yes66 Privacy Policy

1. Introduction

yes66 ("yes66", "we", "us", "our") operates the online gaming platform available at yes66.app (the "Platform"). This Privacy Policy ("Policy") describes how yes66 collects, uses, stores, discloses, and protects personal data belonging to individuals who register as members, make enquiries, or otherwise interact with the Platform ("you", "your", "Member").

By registering a yes66 account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not use the Platform.

This Policy should be read in conjunction with yes66's Terms & Conditions, which govern the overall legal relationship between you and yes66.

2. Data Controller

yes66 acts as the data controller in respect of personal data collected through the Platform. As data controller, yes66 determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that such processing is conducted lawfully and transparently.

For all data protection enquiries, including data subject rights requests, you may contact yes66 using the details in Section 16.

3. Data We Collect

yes66 collects the following categories of personal data from Platform users:

Category	Examples	Purpose
Identity Data	Full name, date of birth, nationality, gender, NRIC / passport number	Account registration, age verification, KYC compliance
Contact Data	Email address, mobile phone number, residential address	Account management, customer support, regulatory notifications
Financial Data	Deposit / withdrawal transaction records, payment instrument identifiers (last 4 digits of card or e-wallet account reference), wallet balance history	Payment processing, fraud prevention, AML compliance
KYC Documentation	Copies of government-issued ID, proof of address documents, source of funds documentation	Identity verification, AML / regulatory compliance
Technical Data	IP address, device type, operating system, browser type, session timestamps, geolocation (country/region level)	Security, fraud detection, platform optimisation
Usage Data	Games played, Wagers placed, betting history, session duration, platform navigation patterns	Responsible gaming monitoring, personalisation, analytics
Communications Data	Customer support interaction records, chat transcripts, email correspondence	Support quality assurance, dispute resolution
Marketing Preferences	Promotional opt-in/opt-out status, communication channel preferences	Delivery of opted-in marketing communications

yes66 does not intentionally collect sensitive personal data (such as health information, racial or ethnic origin, political opinions, or biometric data) except where specifically required for responsible gaming assessments or by applicable regulatory obligations.

4. How We Collect Data

yes66 collects personal data through the following channels:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting Customer Support, or responding to promotional communications.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies (see Section 10).
• Third-party sources: Identity and fraud-check data from KYC verification service providers; payment confirmation data from payment processors; publicly available data used for AML screening purposes.

5. Legal Basis for Processing

yes66 processes personal data on the following legal bases:

• Contract performance: Processing necessary to fulfil yes66's obligations under the Terms & Conditions, including account management, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) regulations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where such interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications and the use of non-essential cookies, where you have provided express consent. Consent may be withdrawn at any time.

6. How We Use Your Data

yes66 uses the personal data it collects for the following purposes:

• Creating and managing your yes66 account;
• Verifying your identity and age in accordance with KYC requirements;
• Processing deposits, Wagers, and withdrawal requests;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activities;
• Providing and improving Customer Support services;
• Monitoring platform usage to identify responsible gaming concerns and deliver appropriate interventions;
• Personalising your Platform experience, including game recommendations and promotional offers relevant to your activity;
• Sending transactional communications (account alerts, withdrawal confirmations, security notifications) which are not subject to marketing opt-outs;
• Sending optional promotional and marketing communications where you have opted in;
• Conducting aggregate, anonymised analytics to improve Platform performance;
• Complying with legal, regulatory, and law enforcement obligations.

7. Sharing Your Data

yes66 does not sell, rent, or trade personal data to third parties. yes66 may share your personal data with the following categories of recipients solely to the extent necessary for the described purposes:

• Payment processors: Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, Hong Leong, and other payment service providers, for the processing of deposit and withdrawal transactions.
• KYC and identity verification providers: Third-party identity verification services that assist yes66 in fulfilling KYC obligations.
• Game content providers: Game studios and platform providers whose software is integrated into the yes66 Platform may receive session identifiers necessary to deliver game functionality.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory directive, yes66 will disclose personal data to competent authorities without notice to the affected Member where such notice would be unlawful or would prejudice the relevant investigation.
• Fraud prevention services: Industry fraud prevention and AML screening databases to which yes66 contributes and from which it queries, as part of its fraud prevention obligations.
• Professional advisers: Legal, accounting, audit, and compliance professionals engaged by yes66 where such engagement requires limited access to personal data.

All third-party data processors engaged by yes66 are contractually required to handle personal data in a manner consistent with this Policy and applicable data protection law.

8. International Data Transfers

yes66's Platform and data infrastructure may involve the transfer of personal data to servers or processors located outside Malaysia. Where personal data is transferred internationally, yes66 ensures that appropriate safeguards are in place — including standard contractual clauses or equivalent data transfer mechanisms — to ensure that your data receives a level of protection consistent with applicable standards.

9. Data Retention

yes66 retains personal data only for as long as necessary to fulfil the purposes described in this Policy or to comply with applicable legal and regulatory obligations. The following indicative retention periods apply:

• Active account data: Retained for the duration of your membership and for a minimum of five (5) years following account closure, to satisfy AML regulatory requirements.
• KYC documentation: Retained for a minimum of five (5) years following account closure, or longer where required by law.
• Transaction records: Retained for a minimum of seven (7) years to comply with applicable financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of last interaction, for dispute resolution and quality assurance purposes.
• Marketing preferences: Retained until you withdraw consent or request deletion, subject to minimum retention periods above.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

10. Cookies & Tracking Technologies

yes66 uses cookies and similar tracking technologies to operate and improve the Platform. The following types of cookies are deployed:

• Strictly necessary cookies: Essential for Platform functionality, including session management and yes66 login authentication. These cookies cannot be disabled without impacting Platform functionality.
• Performance cookies: Collect aggregate, anonymised information about how visitors use the Platform to help yes66 identify areas for improvement. No personally identifiable information is collected via performance cookies.
• Functional cookies: Remember your preferences (e.g., language settings, preferred game categories) to improve your Platform experience.
• Analytics cookies: Used by yes66's internal analytics systems to understand Platform usage patterns. Data collected is aggregated and anonymised.

You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of some Platform features.

11. Security Measures

yes66 implements a range of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure, including:

• TLS 1.3 with 256-bit AES encryption on all data in transit;
• Encryption of sensitive data fields at rest in yes66's database infrastructure;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments of Platform infrastructure;
• Multi-factor authentication requirements for yes66 staff accessing production systems;
• Documented incident response procedures for data breach scenarios.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed as completely secure. If you have reason to believe that your interaction with yes66 is no longer secure, please contact Customer Support immediately.

12. Your Rights

Subject to applicable law, you have the following rights in respect of your personal data held by yes66:

• Right of access: You may request a copy of the personal data yes66 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data in certain circumstances, subject to yes66's legal obligations to retain certain records.
• Right to restriction: You may request that yes66 restrict its processing of your personal data in certain circumstances while a query or dispute is being resolved.
• Right to data portability: Where processing is based on consent or contract performance, you may request a machine-readable copy of personal data you have provided to yes66.
• Right to object: You may object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact yes66 at [email protected]. Requests will be acknowledged within 48 hours and addressed within thirty (30) calendar days. yes66 may ask you to verify your identity before processing a data subject rights request.

13. Children's Privacy

yes66 does not knowingly collect personal data from individuals under the age of 21. The Platform is strictly intended for adults. If yes66 becomes aware that personal data has been collected from an individual under this age limit without appropriate verification, it will take immediate steps to delete the relevant data and close the associated account. If you believe a minor has registered on the Platform, please contact [email protected].

14. Marketing Communications

yes66 may send you promotional emails, SMS messages, or in-Platform notifications about bonuses, new games, and events where you have opted in to receive such communications at the time of registration or subsequently through your Account Settings.

You may opt out of marketing communications at any time by: (a) clicking the unsubscribe link included in any marketing email from yes66; or (b) updating your communication preferences in your Account Settings. Opting out of marketing communications does not affect transactional communications related to your account (e.g., deposit confirmations, security alerts, withdrawal status notifications).

15. Changes to This Policy

yes66 may update this Privacy Policy from time to time to reflect changes in our data handling practices, legal obligations, or Platform features. Where changes are material, yes66 will provide advance notice to registered Members via email to the registered address on their yes66 account. The updated Policy will be published at yes66.app/privacy-policy with a revised effective date.

Your continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should cease using the Platform and close your yes66 account.

16. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or yes66's data handling practices, please contact:

• General & Data Enquiries: [email protected]
• Customer Support (24/7): [email protected]
• Responsible Gaming: [email protected]

yes66 will acknowledge all written privacy enquiries within 48 hours and aims to provide a substantive response within 30 calendar days. Complex requests involving large volumes of data or requiring third-party consultation may take up to 60 days, in which case yes66 will notify you of the extended timeline.