Privacy Policy

This Privacy Policy ("Policy") describes how 66zz ("the Platform", "we", "us", "our") collects, processes, stores, and protects personal data relating to individuals ("you", "the User", "the Player") who access or use the services available at https://66zz.casa and any associated subdomains or mobile interfaces.

We are committed to handling your personal data with transparency, fairness, and security. This Policy is designed to ensure you understand exactly how your information is used and what choices you have. It applies to all data collected during account registration, gameplay, payment transactions, customer support interactions, and general browsing of our platform.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the 66zz platform. By registering an account or using the platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial account details, and online identifiers such as IP addresses.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, 66zz acts as the Data Controller in respect of all player personal data.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a contractual arrangement and in accordance with the Controller's instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data for a stated purpose.
• "Sensitive Data" — categories of personal data warranting heightened protection, including information about health, biometrics, or financial vulnerability indicators.
• "KYC Data" — identity and address verification documents collected as part of the Know Your Customer process, including government-issued identity documents and proof of payment method ownership.
• "Cookie" — a small data file placed on a user's device by a website, used to remember preferences, manage sessions, or track usage patterns.

66zz acts as the Data Controller in respect of the personal data of all registered players and website visitors. As Data Controller, 66zz is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is conducted lawfully, fairly, and transparently.

Where 66zz engages third-party service providers to process personal data on its behalf (for example, payment processors, KYC verification services, or analytics providers), those parties act as Data Processors. 66zz enters into data processing agreements with all such parties to ensure your data is handled appropriately and in accordance with this Policy.

For all data protection enquiries, requests to exercise your rights, or concerns about how your personal data is being handled, please contact us using the details provided in Section 17 of this Policy.

66zz collects the following categories of personal data. We collect only what is necessary for the stated purposes and do not retain data beyond the periods set out in Section 10.

66zz collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide during account registration, KYC verification, cashier transactions, support interactions, and any surveys or feedback forms.
• Automated technical collection: When you access the platform, our servers automatically log technical data including your IP address, device identifier, browser type, session timestamps, and pages visited. This occurs via cookies and server-side logging.
• Payment providers: When you make a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, RHB Bank, or cryptocurrency wallets, our payment processing partners transmit transaction confirmation data to us.
• KYC and AML service providers: Our identity verification partners may provide us with a verification status, risk score, and document authenticity confirmation following their processing of the documents you submit.
• Third-party analytics: We use first-party analytics tools to understand platform usage patterns. These tools operate under data processing agreements and do not share data with advertising platforms.

66zz processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and 66zz — including account creation, payment processing, gameplay facilitation, and withdrawal handling. Without this processing, we cannot provide our services.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations — including KYC/AML requirements, record-keeping obligations, and cooperation with law enforcement or regulatory authorities where legally compelled.
• Legitimate interests: Processing carried out in pursuit of 66zz's legitimate business interests, where those interests are not overridden by your rights — including fraud prevention, platform security, responsible gambling monitoring, and service analytics.
• Consent: Processing based on your freely given, specific consent — primarily in relation to marketing communications. You may withdraw consent at any time with immediate effect.

Where processing is based on legitimate interests, 66zz has assessed that the processing is necessary, proportionate, and does not cause undue prejudice to your rights and interests as a data subject.

66zz uses the personal data it collects for the following operational purposes:

• Account management: Creating, maintaining, and closing player accounts; authenticating logins; processing password resets; communicating account-related notices.
• Payment processing: Executing deposit and withdrawal transactions in MYR via the payment methods available on the platform; verifying payment method ownership; managing transaction records.
• Identity verification (KYC): Verifying player identity and age (21+) prior to enabling withdrawal functionality; complying with anti-money laundering (AML) obligations; screening against sanctions and PEP lists.
• Responsible gambling: Monitoring gaming behaviour for indicators of problem gambling; applying player-set deposit limits and session reminders; administering self-exclusion requests; contacting players where responsible gambling concerns arise.
• Customer support: Responding to queries submitted via live chat or email; investigating complaints; resolving disputes; maintaining support interaction records for quality assurance.
• Fraud and security: Detecting and investigating suspicious account activity, unauthorised access, multi-accounting, and payment fraud; maintaining platform integrity; protecting the security of all player accounts.
• Platform improvement: Analysing anonymised or aggregated usage data to improve platform features, game selection, and user experience — no individual players are identified in this analysis.
• Marketing (where consent given): Sending promotional communications about bonuses, new games, and platform updates to players who have opted in. Each communication includes a clear unsubscribe mechanism.

66zz does not sell, rent, or trade your personal data to unaffiliated third parties. We share personal data only in the following circumstances, and only to the extent necessary for the specific purpose:

• Payment service providers: To process deposits and withdrawals, your transaction data and account identifiers are shared with the relevant payment processor — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, RHB Bank, and cryptocurrency network validators. These providers process data under their own privacy policies and our data processing agreements.
• KYC and AML verification providers: Identity documents and verification data are shared with our contracted KYC/AML partners for the purpose of authenticating your identity, verifying your age, and screening against applicable sanctions lists.
• Game studio providers: When you play a game hosted on our platform by a third-party studio, a session token and limited account identifier may be shared with that studio to enable gameplay. Game studios do not receive your full identity or financial data.
• IT and platform infrastructure providers: Cloud hosting, data storage, and cybersecurity partners may process personal data in the course of providing infrastructure services to 66zz. All such providers are bound by contractual data protection obligations.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, a valid legal order, or our licensing obligations. Where permitted by law, we will notify affected players of such disclosures.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 66zz's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.

