Privacy Policy – ultra66

Effective Date: 1 January 2026

1. Introduction and Scope

This Privacy Policy ("Policy") describes how ultra66 ("ultra66", "we", "us", "our") collects, uses, stores, discloses and otherwise processes personal data relating to individuals ("you", "your") who register for or use the ultra66 online gaming platform accessible at ultra66.one ("Platform"). This Policy applies to all personal data collected through the Platform, our mobile applications, customer support channels, and any other services operated by ultra66.

By registering an account or using the ultra66 Platform, you acknowledge that you have read and understood this Policy. If you do not agree to the processing of your personal data as described herein, you should not create an account or use the Platform.

This Policy should be read together with the ultra66 Terms and Conditions, which are available at ultra66.one/terms-conditions and are incorporated by reference into this Policy.

2. Data Controller

ultra66 is the data controller responsible for the personal data collected through the Platform. For the purposes of Malaysia's Personal Data Protection Act 2010 (PDPA) and any other applicable data protection legislation, ultra66 is the entity that determines the purposes and means of processing your personal data.

If you have any questions or concerns regarding the processing of your personal data, you may contact the ultra66 Data Protection Team at: [email protected] (plain text — not a clickable link).

3. Personal Data We Collect

ultra66 collects the following categories of personal data:

3.1 Identity Data: Full legal name, date of birth, nationality, national identification number or passport number, and copies of identity documents submitted for KYC verification purposes.

3.2 Contact Data: Email address, mobile telephone number, and residential address (including city, state and postcode).

3.3 Financial Data: Bank account details, e-wallet account identifiers (such as Touch n Go eWallet or Boost account references), transaction history, deposit and withdrawal records, and payment card details where applicable.

3.4 Account Data: Username, encrypted password, account preferences, communication settings, responsible gaming tool settings (including deposit limits and self-exclusion status), and login history.

3.5 Usage Data: Information about how you use the Platform, including games played, bets placed, session duration, pages visited, features used, and interaction with promotions.

3.6 Technical Data: IP address, device identifiers, browser type and version, operating system, screen resolution, referring URLs, and geolocation data (where permitted and to the extent required for regulatory compliance).

3.7 Communications Data: Records of communications between you and ultra66, including live chat transcripts, email correspondence, and records of any complaints or disputes raised.

4. How We Collect Your Data

ultra66 collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Data collected automatically through the Platform via cookies, web beacons, server logs and similar technologies when you access and use the Platform.
• Third-party sources: Data received from identity verification service providers, payment processors, fraud prevention agencies, and our international gaming authority licensor in connection with compliance obligations.

5. Purposes and Legal Basis for Processing

ultra66 processes your personal data for the following purposes and on the following legal bases:

• Account management and service delivery — to register and manage your ultra66 account, process transactions, settle bets, and provide customer support. Legal basis: performance of a contract with you.
• Identity verification and regulatory compliance — to comply with Know Your Customer (KYC), anti-money-laundering (AML), and responsible gaming obligations under our international gaming authority licence. Legal basis: legal obligation and legitimate interests.
• Fraud prevention and security — to detect, investigate and prevent fraudulent activity, money laundering, underage gambling, and other prohibited conduct. Legal basis: legitimate interests and legal obligation.
• Platform improvement and analytics — to analyse usage patterns, improve Platform performance, and develop new features and services. Legal basis: legitimate interests.
• Marketing communications — to send you promotional offers, bonus notifications and news about ultra66 services where you have provided your consent or where we have a legitimate basis under applicable law. Legal basis: consent (where required) or legitimate interests.
• Legal proceedings — to exercise or defend legal rights and claims. Legal basis: legitimate interests and legal obligation.

6. Disclosure of Personal Data

ultra66 may disclose your personal data to the following categories of recipients:

• Service providers: Identity verification providers, payment processors (including Touch n Go, Boost, GrabPay, Maybank and other banking partners), IT infrastructure providers, customer support platforms, and analytics providers engaged by ultra66 to support the operation of the Platform. All service providers are required to process your data only in accordance with ultra66's instructions and are subject to appropriate data protection obligations.
• Regulatory authorities: Gaming regulators, financial intelligence units, and law enforcement agencies, where ultra66 is required to disclose personal data under its international gaming authority licence or by applicable law.
• Corporate group: ultra66 affiliates and group companies where necessary for the management of the business, subject to equivalent data protection standards.
• Business transfers: In the event of a merger, acquisition, or sale of assets involving ultra66, your personal data may be transferred to the acquiring entity as part of the business transfer, subject to equivalent privacy protections.

ultra66 does not sell, rent, or trade your personal data to third parties for their own independent marketing or commercial purposes.

7. International Data Transfers

ultra66's operations and service providers may be located in jurisdictions outside Malaysia. Where your personal data is transferred outside Malaysia, ultra66 will ensure that appropriate safeguards are in place to protect your data, including contractual protections equivalent to those required under the PDPA and our gaming licence obligations. By using the Platform, you consent to the transfer of your personal data to such jurisdictions as may be necessary for the delivery of the ultra66 service.

8. Data Retention

ultra66 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting and regulatory reporting requirements. In particular:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in accordance with anti-money-laundering regulations applicable to our gaming licence.
• KYC documents are retained for the period required by our gaming authority licensor, typically five (5) years from the date of verification.
• Marketing communications preferences and consent records are retained for the duration of your account and for a reasonable period thereafter.

When personal data is no longer required for the purposes stated above, it is securely deleted or anonymised.

9. Cookies and Tracking Technologies

ultra66 uses cookies, web beacons, pixel tags and similar tracking technologies on the Platform. Cookies are small data files stored on your device that help ultra66 recognise returning visitors, maintain session state (keeping you logged in), personalise your experience, and gather analytics about Platform usage.

The following types of cookies are used by ultra66:

• Strictly necessary cookies: Required for the Platform to function, including session management and security. These cannot be disabled.
• Analytics cookies: Used to collect aggregated data about how members use the Platform, enabling us to improve functionality and performance.
• Preference cookies: Used to remember your settings and preferences, such as language and display options.
• Marketing cookies: Used to deliver relevant promotional content. These are only set where you have provided consent.

You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform.

10. Security of Your Personal Data

ultra66 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• 256-bit SSL encryption for all data transmitted between your device and ultra66 servers;
• Encryption of stored sensitive personal data, including financial information;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security audits and penetration testing;
• Two-factor authentication for staff access to systems containing personal data.

While ultra66 takes data security seriously, no method of electronic transmission or storage is completely secure. You acknowledge this inherent risk and are encouraged to take your own precautions, including using a strong unique password and enabling 2FA on your ultra66 account.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ultra66:

• Right of access: You may request a copy of the personal data ultra66 holds about you.
• Right to correction: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to restrict processing: You may request that ultra66 restrict the processing of your personal data in certain circumstances.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object to marketing: You may opt out of receiving marketing communications at any time via your account settings.

To exercise any of these rights, please contact the ultra66 Data Protection Team at [email protected]. ultra66 will respond to your request within 30 days. ultra66 may need to verify your identity before processing your request.

12. Children and Minors

The ultra66 Platform is strictly for persons aged 21 years and over. ultra66 does not knowingly collect personal data from persons under the age of 21. If ultra66 discovers that personal data has been collected from a person under 21, that account will be immediately closed and all data deleted. If you believe that a person under 21 has registered an account on ultra66, please contact us immediately.

13. Changes to This Privacy Policy

ultra66 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations or the services we provide. Updated versions will be posted on the Platform with a revised effective date. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy. We recommend reviewing this Policy periodically.

14. Contact and Complaints

If you have any questions, concerns or complaints regarding this Privacy Policy or the way ultra66 handles your personal data, please contact us at [email protected]. Our Data Protection Team aims to respond to all privacy enquiries within 10 business days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.