Privacy Policy — 666duit Gaming Platform

This Privacy Policy (the "Policy") is published by 666duit (the "Platform", "Operator", "We", "Us", or "Our") and applies to all personal data collected from individuals (the "Player", "User", or "You") who access, browse, register on, or interact with the 666duit online gaming platform accessible at https://666duit.cam and all associated sub-domains and interfaces (collectively, the "Service").

666duit is committed to protecting your privacy and handling your personal data with transparency, integrity, and appropriate technical security measures. This Policy describes in detail the categories of personal data we collect, the purposes for which we process that data, the legal basis for such processing, and the rights available to you regarding your personal information.

This Policy should be read alongside the666duit Terms & Conditions, which govern the overall relationship between you and the Platform. By using the Service or registering an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, location data, and online identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, organisation, retrieval, use, disclosure, transmission, alteration, and deletion.
• "Data Controller" means 666duit, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller, under documented instructions and subject to binding confidentiality obligations.
• "KYC Data" means identity verification documentation including government-issued photo identification (e.g., MyKad, passport, driving licence), proof of address, and payment instrument verification materials submitted in fulfilment of Know Your Customer requirements.
• "Sensitive Data" means a subset of Personal Data that warants enhanced protection, such as financial account details, government identification numbers, and payment instrument information.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data for a stated purpose.
• "Cookie" means a small text file stored on your device by the Platform to record session preferences, authentication state, and anonymised usage analytics.

666duit collects Personal Data through several channels: directly from you during registration and account management, automatically during your use of the Service, and from third-party service providers in the course of payment processing and identity verification. The categories of data collected are set out in the table below.

666duit does not intentionally collect Sensitive Personal Data relating to racial or ethnic origin, religious beliefs, political opinions, biometric data (beyond that required for identity document verification), or health information unless directly relevant to a responsible gambling support request.

666duit processes your Personal Data for the following specific and documented purposes:

• Account Management: To create, maintain, secure, and administer your Account, including processing registrations, updating account details, managing login sessions, and enforcing account-level policies.
• Identity & Age Verification (KYC): To verify that you meet the minimum age requirement of 21 years and that your identity is accurately established, as required by our international licensing obligations and responsible gambling commitments.
• Payment Processing: To facilitate deposits and withdrawals in MYR via supported Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and direct bank transfers through Maybank, CIMB, Public Bank, RHB, and Hong Leong.
• Fraud Prevention & Anti-Money Laundering: To detect, investigate, and prevent fraudulent transactions, bonus abuse, account manipulation, and money laundering activity, including sharing relevant data with payment processors and financial intelligence partners where legally required.
• Customer Support: To respond to your enquiries, resolve disputes, process responsible gambling requests (including self-exclusion and deposit limits), and maintain records of support interactions.
• Platform Improvement: To analyse aggregated usage patterns, game performance data, and technical logs for the purpose of improving Platform stability, user experience, and game selection. This analysis is performed on anonymised or pseudonymised data where feasible.
• Legal & Regulatory Compliance: To comply with obligations arising from our international gaming licence, applicable financial crime prevention regulations, and any lawful requests from competent regulatory or law enforcement authorities.
• Marketing Communications: To send you promotional offers, bonus notifications, and gaming news where you have provided explicit consent to receive such communications. You may opt out at any time (see Section 13).

Where applicable data protection frameworks require the identification of a lawful basis for each processing activity, 666duit relies on the following grounds:

• Contractual Necessity: Processing is necessary for the performance of the Terms & Conditions contract between you and 666duit — including account creation, payment processing, and delivering the gaming services you have requested.
• Legitimate Interests: Processing is necessary for666duit's legitimate business interests, including fraud prevention, platform security, AML monitoring, and improving our services — provided these interests are not overridden by your fundamental privacy rights.
• Legal Obligation: Processing is required to comply with mandatory legal and regulatory obligations, including KYC requirements under our international gaming licence and financial crime prevention frameworks.
• Consent: Where processing is based on your consent — principally in relation to marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

666duit does not sell your Personal Data to third parties. We may share your data with the following categories of third-party recipients, solely to the extent necessary to fulfil the stated purposes:

• Payment Service Providers: Financial institutions and e-wallet operators (including but not limited to those operating Touch 'n Go eWallet, Boost, GrabPay, and the FPX/DuitNow network) receive transactional data necessary to process deposits and withdrawals in MYR.
• KYC & Identity Verification Providers: Third-party identity verification service providers receive copies of identification documents and selfie images to perform automated or manual age and identity checks on behalf of 666duit.
• Fraud Prevention & AML Service Providers: Specialist fraud detection platforms and financial intelligence services receive transaction metadata to identify suspicious activity patterns.
• Game Content Providers: Online game studios and live dealer platform operators may receive anonymised player session data (e.g., session identifiers, bet amounts) required to operate their games within the 666duit environment. They do not receive your full identity data.
• IT & Infrastructure Providers: Cloud hosting, database management, and cybersecurity service providers process data on 666duit's behalf under strict data processing agreements.
• Legal & Regulatory Authorities: In circumstances where 666duit is legally required to disclose data — including in response to a court order, regulatory direction, or law enforcement investigation — we will comply with such requirements and, where legally permissible, notify you of the disclosure.

All third-party Data Processors engaged by 666duit are subject to binding data processing agreements that restrict their use of your data to the specific purposes for which it was shared and mandate appropriate technical and organisational security measures.

Given that666duit is an internationally operated platform, your Personal Data may be transferred to and processed in countries outside of Malaysia, including but not limited to the jurisdiction(s) in which 666duit holds its gaming licence, and the countries in which our data processors and cloud infrastructure providers operate.

