tab66 Privacy Policy

tab66 ("we", "us", "our", "tab66") operates the online gaming platform accessible at tab66.win, serving registered Members primarily based in Malaysia. As part of operating this platform, tab66 collects and processes personal data relating to Members and website visitors.

This Privacy Policy describes the types of personal data tab66 collects, the purposes for which that data is processed, the parties with whom it may be shared, and the rights available to individuals in relation to their personal data. This policy applies to all personal data collected through tab66.win and any associated digital services provided by tab66.

This Privacy Policy should be read in conjunction with the tab66 Terms & Conditions. Unless otherwise defined herein, capitalised terms have the meanings given to them in the Terms & Conditions.

tab66 acts as the data controller in respect of personal data collected through the tab66 platform. As data controller, tab66 determines the purposes and means of processing personal data collected from Members and visitors.

tab66 operates under an international gaming authority license and processes personal data in accordance with the data protection obligations imposed by that licensing framework, as well as applicable data protection laws and regulations.

For all data protection enquiries, Members and visitors may contact tab66 via the support contact details provided in Section 14 of this policy.

tab66 collects personal data in the following categories:

tab66 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, or health data, except where explicitly required by applicable licensing or AML regulations.

tab66 does not collect or store full payment card numbers. Card payment processing is handled by PCI-DSS compliant third-party payment processors.

tab66 processes personal data for the following purposes:

• Account management: To create, maintain, and administer your tab66 account, including login authentication and account security.
• Transaction processing: To process MYR deposits and withdrawals via Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, and other supported payment methods.
• Identity & age verification: To verify that Members are 21 years of age or older and to confirm the identity of individuals making withdrawals, as required under tab66's licensing obligations.
• Regulatory compliance: To comply with applicable Anti-Money Laundering (AML), Know Your Customer (KYC), and Counter-Terrorism Financing (CTF) obligations under tab66's international gaming authority license.
• Fraud prevention & security: To detect, investigate, and prevent fraudulent transactions, account takeovers, and other prohibited activities on the tab66 platform.
• Customer support: To respond to Member enquiries, resolve disputes, and maintain records of support interactions.
• Platform improvement: To analyse usage patterns, optimise game performance, test new features, and improve the overall tab66 member experience.
• Responsible gaming: To monitor gambling activity for signs of problem gambling behaviour and to administer self-exclusion and responsible gaming tools in accordance with licensing requirements.
• Marketing communications: Where you have consented, to send promotional offers, bonus notifications, and platform updates via email or other channels. You may withdraw marketing consent at any time.

tab66 processes personal data on the following legal bases:

• Contract performance: Processing necessary to perform the tab66 Member agreement (account creation, transaction processing, gameplay facilitation).
• Legal obligation: Processing required to comply with applicable AML, KYC, CTF, and licensing regulations.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by the rights of the data subject.
• Consent: Processing for direct marketing communications, where consent has been explicitly obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

tab66 does not sell personal data to unaffiliated third parties for their independent marketing or commercial purposes. Personal data may be shared with the following categories of third party, strictly as necessary to operate the tab66 platform and comply with legal obligations:

• Payment processors: Regulated payment service providers who process MYR transactions on behalf of tab66 (e.g., FPX operators, eWallet providers, card processing networks). These providers are PCI-DSS compliant and contractually bound to process data only as instructed by tab66.
• KYC & identity verification providers: Regulated third-party services used to verify Member identities and ages in compliance with licensing requirements.
• Fraud prevention services: Third-party fraud detection and AML screening providers used to identify and prevent prohibited activities on the platform.
• Game providers: Licensed game studios and live dealer platform providers who supply game content to tab66. Game providers may receive anonymised or pseudonymised session data necessary to deliver game functionality.
• Regulatory and licensing authorities: tab66's international gaming authority license may require disclosure of Member data to licensing regulators upon request.
• Law enforcement: tab66 will disclose personal data to law enforcement or other governmental authorities where required by applicable law or court order.
• Cloud & infrastructure providers: Hosting, storage, and security infrastructure providers who process data on behalf of tab66 under contractual data processing agreements.

All third-party processors engaged by tab66 are bound by contractual data processing obligations consistent with this Privacy Policy and applicable data protection law.

tab66 uses cookies and similar tracking technologies on the tab66.win website. Cookies are small data files stored on your device that help tab66 deliver a functional, secure, and personalised platform experience.

tab66 uses the following categories of cookies:

• Strictly necessary cookies: Essential for platform functionality — login session management, security tokens, and basic navigation. These cannot be disabled without impairing core platform functions.
• Performance & analytics cookies: Used to measure platform usage, identify error patterns, and understand how Members navigate tab66. Data is collected in aggregated or pseudonymised form.
• Functional cookies: Used to remember your preferences, language settings, and customisation choices across sessions.
• Fraud prevention cookies: Used in conjunction with fraud detection systems to identify suspicious login or transaction patterns.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the tab66 platform normally.

tab66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations.

Specifically:

• Account and transaction data is retained for a minimum of five (5) years following account closure, as required by applicable AML and gaming regulatory frameworks.
• KYC documentation is retained in accordance with the requirements of tab66's licensing authority, typically for a minimum of five (5) years.
• Marketing preference records are retained for as long as necessary to evidence consent and comply with applicable communications regulations.
• Technical and usage data may be retained in anonymised or aggregated form beyond these periods for statistical and platform improvement purposes.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with tab66's data disposal procedures.

tab66 implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data processed. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between Member devices and the tab66 platform;
• Encryption of stored sensitive data, including passwords (bcrypt hashing) and KYC documents;
• Access controls limiting internal access to personal data to authorised personnel with a legitimate business need;
• Regular security assessments and penetration testing;
• PCI-DSS compliant payment data handling through certified processors;
• Incident response procedures for data breach detection, investigation, and notification.

While tab66 takes all reasonable steps to protect Member data, no online system can guarantee absolute security. Members are responsible for maintaining the security of their account credentials and should report any suspected unauthorised access to tab66 support immediately.

Subject to applicable data protection law and regulatory constraints, Members and visitors have the following rights in relation to their personal data held by tab66:

• Right of access: To request a copy of the personal data tab66 holds about you.
• Right to rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure: To request deletion of personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to restriction: To request that tab66 restrict processing of your personal data in certain circumstances.
• Right to data portability: To receive your personal data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object: To object to processing based on legitimate interests, including direct marketing processing.
• Right to withdraw consent: To withdraw consent for marketing communications at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact tab66 via the support details in Section 14. tab66 will respond to valid requests within a reasonable timeframe, and in any event within 30 days. tab66 may request identity verification before processing data access or erasure requests.

Please note that certain rights may be limited where tab66 is required to retain data to comply with regulatory, legal, or licensing obligations — for example, AML record-keeping requirements will take precedence over erasure requests for transaction data within mandatory retention periods.

If you believe that a minor has registered an account on tab66, please contact our support team immediately so we can take appropriate action.

As an internationally licensed gaming platform, tab66 may transfer personal data to third-party service providers located outside Malaysia, including to countries where data protection laws may differ from those in Malaysia. Such transfers occur only where:

• The receiving country provides an adequate level of data protection as determined by applicable regulatory frameworks;
• Appropriate contractual safeguards (such as standard contractual clauses) are in place between tab66 and the receiving entity; or
• The transfer is necessary for the performance of the Member agreement or compliance with legal obligations.

Where personal data is transferred internationally, tab66 takes all reasonable steps to ensure that such data receives a level of protection consistent with this Privacy Policy.

tab66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform services. When material changes are made, tab66 will notify Members via email to the registered account address and/or by publishing a prominent notice on the Platform.

The updated Privacy Policy will take effect from the date stated at the top of the document. Continued use of the tab66 platform following the effective date of an updated policy constitutes acceptance of the revised terms. We encourage Members to review this Privacy Policy periodically.

For all privacy-related enquiries, data subject access requests, or complaints regarding tab66's data processing practices, please contact our support team: