666duit Privacy Policy

1. Introduction

666duit ("we", "us", "our", "the Platform") is committed to protecting the personal data of all Members and visitors to its platform in accordance with applicable data protection law and the data privacy obligations imposed on us under our international gaming authority licence. This Privacy Policy describes the nature, scope, and purposes of the personal data processing carried out by 666duit in the course of providing online gaming services to Members across Malaysia and other permitted jurisdictions.

We recognise that trust is foundational to the relationship between a gaming platform and its members. Malaysian players who choose 666duit are sharing sensitive financial and identity information with us — information that enables us to operate legally, prevent fraud, and fulfil our regulatory obligations. This Privacy Policy is our commitment to handle that information with care, transparency, and proportionality.

This Policy should be read alongside the 666duit Terms & Conditions, which form the complete legal framework governing your use of the platform.

2. Personal Data We Collect

2.1 Registration Data

When you create a 666duit account, we collect: full legal name; date of birth; email address; mobile number; country and state of residence (e.g., Selangor, Kuala Lumpur, Johor, Penang); and a username and password of your choosing. This information is mandatory for account creation and forms the core of your Member profile.

2.2 Identity Verification (KYC) Data

To fulfil our anti-money-laundering (AML) and Know Your Customer (KYC) obligations under our international gaming licence, 666duit may request documentary evidence of identity and address. This includes copies of government-issued identification (Malaysian MyKad, passport), proof of residential address (utility bill, bank statement), and — in some circumstances — source-of-funds documentation. KYC verification is triggered at specific withdrawal thresholds and where our compliance processes flag a requirement for additional due diligence.

2.3 Financial Data

We collect the payment method details necessary to process deposits and withdrawals, including e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), Malaysian bank account numbers (Maybank, CIMB, Public Bank), FPX transaction references, DuitNow IDs, and USDT TRC20 wallet addresses where applicable. We do not store full card numbers or banking passwords — financial transaction data is handled through our licensed payment processor integrations.

2.4 Transactional Data

We record all transactions associated with your 666duit account: deposits, withdrawals, bets placed, games played, bet outcomes, bonus claims, and cashier history. This transactional record is retained for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.

2.5 Technical and Device Data

When you access 666duit, we automatically collect: IP address; browser type and version; device type and operating system; session timestamps; pages visited; and geolocation data (derived from IP address). This data is used for security monitoring, fraud prevention, and platform performance optimisation.

2.6 Communications Data

If you contact 666duit support via email or live chat, we retain a record of your communications — including the content of messages, timestamps, and support agent responses. This record is retained for quality assurance and dispute resolution purposes.

3. How We Collect Personal Data

666duit collects personal data through the following channels:

• Directly from you — through the registration form, KYC document submission process, cashier interactions, and communications with support;
• Automatically — through cookies, server logs, and tracking technologies when you access the 666duit website or mobile platform (see Section 9);
• From third-party payment processors — transaction confirmation data from integrated payment gateways including FPX, DuitNow, and e-wallet providers;
• From identity verification services — where 666duit engages a third-party KYC provider to assist with document verification, that provider may supply data back to 666duit confirming verification outcome;
• From fraud prevention services — where third-party risk tools flag or enrich data associated with a registration or transaction for fraud scoring purposes.

4. Purposes of Processing

666duit processes your personal data for the following purposes:

• Account creation and management — to register, maintain, and administer your 666duit Member account;
• Service delivery — to provide sportsbook, casino, slots, poker, and cashier services to registered Members;
• Payment processing — to execute deposit and withdrawal transactions via approved Malaysian payment methods;
• Regulatory compliance — to fulfil KYC, AML, and responsible gaming obligations mandated by our international gaming authority licence;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and unauthorised account access;
• Responsible gaming — to monitor gaming behaviour for indicators of problem gambling and to apply responsible gaming tools where triggered by Member settings or risk flags;
• Customer support — to respond to and resolve Member queries, complaints, and disputes;
• Platform improvement — to analyse aggregate usage data to improve the 666duit platform, product offerings, and user experience;
• Marketing communications — to send promotional emails, SMS, or in-platform notifications about 666duit offers and products, where you have consented to receive such communications or where we have a legitimate interest in doing so;
• Legal proceedings — to establish, exercise, or defend legal claims arising from or related to your use of the 666duit platform.

5. Legal Basis for Processing

666duit processes personal data on the following legal bases:

• Performance of a contract — processing necessary to provide the services you have contracted for by registering a 666duit account and accepting the Terms & Conditions;
• Legal obligation — processing required to comply with AML laws, KYC regulations, licensing conditions, and any applicable data protection legislation;
• Legitimate interests — processing for fraud prevention, security monitoring, platform analytics, and direct marketing to existing Members where our legitimate interests are not overridden by your data protection rights;
• Consent — where you have expressly consented to processing for a specific purpose, such as receiving promotional communications. You may withdraw consent at any time by updating your communication preferences in your 666duit account settings.

6. Data Sharing and Disclosure

666duit does not sell your personal data to third parties. We share personal data only in the following circumstances:

• Payment processors — personal and transactional data is shared with licensed payment gateway providers to process deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, and other approved methods;
• Game and software providers — where required for game session authentication with third-party providers such as Evolution Gaming, Pragmatic Play, PG Soft, and Habanero, limited session data may be shared with those providers under data processing agreements;
• KYC and fraud prevention providers — identity verification and fraud screening services engaged under data processing agreements where the provider acts as our data processor;
• Licensing and regulatory authorities — 666duit is obligated to disclose Member data to the relevant international gaming authority and to law enforcement agencies upon lawful request, court order, or regulatory direction;
• Legal and professional advisers — lawyers, auditors, or other professional advisers engaged by 666duit in connection with legal proceedings, compliance reviews, or business transactions, subject to appropriate confidentiality obligations;
• Business transfers — in the event of a merger, acquisition, or sale of substantially all of 666duit's assets, Member data may be transferred to the acquiring entity subject to equivalent privacy protections.

