arr66 Privacy Policy

arr66 ("we", "us", "our", "Platform") is committed to protecting the personal data of all individuals who visit, register with, or use our online casino and sports betting platform at https://arr66.cam. This Privacy Policy ("Policy") sets out in clear terms how we collect, process, store, share, and safeguard your personal information.

This Policy applies to all users of the arr66 Platform, including registered Account holders and anonymous visitors. It should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, which together govern your relationship with arr66.

By registering an Account, depositing funds, or otherwise accessing the arr66 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Account" means a registered user account on the arr66 Platform.
• "Cookie" means a small text file placed on your device by the Platform to enable certain functionality and to collect browsing data.
• "Data Controller" means arr66, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed by arr66 — this includes you as a registered player or website visitor.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, financial details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, transmission, alteration, restriction, or erasure.
• "Third Party" means any entity other than you and arr66 that is involved in the processing of your personal data, such as a payment processor, KYC verification provider, or analytics service.

arr66 collects personal data across several categories, depending on how you interact with the Platform:

3.1 Registration & Identity Data

• Full legal name (as per government-issued identification);
• Date of birth (for age verification — 21+ requirement);
• Email address and contact number;
• Malaysian city or state of residence;
• Username and encrypted password.

3.2 KYC Verification Documents

• Government-issued identification (Malaysian MyKad, passport);
• Proof of residential address (utility bill, bank statement);
• Payment method ownership documentation where required.

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts and timestamps;
• Payment method details (e-wallet identifiers, bank account references for Maybank2u, CIMB Clicks, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Public Bank, Hong Leong Connect);
• Account balance history and bonus transaction records.

3.4 Betting & Gaming Activity Data

• Sports bets placed (markets, stakes, odds, outcomes);
• Casino game sessions (game type, session duration, wager amounts);
• Responsible gambling tool usage (deposit limits set, self-exclusion requests).

3.5 Technical & Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser version;
• Session timestamps, page views, and navigation paths;
• Cookie identifiers and similar tracking technologies.

3.6 Communications Data

• Live chat transcripts and support ticket content;
• Email correspondence with arr66;
• Feedback, complaints, and survey responses.

arr66 collects personal data through the following channels:

arr66 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions — including Account management, bet settlement, payment processing, and customer support;
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, KYC requirements, and regulatory reporting duties;
• Legitimate interests: Processing necessary for arr66's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your rights;
• Consent: Processing based on your explicit consent, including the use of non-essential cookies and receipt of marketing communications. You may withdraw consent at any time.

arr66 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and securing your arr66 Account, including password resets and Account recovery;
• Identity verification: Confirming your identity and age (21+) in accordance with our KYC procedures and licence obligations;
• Payment processing: Facilitating deposits and withdrawals via Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect;
• Service delivery: Providing access to betting markets, live casino games, slots, promotions, and VIP programme benefits;
• Customer support: Responding to enquiries, resolving disputes, and processing complaints via live chat and email;
• Fraud prevention and security: Detecting and preventing fraud, money laundering, account takeover, bonus abuse, and other prohibited conduct;
• Responsible gambling: Monitoring player behaviour to identify potential problem gambling patterns and administering self-exclusion, deposit limit, and loss limit requests;
• Legal and regulatory compliance: Meeting obligations under applicable AML, KYC, and gaming licence requirements;
• Platform improvement: Analysing usage data to improve site performance, user experience, and game offerings;
• Marketing (with consent only): Sending promotional offers, bonus notifications, and product updates to players who have opted in. You may unsubscribe at any time.

arr66 does not share your personal data with third parties except in the limited circumstances described below. Where data is shared, appropriate data processing agreements are in place to ensure your information is handled to the same standard as we apply internally.

