Privacy Policy

This Privacy Policy ("Policy") describes how play666 ("the Company", "we", "us", "our") collects, processes, stores, and protects the personal data of users ("you", "your", "the Player") of the play666 online gaming and sports betting platform accessible at https://play666.cam (the "Platform").

play666 is committed to protecting the privacy and personal data of all registered Players in accordance with applicable data protection legislation, including but not limited to Malaysia's Personal Data Protection Act 2010 (PDPA) and any other relevant international data protection frameworks that may apply to the Company's operations.

By registering an account on the Platform or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.

In this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means play666, being the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of play666 under a contractual arrangement (e.g., KYC verification providers, payment processors).
• "KYC" means Know Your Customer — the identity and age verification process mandated for all Players prior to withdrawal.
• "Cookies" means small text files placed on your device when you visit the Platform to facilitate functionality, analytics, and session management.
• "Sensitive Data" means Personal Data of a more sensitive nature, including identity document information submitted during KYC.

play666 collects the following categories of personal data from Players. We collect only what is necessary for the stated purposes.

play666 does not collect special category personal data (such as health information, racial origin, or political opinions) except where you voluntarily disclose such information to us — for example, when notifying us of a gambling-related health concern in the context of responsible gambling support.

play666 collects Personal Data through the following means:

• Direct provision: Information you provide when completing the account registration form, submitting KYC documents, contacting customer support, or completing any other data entry field on the Platform.
• Automated technical collection: Technical Data collected automatically through your device and browser when you access and use the Platform, including IP address, session data, and cookie-based analytics.
• Transaction records: Financial Data generated through your deposit and withdrawal activity on the Platform, including data passed to us by payment processors such as FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong.
• Third-party verification providers: Identity and document verification data returned to us by licensed KYC service providers following submission of your verification documents.
• Communications: Data generated during your interactions with our customer support team via live chat, email, or any other supported channel.

play666 processes your Personal Data under the following legal bases, in accordance with applicable data protection law:

1. Contractual necessity: Processing required to provide the services you have requested — including operating your account, processing MYR deposits and withdrawals, and delivering gaming services.
2. Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC requirements, age verification mandates, and gaming licence conditions.
3. Legitimate interests: Processing carried out for play666's legitimate business interests where these are not overridden by your rights — including fraud prevention, platform security, responsible gambling monitoring, and service improvement.
4. Consent: Where we process your data based on your freely given, specific, and informed consent — including for certain marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

play666 uses your Personal Data for the following purposes:

• Creating, managing, and operating your play666 account
• Processing MYR deposits and withdrawals via your chosen payment method
• Conducting KYC identity and age verification (21+ requirement)
• Detecting, investigating, and preventing fraud, money laundering, and prohibited conduct
• Complying with anti-money laundering (AML) and gaming regulatory obligations
• Providing 24/7 customer support, including resolving disputes and responding to complaints
• Monitoring your usage patterns to support responsible gambling tools, including session limits and self-exclusion
• Communicating account-related notifications including transaction confirmations, security alerts, and policy updates
• Personalising your experience on the Platform (e.g., relevant game recommendations, localised content for Malaysian players)
• Conducting internal analytics to improve Platform performance, game availability, and user experience
• Sending promotional communications and bonus offers where you have opted in, and where permitted by applicable law

play666 does not sell, rent, or trade your Personal Data to third parties for any commercial purpose. We may share your data only in the limited circumstances set out below, and only to the extent necessary for the relevant purpose:

All third parties with whom play666 shares Personal Data are contractually required to handle your data in accordance with applicable data protection law and play666's data protection standards. They may not use your data for any purpose beyond the specific task for which it was shared.

The play666 Platform uses cookies and similar tracking technologies to enable core Platform functionality, improve your experience, and support security and fraud detection. Cookies are small text files stored on your device by your browser when you visit the Platform.

play666 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function — including session management, login state, and security token handling. These cannot be disabled without breaking core functionality.
• Performance & Analytics Cookies: Used to collect anonymised usage data to help us understand how Players navigate the Platform — including which games are most popular and where users encounter friction. This data helps us improve the player experience.
• Functional Cookies: Remember your preferences — such as language settings, notification preferences, and game display options.
• Security Cookies: Used to detect and prevent fraudulent activity, including identifying unusual login locations or device changes that may indicate account compromise.

You may adjust your cookie preferences through your browser settings. Note that disabling cookies may affect the functionality of certain Platform features. play666 does not use third-party advertising or behavioural targeting cookies.

play666 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption applied to all pages, data transmissions, and API calls on the Platform
• Two-factor authentication (2FA) available to all Players for enhanced account security
• Encrypted storage of sensitive data at rest, including KYC documents and financial transaction records
• Restricted access controls ensuring that Personal Data is accessible only to authorised personnel who require it to perform their duties
• Regular security audits and penetration testing conducted by independent cybersecurity specialists
• Intrusion detection systems and real-time monitoring to identify and respond to suspicious activity
• Staff data protection training to ensure all team members understand their obligations in handling Player data

Despite these measures, no method of electronic transmission or storage is entirely secure. In the event of a data breach that poses a risk to your rights and freedoms, play666 will notify affected Players and, where required, the relevant regulatory authority within the applicable notification period.

play666 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following retention guidelines apply:

Following the expiry of the applicable retention period, your Personal Data will be securely deleted or anonymised in a manner that prevents re-identification.

Subject to applicable data protection law and certain limited exceptions, you hold the following rights in relation to your Personal Data held by play666. To exercise any of these rights, please contact us via the channels listed in Clause 15.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, such as where accuracy is disputed.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

play666 will respond to all valid data subject requests within 30 days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it. We may ask you to verify your identity before processing any data subject request.

play666 operates infrastructure that may involve the transfer of your Personal Data to servers or service providers located outside Malaysia. Where such transfers occur, play666 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under Malaysian data protection law, including:

• Contractual clauses requiring the recipient to maintain data protection standards equivalent to those applied by play666
• Use of service providers located in jurisdictions with recognised adequate data protection frameworks
• Technical security measures ensuring data in transit and at rest is encrypted regardless of geographic location

All third-party service providers engaged by play666, regardless of their location, are contractually bound to process your data only as directed by play666 and in accordance with this Policy. We do not transfer Personal Data to jurisdictions that do not provide adequate data protection safeguards without implementing compensating controls.

play666 operates a strict 21+ age policy. The Platform is not directed at, and is not intended for use by, any person under the age of 21. We do not knowingly collect Personal Data from any person under 21 years of age.

All accounts are subject to age verification as part of the KYC process. Where play666 discovers or reasonably suspects that an account has been registered by a person under the age of 21, we will immediately suspend the account, initiate an investigation, and delete any associated Personal Data to the extent permitted by our legal obligations.

If you are a parent or guardian and believe that a minor may have registered on the Platform using your or their own identity, please contact us immediately at [email protected]. We will investigate and take appropriate action promptly.

play666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our services. The date of the most recent revision is displayed at the top of this page.

Where changes are material, we will notify registered Players by email or through a prominent notice on the Platform before the changes take effect. We recommend that you review this Policy periodically to remain informed about how we protect your Personal Data.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by play666, please contact our Data Protection team through the following channels:

When submitting a data subject access request or any other rights-based request, please provide sufficient information to allow us to verify your identity and locate the relevant data. This typically means providing your registered email address, account username, and a brief description of your request.

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. In Malaysia, the relevant body is the Department of Personal Data Protection (JPDP) under the Ministry of Communications and Digital.

For general enquiries about play666 services, please visit our FAQ page or About Us page.