provided explicit, freely given consent. You may withdraw consent at any time by contacting ar666 support or adjusting your account preferences.

ar666 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data in the following limited circumstances:

1. Payment processors: Financial data is shared with authorised payment service providers (including Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, and DuitNow operators) solely for the purpose of processing your transactions.
2. Identity verification providers: Identity and document data is shared with licensed KYC and age verification agencies to fulfil our legal obligations.
3. Game providers: Certain gaming activity data may be shared with certified game studios (such as Evolution Gaming, Pragmatic Play) to facilitate game operation and dispute resolution.
4. Regulatory authorities: ar666 is required by law to disclose data to relevant regulatory, tax, or law enforcement authorities where mandated by a lawful order, court order, or statutory obligation.
5. Professional advisors: Legal advisors, auditors, and insurers may access limited personal data on a confidential, need-to-know basis.

All third parties with whom ar666 shares personal data are required to process that data in accordance with applicable data protection standards and are prohibited from using it for any purpose beyond what ar666 has authorised.

ar666 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. General retention principles are as follows:

1. Account and identity data is retained for a minimum of five (5) years following account closure, in compliance with applicable AML and gaming record-keeping requirements.
2. Transaction records and gaming history are retained for five (5) years from the date of the transaction or gaming session.
3. Customer support correspondence is retained for three (3) years from the date of the interaction.
4. Technical logs are typically retained for twelve (12) months, after which they are securely deleted or anonymised.

Upon expiry of the applicable retention period, ar666 will securely delete or irreversibly anonymise your personal data such that it can no longer be associated with you as an individual.

ar666 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

1. 256-bit SSL/TLS encryption for all data transmitted between your device and the ar666 servers — the same encryption standard used by major Malaysian financial institutions.
2. Encrypted storage of passwords and sensitive financial identifiers using industry-standard hashing algorithms.
3. Role-based access controls limiting ar666 staff access to personal data on a strict need-to-know basis.
4. Regular security audits and penetration testing conducted by independent cybersecurity professionals.
5. Multi-factor authentication options for ar666 accounts, giving players an additional layer of login security.
6. Real-time fraud monitoring systems that flag unusual login behaviour, including access from new devices or atypical geographic locations.

Notwithstanding these measures, no electronic transmission or storage system can guarantee absolute security. In the event of a data breach that materially affects your personal data, ar666 will notify you in accordance with applicable legal requirements.

The ar666 platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and gather analytics. The categories of cookies used include:

1. Strictly necessary cookies: Essential to the operation of the ar666 platform — including session management, security tokens, and ar666 login state persistence. These cannot be disabled.
2. Performance cookies: Collect anonymised data on how players interact with the ar666 platform to help us identify areas for improvement. Data is aggregated and not linked to individual identities.
3. Functional cookies: Remember your preferences such as language settings and responsible gaming configurations to provide a more personalised ar666 experience.
4. Analytics cookies: Used to understand traffic patterns and player behaviour across the ar666 platform. Data may be processed by our analytics service partners under strict data processing agreements.

You may manage non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the ar666 platform.

Subject to applicable data protection legislation, you have the following rights in relation to your personal data held by ar666:

1. Right of access: You may request a copy of the personal data ar666 holds about you, along with information about how it is being processed.
2. Right to rectification: You may request correction of any inaccurate or incomplete personal data associated with your ar666 account.
3. Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ar666's legal retention obligations.
4. Right to restrict processing: You may request that ar666 restrict processing of your personal data in certain circumstances, such as where you contest its accuracy.
5. Right to data portability: Where processing is based on your consent or a contract, you may request that we provide your personal data in a structured, machine-readable format.
6. Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to ar666's data protection team at the contact address provided in Section 13. ar666 will respond within thirty (30) calendar days of receiving a valid request, and may require identity verification before processing the request.

The ar666 platform is strictly restricted to individuals who are 21 years of age or older. ar666 does not knowingly collect personal data from any person under the age of 21. If we become aware that a registered account belongs to a person under 21, we will immediately suspend the account, delete all associated personal data (subject to any legal retention requirements), and return any deposited funds to the source payment method.

Parents and guardians who believe a minor may have accessed the ar666 platform should contact our support team immediately so that we can take prompt action.

The ar666 platform may contain references to third-party payment providers and gaming studios whose services integrate with the ar666 platform. These third parties operate under their own privacy policies, and ar666 is not responsible for the privacy practices of such parties. We recommend that you review the privacy policies of any third-party service providers whose services you access in connection with your ar666 account.

ar666 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal obligations. Material changes will be communicated to registered players via email or a prominent notice on the ar666 platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the ar666 platform following any update constitutes your acceptance of the revised Policy. If you do not agree with any material change, you should discontinue use of the platform and contact ar666 to request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ar666, please contact our data protection team in writing: