ong66 Privacy Policy

Introduction

This Privacy Policy ("Policy") explains how ong66 ("ong66," "we," "our," "us") collects, uses, discloses, retains, and protects personal data in connection with the ong66 online gaming platform at ong66.asia ("Platform"). It applies to all persons who register an account, use any ong66 product or service, or interact with the Platform in any capacity.

ong66 is committed to handling personal data responsibly, in accordance with applicable data protection legislation and in fulfilment of the obligations imposed under its international gaming licence — including Anti-Money Laundering (AML) and Know Your Customer (KYC) regulatory requirements. By using the ong66 Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside the ong66 Terms & Conditions, which govern your use of the Platform generally. Defined terms used but not defined in this Policy have the meanings given to them in the Terms & Conditions.

Data Controller

For the purposes of applicable data protection law, ong66 is the data controller in respect of personal data collected through the Platform. As data controller, ong66 determines the purposes and means by which personal data is processed.

Data We Collect

ong66 collects personal data through your interactions with the Platform. The categories of data collected, and the context in which they are collected, are set out in the table below.

Where ong66 is required to collect personal data to fulfil its legal and regulatory obligations (such as KYC identity verification), failure to provide the required data will prevent ong66 from opening or maintaining your account or processing withdrawal requests.

How We Use Your Data

ong66 processes personal data for the following purposes:

• Account management: Creating, maintaining, and administering your ong66 account, including authentication and access control;
• Service delivery: Enabling participation in all ong66 products including Live Casino, Sportsbook, and Slots;
• Financial processing: Processing deposits and withdrawals via Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank; verifying payment method ownership;
• KYC and identity verification: Verifying your identity and age (21+) as required under our international gaming licence;
• AML compliance: Monitoring account and transaction activity for indicators of money laundering or terrorist financing as required by applicable law and our licence conditions;
• Responsible gaming: Monitoring gaming patterns to support responsible gaming tools and to identify accounts that may require intervention in accordance with our licence obligations;
• Fraud and security: Detecting, investigating, and preventing fraudulent activity, cheating, bonus abuse, and account security breaches;
• Customer support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions;
• Marketing communications: Sending promotional offers and updates where you have opted in to receive such communications — you may opt out at any time;
• Legal obligations: Complying with applicable laws, regulatory requirements, court orders, and requests from competent authorities.

ong66 does not use personal data for automated decision-making that produces legal or similarly significant effects on you without human review, except where required by AML monitoring systems, in which case you have the right to request human review of any decision.

Legal Basis for Processing

Where data protection law requires a legal basis for the processing of personal data, ong66 relies on the following bases:

• Performance of contract: Processing necessary to provide the ong66 service under the Terms & Conditions you accepted at registration (account management, deposits, withdrawals, gameplay);
• Legal obligation: Processing required to comply with AML legislation, KYC requirements, and obligations under our international gaming licence (identity verification, transaction monitoring, record-keeping);
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring where such interests are not overridden by your data protection rights;
• Consent: Marketing communications where you have opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Sharing Your Data

ong66 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following circumstances and only to the extent necessary for each purpose:

• Payment processors: To facilitate deposits and withdrawals via Touch 'n Go, Boost, Maybank, CIMB, and Public Bank. Each processor operates under its own privacy policy and applicable financial services regulation;
• KYC and identity verification providers: To verify identity documents and addresses as required by our licence. These providers are contractually bound to process data only for the purpose of identity verification;
• Gaming software providers: Game outcome data is shared with RNG-certified software providers to the extent necessary to deliver and audit game results;
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or the conditions of our international gaming licence — including mandatory reporting obligations under AML regulations;
• Professional advisers: Legal counsel, auditors, and compliance consultants under obligations of professional confidentiality;
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the ong66 business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

Cookies & Tracking Technologies

ong66 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit the Platform. They are used for the following purposes:

• Strictly necessary cookies: Required for the Platform to function, including session management, authentication, and security features. These cannot be disabled without breaking Platform functionality;
• Functional cookies: Remembering your language preference, login state, and display settings to improve your experience on subsequent visits;
• Analytics cookies: Collecting anonymised data about how players interact with the Platform to identify technical issues and improve product areas. Data from analytics cookies does not identify you individually;
• Security cookies: Supporting fraud detection, bot prevention, and brute-force login protection mechanisms.

ong66 does not use third-party advertising cookies or share tracking data with advertising networks. You may manage or delete cookies through your browser settings; however, disabling strictly necessary cookies will impair Platform functionality including the ong66 login process.

Data Security

ong66 implements technical and organisational security measures appropriate to the nature of the personal data processed and the risks involved. Key measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your device and ong66 servers — visible as HTTPS in your browser;
• AES-256 encryption for personal and financial data stored at rest in ong66 databases;
• Role-based access controls ensuring that ong66 staff can only access personal data that is necessary for their specific job function;
• Multi-factor authentication for all ong66 staff accessing production systems containing personal data;
• Regular penetration testing and vulnerability assessments by accredited third-party security firms;
• Documented incident response procedures with notification timelines compliant with applicable regulatory requirements.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. ong66 will notify affected account holders promptly in the event of a personal data breach that is likely to result in a high risk to your rights and freedoms.

Data Retention

ong66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, taking into account our legal and regulatory obligations. The following retention periods apply as a general guide:

• Account data: Retained for the duration of your active ong66 account plus a minimum of 7 years following account closure, in accordance with AML record-keeping requirements under our gaming licence;
• Transaction records: Retained for a minimum of 7 years from the date of each transaction for AML and audit purposes;
• KYC documents: Retained for 7 years from the date of verification or account closure, whichever is later;
• Support communications: Retained for 3 years from the date of the interaction;
• Marketing preferences: Retained until you withdraw consent or for 2 years following your last active login, whichever is earlier.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with ong66's data destruction policy.

Your Rights

Subject to applicable data protection law and the limitations imposed by our regulatory obligations, you have the following rights in relation to your personal data held by ong66:

• Right of access: To request a copy of the personal data ong66 holds about you;
• Right to rectification: To request correction of inaccurate or incomplete personal data;
• Right to erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal and regulatory retention obligations;
• Right to restriction: To request that ong66 restricts processing of your data in certain circumstances while a dispute or complaint is investigated;
• Right to data portability: To receive your personal data in a structured, commonly used, machine-readable format where processing is based on your consent or a contract;
• Right to object: To object to processing of your personal data for direct marketing purposes at any time, and to object to other processing based on legitimate interests grounds;
• Right to withdraw consent: Where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact ong66 at the address in Section 13. ong66 will respond within 30 days. We may require identity verification before processing your request.

Children's Privacy

The ong66 Platform is strictly intended for users who are 21 years of age or older. ong66 does not knowingly collect personal data from individuals under the age of 21. If ong66 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the account suspended immediately. If you believe that ong66 may have inadvertently collected data from a person under 21, please contact us immediately at the address in Section 13.

Changes to This Privacy Policy

ong66 reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to registered account holders via the email address on file at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the date of the most recent revision. Continued use of the ong66 Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ong66, please contact our Data Protection team. All data protection enquiries are handled confidentially and responded to within 5 business days.

If you are dissatisfied with ong66's response to a data protection concern, you have the right to lodge a complaint with the supervisory authority responsible for data protection in the jurisdiction applicable under our gaming licence, or with the data protection authority in your country of residence.