Privacy Policy — How max66 Handles Your Personal Data

Introduction

This Privacy Policy ("Policy") is issued by max66, the operator of the online casino and sports betting platform at max66.cam ("the Platform"). This Policy applies to all personal data collected from individuals ("Users", "Account Holders", "you") who register for an account, access the Platform, or otherwise interact with max66's services.

max66 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy explains: (a) what personal data we collect; (b) how and why we collect and use it; (c) with whom we may share it; (d) how long we retain it; (e) the security measures we employ; and (f) the rights you hold with respect to your personal information.

By registering an Account on max66 or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read in conjunction with our Terms & Conditions.

Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means max66, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means a third party that processes personal data on behalf of max66 pursuant to written instructions and data processing agreements.
• "KYC Data" means identity verification documentation including government-issued photo identification, proof of address, and payment method ownership documentation required under Know Your Customer obligations.
• "Cookies" means small text files placed on a User's device for the purpose of storing session information, user preferences, and analytics data.
• "Sensitive Data" means a special category of personal data including financial account details, identification numbers, and health-related information where applicable to responsible gambling assessments.

Personal Data We Collect

max66 collects the following categories of personal data from Account Holders and Platform visitors:

How We Collect Personal Data

max66 collects personal data through the following channels:

• Direct Submission: Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, browser fingerprints, device identifiers, session duration, and navigation patterns, collected through server logs and first-party cookies.
• Payment Processors: Transaction confirmation data shared by Malaysian payment processors including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners, solely for the purpose of reconciling deposits and withdrawals.
• Third-Party Verification Services: Identity and address verification data returned by licensed KYC service providers used to fulfil our compliance obligations.

Purposes of Processing & Legal Basis

The table below sets out the purposes for which max66 processes personal data and the legal basis relied upon for each processing activity:

Where processing is based on legitimate interest, max66 has conducted a balancing assessment confirming that our interest does not override the fundamental rights and freedoms of the individuals concerned. Where processing is based on consent, that consent may be withdrawn at any time by contacting support, without affecting the lawfulness of processing that occurred prior to withdrawal.

Data Sharing & Disclosure

max66 does not sell personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: We share transaction data with Malaysian payment processors — including Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and applicable banking partners — solely to process deposits and withdrawals. These providers are contractually bound to process data only as instructed by max66.
• KYC and Identity Verification Providers: Identity documents and verification data are shared with licensed third-party KYC service providers to fulfil our compliance obligations. These providers operate under strict data processing agreements.
• Technology and Hosting Providers: We engage cloud infrastructure and platform technology providers to host and operate the Platform. These providers access personal data only as Data Processors under written agreements that prohibit independent use of the data.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or legitimate regulatory request, max66 will disclose personal data to the relevant authority. We will notify affected Account Holders where legally permitted to do so.
• Fraud Prevention and Security Agencies: In cases of suspected fraud, money laundering, or material breach of the Terms, max66 may share data with appropriate fraud prevention organisations or law enforcement bodies.

Data Retention

max66 retains personal data only for as long as necessary to fulfil the purposes outlined in this Policy or to comply with applicable legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of the Account's active status plus a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements.
• KYC and Verification Documents: Retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later, in compliance with financial regulatory obligations.
• Transaction Records: Financial transaction data is retained for a minimum of seven (7) years following the date of each transaction.
• Customer Support Communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction, unless related to an ongoing dispute or investigation.
• Technical and Log Data: Server logs, IP address records, and session data are retained for twelve (12) months unless required for longer retention in connection with a security incident or fraud investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual. Where anonymisation is not technically feasible, data is securely destroyed.

Security Measures

max66 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• Encryption in Transit: All data transmitted between your browser or device and the max66 Platform is encrypted using TLS 1.2 or higher (256-bit SSL), including login credentials, payment data, and KYC document uploads.
• Encryption at Rest: Sensitive personal data stored on max66 servers — including identity documents, financial account details, and password hashes — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data systems is restricted to authorised personnel on a strict least-privilege basis. All access is logged and subject to periodic review.
• Multi-Factor Authentication: Internal access to systems containing personal data requires multi-factor authentication for all personnel.
• Regular Security Audits: The Platform undergoes periodic third-party penetration testing and security assessments. Identified vulnerabilities are remediated according to a defined risk-based schedule.
• Incident Response: max66 maintains a documented data breach response procedure. In the event of a breach affecting personal data, affected Account Holders will be notified in accordance with applicable data protection requirements.