• Payment processors: Transaction data is shared with certified Malaysian and international payment processors solely to facilitate deposits and withdrawals. This includes providers behind DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect;
• KYC and identity verification providers: Identity documents and verification data are shared with regulated third-party KYC service providers solely for the purpose of identity and age verification;
• Fraud prevention and security providers: Device and behavioural data may be shared with risk management and fraud detection partners to protect the Platform and its players;
• Analytics providers: Aggregated and anonymised usage data may be shared with analytics platforms to support Platform performance analysis. No personally identifiable information is included in such transfers;
• Regulatory and law enforcement authorities: arr66 may disclose personal data to regulators, law enforcement agencies, or courts where required by applicable law or by a valid legal order;
• Business succession: In the event of a merger, acquisition, or sale of substantially all assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

arr66 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and improve your experience. The types of cookies we use are as follows:

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate securely.

arr66 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal and regulatory obligations. The following general retention periods apply:

• Active Account data: Retained for the duration of your Account's existence and for a minimum period of five (5) years following Account closure, in compliance with AML and gaming licence record-keeping requirements;
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later;
• Transaction records: Retained for a minimum of seven (7) years in accordance with financial record-keeping obligations;
• Support communications: Retained for up to three (3) years following resolution of the relevant enquiry or complaint;
• Technical and device data: Typically retained for 12 to 24 months in aggregate or anonymised form for analytical purposes;
• Marketing consent records: Retained for as long as you remain opted in, plus a reasonable period after opt-out for compliance documentation purposes.

Where retention beyond these periods is required by law, regulation, or active legal proceedings, data will be retained until the relevant obligation is fulfilled.

arr66 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the arr66 servers;
• Encrypted storage of sensitive data fields including passwords (hashed), financial details, and identity documents;
• Access controls limiting internal access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing conducted by independent third-party security specialists;
• Two-factor authentication options available to Account holders to strengthen login security;
• Fraud detection systems monitoring transactions and account activity in real time for suspicious patterns.

While arr66 takes data security seriously and employs industry-standard protections, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and should notify arr66 immediately if you suspect unauthorised access to your Account.

Subject to applicable law, you have the following rights with respect to your personal data held by arr66. To exercise any of these rights, please contact our support team at the details set out in Clause 16.

• Right of Access: You may request a copy of the personal data arr66 holds about you, along with information about how it is being processed;
• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data we hold about you;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations;
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, for example while a dispute is being resolved;
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your personal data in a structured, machine-readable format;
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis, and where your interests override ours;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

arr66 will respond to valid data rights requests within thirty (30) days of receipt. In complex or high-volume cases, this period may be extended by a further thirty (30) days, with notice provided to you.

arr66 operates as an internationally licenced gaming platform and may transfer your personal data to, or process it in, countries outside of Malaysia. Such transfers may involve countries whose data protection frameworks differ from those in Malaysia.

Where personal data is transferred internationally, arr66 takes appropriate safeguards to ensure that your data receives a level of protection consistent with this Policy, including:

• Transfers to countries recognised as providing an adequate level of data protection;
• Use of standard contractual clauses or equivalent data processing agreements with recipients;
• Implementation of technical safeguards such as encryption in transit and at rest.

The arr66 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21. If you are under 21, you must not register an Account, access the Platform, or provide any personal information to arr66.

If arr66 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and permanently close the associated Account. Any deposits made by a person under 21 will be returned to the original payment method following identity verification.

Parents and guardians who believe that their child has accessed the arr66 Platform should contact our support team immediately so that appropriate action can be taken.

The arr66 Platform may, from time to time, reference or integrate third-party services such as payment processors (Maybank2u, CIMB Clicks, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, FPX, Public Bank, Hong Leong Connect) and identity verification providers. These third-party services operate under their own privacy policies, which are independent of this Policy.

arr66 is not responsible for the privacy practices of third-party services and encourages you to review the privacy policies of any third-party platforms you interact with in connection with your arr66 Account. Our responsibility extends only to data we directly collect and process.

arr66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform functionality. The "Last Updated" date at the top of this page reflects the most recent revision.

Where a material change is made to this Policy, arr66 will notify registered Account holders by email or by displaying a prominent notice on the Platform prior to the change taking effect. Continued use of the Platform following notification of a revised Policy constitutes your acceptance of the updated terms.

We recommend reviewing this Policy periodically to remain informed of how arr66 handles your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way arr66 handles your personal data, please contact our Data Privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the arr66 Platform
• Support Language: English
• Operating Hours: Round-the-clock (Malaysia Standard Time, GMT+8)
• Data Rights Requests: Please include "Data Rights Request" in your subject line or opening message to ensure prompt handling

arr66 aims to respond to all privacy-related enquiries within 30 days of receipt. For urgent matters involving Account security or suspected unauthorised data access, please use our live chat service for the fastest response.