Privacy Policy Ultra 66 – Our Commitment to Protecting Your Data

This Privacy Policy is issued by Ultra 66 ("we", "ultra 66" or "the platform") and applies to all users who access or use the ultra66.biz website, mobile application and all related services provided by ultra 66 in Malaysia.

We understand that the trust of Malaysian users is ultra 66's most valuable asset. That is why we take a transparent and responsible approach to every aspect of personal data processing. This policy explains exactly what data we collect, why we need it, who can access it and what your rights are as a user.

This document forms part of your overall agreement with ultra 66, together with Terms & Conditions and other policies published on our platform.

Ultra 66 collects several categories of information from users. Each category is collected for a clear and legitimate purpose:

Ultra 66 does not collect sensitive data such as health information, religious beliefs, political affiliations or biometric data unless explicitly stated and you have provided written consent.

Personal data collected by ultra 66 is used solely for the following legitimate purposes:

• Account Management: Creating and managing your user account, verifying your identity, and ensuring login security.
• Service Delivery: Enables you to use all features of the ultra 66 platform, including Sports Betting on football, badminton, cricket, poker, slots, Live Casino and lottery.
• Financial Processing: Processing deposits (Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u / CIMB Clicks) and withdrawals in Malaysian Ringgit (RM).
• Legal Compliance: Fulfilling legal obligations including anti-money laundering (AML) requirements, KYC, and reporting to Malaysian authorities where required.
• Platform Security: Detecting and preventing fraud, unauthorised access, collusion in poker games, and system abuse.
• Service Improvement: Analysing usage patterns in aggregate (not individually) to improve user experience and platform features.
• Service Communications: Sending important notifications related to your account, transactions, promotions you have subscribed to and policy updates.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and offer appropriate support.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), ultra 66 processes your personal data on one or more of the following legal bases:

• Consent: You have given explicit consent for specific data processing activities, such as marketing communications and the use of non-essential analytics cookies.
• Contract: Processing is necessary to fulfil the service contract between you and ultra 66 — including account management, bet processing and payments.
• Legal Obligation: Processing is required to comply with applicable Malaysian laws, including AML, tax, and regulatory reporting obligations.
• Legitimate Interests: Processing is in the legitimate business interests of ultra 66, such as fraud detection, platform security and service improvement, provided it does not override users' fundamental rights.

Ultra 66 does not sell users' personal data to any third party for marketing purposes. We only share data in the following limited and lawful circumstances:

• Service Providers: Companies that help us operate the platform — such as cloud infrastructure providers, gaming software providers, payment processors (Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, banks via FPX) and analytics service providers — are all bound by strict data protection agreements.
• Legal Authorities: When required by a court order, Malaysian law, or a relevant regulatory authority. ultra 66 discloses only the minimum data necessary to fulfil our legal obligations.
• Fraud Protection: With approved third-party fraud prevention service providers to protect the platform and all its users.
• Business Transfers: In the event of a merger, acquisition, or asset transfer involving ultra 66, user data may be transferred to a successor entity bound by the same data protection obligations.

In all instances of data sharing, ultra 66 ensures that recipients comply with data protection standards equivalent to or higher than those we apply ourselves.

Ultra 66 implements a range of technical and organisational security measures to protect users' personal data from unauthorised access, loss, alteration or disclosure:

• 256-bit SSL/TLS Encryption: All communications between your browser and the ultra 66 platform are encrypted using the latest SSL/TLS protocols.
• Static Data Encryption: Sensitive personal data is stored in databases encrypted using industry-standard encryption algorithms.
• Access Controls: Access to user data is restricted to staff with a legitimate business need only, with detailed access log monitoring in place.
• Two-Factor Authentication: ultra 66 internal systems containing sensitive data are protected with two-factor authentication for all staff.
• Regular Penetration Testing: The ultra 66 platform undergoes regular security testing by independent third-party cybersecurity experts.
• 24/7 Monitoring: Automated security monitoring systems operate around the clock to detect and respond to cyber threats.

Ultra 66 retains users' personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet applicable legal obligations. Our data retention policy is as follows:

• Active Account Data: Retained for as long as your ultra 66 account remains active.
• Financial Transaction Data: Retained for 7 years after each transaction in accordance with Malaysian accounting and tax legal requirements.
• KYC Data (Identity Verification): Retained for 5 years after account closure in accordance with Malaysia's AML legal requirements.
• Support Communication Logs: Retained for 2 years for reference and dispute resolution purposes.
• Technical Logs: Retained for 90 days, then automatically deleted.
• Account Closure Date: Upon account termination, data not required by law will be deleted within 90 days.

When data is no longer needed, ultra 66 deletes it securely using methods that ensure it cannot be recovered.

As an ultra 66 user, you have the following rights regarding your personal data under Malaysia's PDPA:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data ("right to be forgotten"), subject to our legal obligations.
• Right to Restrict Processing: You have the right to request restriction of the processing of your data under certain circumstances.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes.
• Right to Data Portability: You have the right to receive your personal data in a machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact the ultra 66 support team via live chat or email at support@ultra66.biz. We will respond within 14 business days of receiving your request.

Ultra 66 uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you visit our website.

We use four main types of cookies:

In certain circumstances, your personal data may be processed or stored on servers located outside Malaysia, for example where cloud infrastructure or international service providers are used. When this occurs, ultra 66 ensures:

• Transfers are made only to countries or entities that provide an adequate level of data protection
• Appropriate data transfer agreements are drawn up in accordance with applicable legal requirements
• Engaged service providers are bound by data protection obligations equivalent to Malaysian standards
• Only the minimum data necessary for the relevant service is transferred

The ultra 66 platform is intended solely for individuals aged 18 and above. We do not knowingly collect or process personal data of children under the age of 18.

Should we confirm that personal data of a child has been collected without the knowledge or consent of a parent or legal guardian, we will promptly take steps to delete that data and close the account in question. If you believe we may have collected information from a child, please contact us immediately at support@ultra66.biz so that appropriate action can be taken without delay.

Ultra 66 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new technologies, or updated legal requirements. The effective date of the latest version is always stated at the top of this document.

For material amendments, ultra 66 will notify users via in-platform notifications or email at least 14 days before the changes take effect. Continued use of the platform after the effective date will be deemed acceptance of the amended Privacy Policy.

If you have any questions, concerns, or wish to exercise your data rights, please contact the ultra 66 Data Protection Officer:

• Email: support@ultra66.biz
• Live Chat: Available 24/7 in Bahasa Malaysia on the ultra 66 platform
• Response Time: We are committed to responding within 14 business days