Your Rights Over Personal Data

As a max66 Account Holder, you hold the following rights with respect to personal data we process about you. To exercise any of these rights, submit a written request to [email protected] clearly identifying the right you wish to exercise. We will respond within 30 calendar days of receiving a valid request.

• Right of Access: You may request a copy of all personal data max66 holds about you, along with information about how it is used, where it is stored, and with whom it has been shared. This is commonly referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data we hold about you is inaccurate, incomplete, or out of date, you have the right to request correction. Minor corrections (such as updating a contact number) can often be made directly within your Account settings.
• Right to Erasure: You may request the deletion of your personal data where: (a) it is no longer necessary for the purpose it was collected; (b) you withdraw consent and no other legal basis applies; or (c) you successfully object to processing based on legitimate interest. This right is subject to our regulatory retention obligations — we cannot delete data we are legally required to retain.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your data while a correction or objection request is under review.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format (e.g., CSV or JSON).
• Right to Object: Where processing is based on legitimate interest, you may object to that processing. max66 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is required for legal claims.

Cookies & Tracking Technologies

max66 uses first-party cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that allow the Platform to recognise your session, remember your preferences, and collect aggregate usage statistics to improve the service.

The following categories of cookies are used on the max66 Platform:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Store your preferences such as language settings, preferred game categories, and display options. These improve your experience but are not essential to Platform operation.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, session duration, navigation paths — to help us understand and improve user experience. Data collected is aggregated and not linked to individual identities.

max66 does not use third-party advertising or retargeting cookies. We do not share cookie data with ad networks or social media platforms.

You may control cookie settings through your browser preferences. Disabling strictly necessary cookies will impair your ability to log in and use the Platform. You may delete stored cookies at any time through your browser settings.

Children's Privacy

The max66 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, use, or process personal data from anyone under the age of 21. If max66 becomes aware that an Account has been registered by a person under 21, the Account will be immediately closed, any balance forfeited in accordance with the Terms & Conditions, and all personal data associated with the Account deleted as soon as reasonably practicable, subject to any regulatory retention requirements.

If you have reason to believe that a minor has accessed the Platform or provided personal data to max66, please contact us immediately at [email protected] so that we may investigate and take appropriate action.

Third-Party Links

The max66 Platform does not contain outbound links to third-party websites. In the event that future Platform updates include any reference to external resources, this Policy will be updated accordingly. For the avoidance of doubt, max66 is not responsible for the privacy practices of any third-party service, including but not limited to the payment processors used to facilitate transactions.

If you navigate to any third-party website independently (for example, your bank's online portal when completing an FPX transfer), the privacy policy and data handling practices of that third party apply to any data you submit on their platform. max66 is not a party to those data processing activities.

Cross-Border Data Transfers

Certain service providers engaged by max66 — including cloud hosting infrastructure and KYC verification vendors — may process personal data in jurisdictions outside Malaysia. Where such cross-border transfers occur, max66 ensures appropriate safeguards are in place to protect transferred personal data to a standard equivalent to that described in this Policy.

Safeguards employed for cross-border transfers include: contractual data processing agreements incorporating standard contractual clauses; transfer to jurisdictions with an equivalent or higher level of data protection; and technical controls ensuring the data remains encrypted in transit and at rest in the destination jurisdiction.

You may request information about specific cross-border data transfer safeguards applicable to your personal data by contacting [email protected].

Amendments to This Policy

max66 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. Material changes to this Policy will be communicated to Account Holders via the registered email address associated with their Account, no less than seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. We encourage Account Holders to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the updated Policy.

If you do not accept the revised Privacy Policy, you should discontinue use of the Platform and may request account closure in accordance with the Terms & Conditions. Previous versions of this Policy are available upon written request to [email protected].

Contact Us & How to Raise a Complaint

For any privacy-related enquiries, subject access requests, data rights exercises, or complaints regarding max66's handling of your personal data, please contact our support team using the details below:

• Live Chat: Available 24 hours a day, 7 days a week via the Platform. For data rights requests, please state "Privacy Request" at the start of your chat.
• Email: [email protected] — mark the subject line as "Privacy Enquiry" or "Data Rights Request" for prompt routing. We aim to respond within 2 business days for standard enquiries and within 30 calendar days for formal subject access requests.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. max66 will cooperate fully with any regulatory investigation in accordance with applicable law.