Privacy Policy cafe66 — Protection Personal Data Malaysian Members

Cafe66 collects various types of personal information when you register an account, make financial transactions, or use our platform services. The following are the categories of data we collect:

A. Identity & Account Information

• Full name as shown on identity card or passport
• Identity card number (MyKad) or passport number
• Date of birth for age verification (18+)
• Active email address
• Mobile phone number
• Account username and password (stored in encrypted form)

B. Financial Information

• Bank account number or bank name for withdrawal purposes
• Digital wallet account number (Touch 'n Go eWallet, Boost, GrabPay)
• Deposit and withdrawal transaction records
• Wagering history and gaming activity

C. Technical & Usage Information

• IP address and approximate IP-based location
• Device type, operating system and browser version
• Access log data, pages visited, and session duration
• Cookie information and related tracking technologies

All personal data collected by cafe66 is used only for legitimate, pre-defined purposes. We will not process your data beyond the scope of the following purposes:

If cafe66 wishes to use your data for any new purpose not stated above, we will request your consent in advance via an in-platform notification or your registered email.

Cafe66 does not sell your personal data to any third party for commercial purposes. However, in the course of operating the platform, there are certain situations where data needs to be shared with selected parties:

• Payment Service Providers: Transaction information is shared with payment providers such as FPX processors, DuitNow and digital wallets as required to complete your financial transactions.
• Game Software Providers: Game session information is shared with third-party casino and slot software providers that operate games on the cafe66 platform.
• Regulatory Authority: cafe66 will disclose required information to government authorities or regulatory bodies when mandated by Malaysian law.
• Fraud Prevention Services: Certain technical information may be shared with third-party security platforms to detect and prevent fraudulent activity.

Protecting your personal data is cafe66's highest priority. We continuously invest in the latest cybersecurity infrastructure to keep your data safe from all external and internal threats.

• 256-bit SSL Encryption: All data transmitted between your device and cafe66's servers is encrypted using TLS 1.3 protocol with 256-bit encryption keys — the same standard used by leading banking institutions in Malaysia.
• Database Encryption: Sensitive data such as passwords and financial information is stored in encrypted form using bcrypt and AES-256 algorithms — unreadable even in the event of a server breach.
• Two-Factor Authentication (2FA): cafe66 supports two-factor authentication for an extra layer of protection for your account.
• 24/7 Monitoring: cafe66's cybersecurity team continuously monitors platform activity to detect any intrusion attempts or unauthorized access.
• Periodic Security Audits: The cafe66 platform undergoes periodic independent security audits conducted by accredited third-party cybersecurity firms.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as the data owner have the following rights guaranteed by law and fully respected by cafe66:

• Right to Access: You have the right to request a copy of the personal data we hold about you at any time. Requests will be processed within 21 working days.
• Right to Rectification: If your personal data is inaccurate or outdated, you have the right to request a correction and cafe66 will update the record within 14 days.
• Right to Erasure: You may request deletion of your personal data upon account termination, subject to record retention obligations required under Malaysian law.
• Right to Object to Processing: You may object to the processing of your data for direct marketing purposes at any time, without penalty.
• Right to Withdraw Consent: For processing based on your consent, you may withdraw that consent at any time, although this may affect some of the services we provide.
• Right to Complain: If you believe cafe66 has not complied with the PDPA in handling your data, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the above rights, please contact our privacy team via Live Chat on the platform or email [email protected]. Include your full name and account number to facilitate the identity verification process.

Cafe66 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance, and deliver relevant content to you. The following are the types of cookies used:

• Essential Cookies (Required): Required for core platform functions such as login sessions, security, and navigation. Cannot be disabled.
• Functional Cookies: Saves your preferences such as language, display settings and login details for convenient reuse.
• Analytics Cookies: Collects aggregated information on how users interact with our platform for the purpose of improving the user experience.
• Performance Cookies: Helps us monitor platform response times, detect technical errors and ensure system stability.

You can manage or delete cookies through your web browser settings at any time. However, disabling essential cookies may affect the functionality of the cafe66 platform and your overall gaming experience.

Cafe66 retains your personal data only for as long as it is needed for the stated purposes or as required by Malaysian law. The following are our data retention guidelines:

• Active Account Data: Retained for the entire duration your account is active on the cafe66 platform.
• Financial Transaction Records: Retained for 7 years after the transaction date in accordance with Malaysia's tax and financial legal requirements.
• Security & Access Logs: Retained for 12 months for security investigation and audit purposes.
• KYC Data (Identity Verification): Retained for 5 years after account closure in accordance with anti-money laundering (AML) regulations.
• Customer Communication Records: Retained for 2 years for customer service reference and dispute resolution.

When data is no longer needed and there is no legal obligation to retain it, cafe66 will securely delete or anonymise that data using methods that comply with industry information security standards.

If you have any questions, concerns, or wish to exercise your rights under the PDPA regarding cafe66's Privacy Policy, please do not hesitate to contact us. Our dedicated privacy team is ready to assist you in Bahasa Malaysia.

• Live Chat: Available on the cafe66 platform or app — response within 1 hour, 7 days a week including public holidays.
• Privacy Email: [email protected] — response within 24 hours.
• FAQ Page: Visit FAQ page for answers to common questions regarding privacy and account security.

Cafe66 reserves the right to update this Privacy Policy from time to time. Any significant changes will be communicated via in-platform notifications or your registered email at least 7 days before taking effect. Continued use of the cafe66 platform after changes take effect constitutes your acceptance of the updated policy.