66zz operates internationally, and some of our service providers — including hosting infrastructure, KYC verification providers, and game studios — may be located in countries outside Malaysia. As a result, your personal data may be transferred to and processed in jurisdictions that apply different data protection standards from those in your home country.

Where such transfers occur, 66zz takes steps to ensure that appropriate safeguards are in place. These may include:

• Contractual data protection clauses in agreements with receiving parties, requiring them to maintain standards equivalent to those described in this Policy
• Transfers to jurisdictions recognised as providing an adequate level of data protection
• Application of technical controls (encryption in transit and at rest) regardless of where data is processed

By using 66zz, you acknowledge and accept that your data may be transferred internationally in accordance with these safeguards.

66zz retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulatory obligations. The following general retention periods apply:

After the applicable retention period, personal data is securely deleted or anonymised so it can no longer be associated with an identified individual. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes.

66zz employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Transport Layer Security (TLS): All data transmitted between your browser or mobile device and the 66zz platform is encrypted in transit using TLS 1.2 or higher.
• Encryption at rest: Sensitive personal and financial data stored in our systems is encrypted using AES-256 encryption.
• Access controls: Internal access to player personal data is restricted on a strict need-to-know basis. Staff with legitimate operational access are subject to role-based permissions, mandatory confidentiality obligations, and regular security training.
• Audit logging: All access to personal data by internal personnel is logged and subject to periodic review.
• Two-factor authentication: Player accounts benefit from optional two-factor authentication to protect against unauthorised login attempts.
• Intrusion detection and monitoring: Our infrastructure is monitored continuously for anomalous activity, with automated alerts triggering investigation of potential security incidents.
• Vendor due diligence: All third-party service providers that process personal data on our behalf are assessed for their security practices before engagement and are contractually required to maintain appropriate standards.

66zz uses cookies and similar tracking technologies to operate the platform effectively. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that maintain your login state, CSRF protection tokens, and cashier session management. These cookies cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: First-party analytics cookies that help us understand how players navigate the platform, which features are most used, and where errors occur. This data is aggregated and anonymised — individual user behaviour is not shared externally.
• Functional cookies: Cookies that remember your preferences such as language settings, display options, and responsible gambling settings selected during your session.
• Security cookies: Short-lived cookies used by our fraud detection systems to identify anomalous access patterns and protect accounts from automated threats.

66zz does not use third-party advertising cookies, retargeting pixels, or tracking technologies that enable external advertising networks to profile your behaviour across other websites.

You may manage cookie preferences through your browser settings at any time. Blocking strictly necessary cookies will prevent certain platform features from functioning correctly.

As a 66zz player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us using the details in Section 17.

• Right of access: You may request a copy of the personal data 66zz holds about you, along with information about how it is being processed. Requests are fulfilled within 30 days.
• Right to rectification: If any personal data 66zz holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Account details such as email address and phone number can be updated directly in your account settings.
• Right to erasure ("right to be forgotten"): In certain circumstances, you may request that 66zz delete your personal data — for example, if you close your account and there is no legal obligation to retain the data. Note that regulatory retention requirements (Section 10) may limit the scope of erasure requests.
• Right to restriction of processing: You may request that 66zz temporarily restrict the processing of your data while a dispute about its accuracy or use is being resolved.
• Right to data portability: You may request that 66zz provide a machine-readable copy of the personal data you have provided to us, in a commonly used format.
• Right to object: You may object to processing based on legitimate interests (including direct marketing) at any time. If you object to marketing, processing for that purpose will cease immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

66zz sends promotional communications — including bonus offers, new game announcements, VIP programme updates, and seasonal promotions — only to players who have expressly opted in to receive such communications during account registration or subsequently through their account settings.

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link included in any promotional email
• Updating your communication preferences in your account settings dashboard
• Contacting our support team via live chat or at [email protected] and requesting removal from marketing lists

Unsubscribe requests are actioned immediately for SMS and within 5 business days for email (to account for mail queue processing). Opting out of marketing communications does not affect transactional or account-related communications, which will continue to be sent as necessary for account management.

Players who have activated self-exclusion are automatically removed from all marketing communication lists and will not receive any promotional material during their exclusion period.

The 66zz platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory part of the account registration process, and KYC procedures are designed to identify and close any accounts held by underage individuals.

If 66zz becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and permanently close the associated account. Any deposits made to such accounts will be returned to the verified payment source.

66zz reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform functionality. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page and in the page header banner
• Notify registered players via the email address on record at least 14 days before the changes take effect
• Display a prominent notice on the platform for the notice period

Your continued use of the 66zz platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you should close your account prior to the effective date.

We encourage you to review this Policy periodically to stay informed about how your data is being handled.

For all privacy-related enquiries, requests to exercise data subject rights, or concerns about how 66zz handles your personal data, please contact our support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, from inside your 66zz account dashboard. This is the fastest channel for privacy enquiries — average response time under 15 minutes.
• Email: [email protected] — please include "Privacy Request" in the subject line for routing. Responses within 24 hours during operational periods.

When submitting a data subject rights request, please include your full name, the email address registered to your 66zz account, and a clear description of the right you wish to exercise. We may request additional identity verification before processing your request.

For information about your account's responsible gambling settings, deposit limits, or self-exclusion options, please refer to our Responsible Gambling page or contact support directly.