Where such international transfers occur, 666duit ensures that appropriate safeguards are in place to protect your data, including:

• Standard contractual clauses or equivalent data transfer mechanisms requiring recipient parties to uphold data protection standards;
• Selection of Data Processors in jurisdictions that maintain adequate data protection laws or provide equivalent contractual guarantees;
• Technical encryption measures ensuring data in transit and at rest cannot be accessed by unauthorised parties.

If you have questions about the specific countries to which your data may be transferred or the safeguards in place, please contact us at [email protected].

666duit retains your Personal Data only for as long as is necessary to fulfil the purposes outlined in this Policy, subject to overiding legal and regulatory retention obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised. Where deletion is requested by a Player prior to the expiry of mandatory retention periods, we will restrict active use of the data while retaining it solely to fulfil outstanding legal obligations.

666duit uses cookies and similar tracking technologies (including local storage objects and session tokens) to operate the Platform effectively and improve your experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and CSRF protection identifiers. These cookies cannot be disabled without impairing core Platform functionality.
• Functional / Preference Cookies: Store your preferences such as language settings, display preferences, and remembered login status. Disabling these may reduce the convenience of your experience but will not prevent access to the Platform.
• Analytics Cookies: Collect aggregated, anonymised data about how visitors use the Platform — including pages visited, time on site, and navigation paths. This data informs Platform improvements and is not linked to your individual identity.
• Session Cookies: Temporary cookies that expire when you close your browser, used to maintain your login state and shopping basket (if applicable) during a single browsing session.

You may manage your cookie preferences through your browser's cookie settings. Widely used browsers including Chrome, Firefox, Safari, and Edge all provide mechanisms to view, accept, or delete cookies. Please note that blocking strictly necessary cookies will impair your ability to log in and use the Platform.

666duit implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and 666duit servers is encrypted using industry-standard TLS 1.2 or higher.
• Encryption at Rest: Sensitive Personal Data — including KYC documentation, payment instrument details, and identity records — is stored using strong encryption algorithms.
• Access Controls: Access to Personal Data within the organisation is restricted to personnel who require it to fulfil their job functions. Role-based access controls and multi-factor authentication are enforced for all internal systems.
• Intrusion Detection & Monitoring: Automated systems monitor for unusual access patterns, potential data breaches, and suspicious activity on an around-the-clock basis.
• Regular Security Audits: The Platform undergoes periodic security assessments including vulnerability scanning and penetration testing conducted by independent security professionals.
• Data Breach Response: 666duit maintains a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to affected individuals, we will notify impacted Players within 72 hours of discovery where technically and practically feasible.

Despite these measures, no internet transmission or electronic storage system is 100% secure. Players are encouraged to choose strong, unique passwords for their 666duit Account and to never share login credentials with any third party.

Subject to applicable law and certain exceptions, you hold the following rights with respect to your Personal Data held by 666duit. To exercise any of these rights, please contact our support team via live chat or at [email protected] with the subject line "Data Rights Request — [Your Username]".

666duit will respond to all data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by up to a further 30 days, in which case we will notify you of the extension and the reasons for the delay.

666duit is strictly a platform for adults aged21 years and above. The Service is not directed at, and is not intended to be used by, any person under the age of 21.666duit does not knowingly collect Personal Data from individuals under 21 years of age.

Mandatory KYC age verification procedures are implemented to enforce this restriction at the account registration and first-withdrawal stages. Any Account that is identified as having been created by, or on behalf of, a person under 21 will be immediately suspended, all data will be processed solely for the purpose of investigation and compliance, and the matter may be referred to the appropriate authorities where fraudulent identity documentation has been provided.

If you believe that a person under the age of 21 has registered an Account or provided Personal Data to 666duit, please notify us immediately at [email protected] and we will investigate and take appropriate action without delay.

With your explicit consent at the point of registration or via subsequent opt-in, 666duit may contact you with promotional information including bonus offers, new game announcements, sports betting promotions relating to EPL, Liga Super Malaysia, UFC, and other events and seasonal campaigns.

Marketing communications may be delivered via email and/or SMS to the contact details registered on your Account. The frequency of marketing communications is subject to your preferences and 666duit's standard promotional schedule.

Opting Out: You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link contained in any marketing email;
• Replying "STOP" to any marketing SMS message;
• Contacting our support team via live chat or at [email protected] and requesting removal from all marketing lists.

Opt-out requests will be actioned within 5 business days. Please note that withdrawing marketing consent does not affect the delivery of transactional communications, which include Account security alerts, withdrawal confirmations, and KYC request notifications — these are sent solely on the basis of contractual necessity and cannot be opted out of while your Account remains active.

666duit reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data collection, change a purpose for processing, or add a new category of third-party recipient — we will provide advance notice to registered Account holders via email and/or a prominent notice on the Platform, at least 14 days before the change takes effect.

The "Last Updated" date at the top of this Policy will reflect the date of the most recent revision. We encourage you to review this Policy periodically to remain informed about our data practices. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

Where an amendment requires fresh consent (e.g., a material change to marketing data use), we will contact you directly to obtain renewed consent before processing your data for the new purpose.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the666duit data team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat widget displayed on any page of the Platform. Average response time: under 90 seconds.
• Email: [email protected] — Please use the subject line "Privacy Request — [Your Username]" to ensure your message is routed promptly to the relevant team. Response within 4 hours during standard business hours.

For formal data subject rights requests (access, erasure, portability, etc.), please use the subject line "Data Rights Request — [Your Username]" and include your registered email address and brief description of your request. We will acknowledge receipt within 2 business days and provide a substantive response within 30 calendar days.