7. International Data Transfers

7.1 666duit operates under an international gaming licence, and some of our service providers and data processors are located outside Malaysia. Where personal data is transferred internationally, 666duit ensures that such transfers are subject to appropriate safeguards — including standard contractual clauses, data processing agreements with contractual protections, or transfers to jurisdictions with an adequate level of data protection as recognised under applicable frameworks.

7.2 By registering a 666duit account, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia in connection with the services described in this Policy.

8. Data Retention

8.1 666duit retains personal data for as long as necessary to fulfil the purposes set out in this Policy, unless a longer retention period is required by applicable law or licensing conditions. The primary retention periods applicable to 666duit Member data are as follows:

• Active account data — retained for the duration of the Member's account and for a minimum of five (5) years following account closure;
• Financial and transactional records — retained for a minimum of five (5) years from the date of each transaction, in compliance with AML record-keeping requirements;
• KYC documentation — retained for a minimum of five (5) years following the end of the business relationship, or longer where required by applicable law;
• Support communications — retained for three (3) years from the date of the relevant interaction;
• Marketing consent records — retained until consent is withdrawn and for one (1) year thereafter as evidence of consent history.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 666duit's data disposal procedures.

9. Cookies and Tracking Technologies

9.1 The 666duit website uses cookies and similar tracking technologies to deliver and improve the platform experience. The categories of cookies deployed on 666duit are as follows:

• Strictly necessary cookies — essential to the operation of the platform, including session authentication, load balancing, and security tokens. These cannot be disabled without impairing platform functionality;
• Functional cookies — retain Member preferences such as language settings, bet history display options, and preferred view formats;
• Analytics cookies — collect aggregate, anonymised data about how Members navigate the 666duit platform, used to identify performance issues and improve the user experience;
• Marketing and attribution cookies — where you have consented, these cookies enable 666duit to measure the effectiveness of promotional campaigns and to deliver relevant promotional content on the platform.

9.2 You can manage cookie preferences through your browser settings. Note that disabling functional or analytics cookies may affect your 666duit experience. Strictly necessary cookies cannot be disabled through browser settings without breaking core platform functionality.

10. Data Security

10.1 666duit implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include:

• TLS 1.3 encryption for all data in transit between Member devices and 666duit servers;
• Encryption of sensitive data at rest, including KYC documents and payment details;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for internal systems with access to Member data;
• Regular security assessments, penetration testing, and vulnerability management processes;
• Incident response procedures for the detection, investigation, and notification of personal data breaches.

10.2 No data transmission over the internet can be guaranteed to be 100% secure. While 666duit takes all reasonable precautions, Members acknowledge that they share responsibility for account security — particularly in relation to credential management and the use of two-factor authentication where available.

11. Your Data Rights

Subject to applicable law and the conditions of our international gaming licence, 666duit Members hold the following rights in relation to their personal data:

• Right of Access — you may request a copy of the personal data 666duit holds about you;
• Right of Rectification — you may request correction of inaccurate or incomplete personal data;
• Right of Erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no overriding legal obligation requires its retention;
• Right to Restrict Processing — you may request that 666duit limit the processing of your data in certain circumstances, for example where you contest its accuracy;
• Right to Data Portability — where processing is based on consent or contractual necessity, you may request a machine-readable copy of your personal data for transfer to another provider;
• Right to Object — you may object to processing based on legitimate interests, including direct marketing;
• Right to Withdraw Consent — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to [email protected]. 666duit will respond within 30 days of receipt of a valid request. We may require verification of your identity before processing a data subject request.

12. Children and Minors

The 666duit platform is strictly intended for adults aged 21 and above. 666duit does not knowingly collect personal data from individuals under the age of 21. Where 666duit becomes aware that personal data has been collected from a person under 21 — whether through a registration misrepresentation or otherwise — the relevant account will be closed immediately, all personal data associated with that account will be deleted to the extent permitted by applicable law and AML obligations, and any balance held in the account will be returned to the source of funding following verification.

If you believe that a person under the age of 21 has registered a 666duit account, please notify us immediately at [email protected].

13. Third-Party Platform Links

The 666duit platform may contain links to or integrations with third-party services — for example, game providers' demonstration environments or payment processor interfaces. This Privacy Policy applies solely to data processed by 666duit in its capacity as data controller. 666duit is not responsible for the privacy practices of third-party services accessed via links from the 666duit platform. Members are advised to review the privacy policies of any third-party services they engage with independently of 666duit.

14. Amendments to This Privacy Policy

14.1 666duit reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, licensing requirements, business practices, or platform functionality. Material amendments will be notified to Members via their registered email address and/or via an in-platform notification, with not less than 7 days' advance notice before the amended Policy takes effect.

14.2 The current version of the Privacy Policy, identified by its effective date, is always accessible at 666duit.org/privacy-policy. Continued use of the 666duit platform following the effective date of any amendment constitutes acceptance of the updated Privacy Policy.

15. Contact & Data Queries

For all privacy-related queries, data subject requests, or complaints regarding 666duit's handling of your personal data, please contact us in writing: