Privacy Policy a6tar –
Data Protection for Malaysian Players

a6tar is a sports betting and online casino platform that operates with a full commitment to protecting the privacy of Malaysian players. We understand that when you entrust us with your personal information — your name, phone number, payment details and usage data — you are placing significant trust in us, and we do not take that responsibility lightly.

This Privacy Policy applies to all services provided by a6tar, covering our website, mobile app, bonus programmes, Sports Betting features, Live Casino, and all communication channels between you and our team. This Policy is drawn up in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and industry best practices for data protection in the online gaming sector.

The primary goal of this Privacy Policy is to give you complete clarity on:

• Types of personal information we collect from you
• Why we collect this information and how it is used
• Who may receive or access your information
• Data retention periods and the security measures in place
• Your rights regarding your personal data and how to exercise them

a6tar collects several categories of personal data from you at various stages of platform use. Below is a full breakdown of the data we may collect:

A. Personal Identification Data

• Full name as stated on your Malaysian identity card (MyKad) or passport
• Identity card number (NRIC) or passport number
• Date of birth and gender
• Full residential address including city, state, and postcode in Malaysia
• Nationality

B. Contact Data

• Malaysian mobile number registered in your name
• Active email address

C. Account & Security Data

• Your chosen username
• Passwords stored as encrypted hashes — we do not store passwords in plain text
• Security questions and answers (where applicable)
• Login activity logs including date, time and IP address

D. Financial and Payment Data

• Account name and details required for your chosen payment methods, including Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX accounts (Maybank2u, CIMB Clicks)
• Deposit and withdrawal transaction history
• Betting history and match results
• Account balance and fund movements

E. Platform Usage Data

• Sports and betting markets you access (Malaysia Super League football, EPL, BWF badminton, IPL cricket, MPL Malaysia esports, and more)
• Session time and duration
• Platform features you use
• Your account settings and personal preferences

F. Technical Data

• IP address and geographic location derived from it
• Device type, operating system, and web browser version
• Unique device identifier
• Cookie data and similar tracking technologies

Your personal data is collected through several different channels and methods:

Information You Provide Directly: Most of the data we collect comes directly from you — during the account registration process, during identity verification (KYC), and when you contact our support team a6tar, when you complete an enquiry or feedback form, and when you update your account profile information.

Automatically Collected Information: When you use the platform a6tar, our systems automatically collect technical data including your IP address, device type, operating system, web browser used, and platform usage patterns. This data collection occurs each time you visit our platform, place a bet, or use any feature within your account.

Information from Third-Party Sources: In certain cases, a6tar may receive your personal data from legitimate third-party sources, including:

• Identity verification service providers we use for the KYC process
• Payment service providers such as Touch 'n Go, GrabPay, and FPX to verify transactions
• Fraud prevention and anti-money laundering agencies
• Malaysian government authorities where required by law

a6tar uses personal data collected solely for legitimate purposes directly related to the provision of our platform services. Below is a summary table of the purposes for which data is used:

A6tar will not use your personal data for any purpose not stated above without first obtaining your consent. If we intend to use your data for a new purpose that is materially different, we will notify you and, where required, seek fresh consent.

Marketing Communications: If you have agreed to receive marketing communications during registration or through your account settings, a6tar may send promotional emails or SMS notifications about new bonuses, special sporting events (such as the Thomas Cup or IPL finals), and platform updates. You can opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or updating your communication preferences in your account settings.

a6tar does not sell your personal data to any third party. However, in the course of operating the platform, we may need to share your personal data with the following categories of third parties under limited and controlled circumstances:

Technical and Operations Service Providers: Third parties that assist us in operating the a6tar platform, including cloud infrastructure providers, payment processing service providers (to facilitate transactions via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay and FPX), KYC verification software providers, customer support platform providers, and data analytics companies. All these service providers are bound by data protection agreements that prohibit them from using your data for their own purposes.

Malaysian Government Authorities: a6tar may be required to disclose certain personal data to Malaysian authorities when mandated by law, court order, or valid legal process. This includes, but is not limited to, fraud investigations, anti-money laundering inquiries, or where necessary to protect public safety.

Strategic Business Partners: In certain cases, a6tar may share aggregated or anonymised data with analytics or market research partners to understand general usage patterns. Any data shared in this context contains no personally identifiable information.

a6tar implementing comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The key measures we employ include:

• 256-bit SSL Encryption: All data transmitted between your device and a6tar's servers is protected by 256-bit SSL encryption, the highest industry standard.
• Stored Data Encryption: Sensitive data including passwords and financial information is stored in encrypted form in our database
• Access Controls: Access to your personal data within a6tar's internal systems is restricted to employees who require it to perform their duties, and all access is logged and monitored.
• Two-Factor Authentication: a6tar's internal systems require multi-factor authentication for all employee access to sensitive data
• 24/7 Security Monitoring: Our automated monitoring system is always active to detect any suspicious activity or attempted breaches.
• Regular Security Audits: a6tar conducts regular internal and external security audits to ensure our data protection infrastructure remains up to date

Data Retention Period: a6tar retains your personal data for as long as your account is active and for the period required after account closure to meet legal obligations, resolve any outstanding disputes, and maintain accounting records. In general:

• Financial transaction data is retained for a minimum of 7 years in accordance with Malaysian legal requirements
• Identity verification (KYC) data is retained for a minimum of 6 years following account closure
• Platform activity logs are retained for 2 years.
• Customer support communication records are retained for 3 years

Platform a6tar uses cookies and similar tracking technologies to enhance your experience, understand how the platform is used, and ensure the platform functions properly. The following are the types of cookies we use:

Essential Cookies (Required): These cookies are required for the a6tar platform to function properly. They enable core features such as page navigation, secure login session management, and transaction processing. These cookies cannot be disabled as they are critical to platform operation.

Performance and Analytics Cookies: These cookies help us understand how Malaysian players use the a6tar platform — which pages are visited most frequently, how long sessions last, and any technical issues that may arise. This information is used in aggregated form to improve the platform.

Functional Cookies: These cookies store your preferences such as interface language, display settings, and other personal configurations you have selected on the a6tar platform. Without them, you would need to update your preferences each time you visit.

Managing Cookie Settings: You can control and manage cookies through your web browser settings. Most browsers allow you to view, delete, or block cookies. Please note that disabling certain cookies may affect the functionality of the a6tar platform and your overall user experience.

In accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and industry best practices, you have the following rights regarding your personal data held by a6tar:

Right to Access: You have the right to request a copy of the personal data we hold about you. Data access requests can be submitted by emailing our privacy team. We will process your request within 21 business days.

Right to Rectification: If you become aware that your personal data held by a6tar is inaccurate or incomplete, you have the right to request a correction. For basic changes such as your phone number or email address, you can update these directly through your account settings.

Right to Withdraw Consent: Where we process your data based on your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

Right to Object to Processing: In certain circumstances, you have the right to object to the processing of your personal data carried out on the basis of a6tar's legitimate interests. We will give every objection careful consideration.

Right to Erasure: Under certain circumstances (for example, when data is no longer needed for its original purpose and there is no legal obligation to retain it), you may request the deletion of your personal data. Please note that some data may need to be retained to fulfil legal or contractual obligations.

In the course of operating the platform a6tar, some of your personal data may be processed or stored outside Malaysia by third-party service providers we engage. Such data transfers occur only when necessary and with appropriate safeguards in place.

A6tar ensures that any transfer of personal data outside Malaysia is subject to protections equivalent to those provided under Malaysian law. The safeguards we apply to international data transfers include:

• Ensuring that recipients of data outside Malaysia have data protection policies and practices that are equivalent to or stricter than our own
• Using standard data transfer agreements that bind recipients to the required protection standards
• Only engaging service providers that have undergone thorough security and privacy assessments

If you would like to know more about the countries that may receive your data and the safeguards that apply, please contact our privacy team through the channels listed in Section 13.

a6tar maintains a zero-tolerance policy against the use of our platform by individuals under the age of 18. This platform is not intended for children or minors, and we do not knowingly collect personal data from them.

All prospective members are required to confirm that they are 18 years of age or older at the point of registration. Our KYC process is designed to detect and prevent registration by underage individuals.

Should we discover that we have inadvertently collected personal data from individuals under 18 years of age, we will take immediate steps to:

• Immediate closure of the account in question
• Deleting all related personal data from our systems
• Returning any remaining funds in the account to the original payment method

Platform a6tar may contain links to third-party websites or services in certain contexts, such as links to online banking portals during FPX payment processing. These links are provided for your convenience and do not imply that a6tar endorses or is responsible for the content or privacy practices of those websites.

Once you leave the a6tar platform and access a third-party website, this Privacy Policy no longer applies. We encourage you to read the privacy policy of any third-party website before providing them with your personal information.

A6tar is not responsible for the privacy practices or content of any third-party websites you may access through links on our platform.

a6tar reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, evolving legal requirements, or improvements in how we protect your data.

When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page
• Displaying a prominent notice on the a6tar platform homepage
• Sending email notifications to all registered members if the changes involve a material change in how we use your data

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data. Your continued use of the a6tar platform after any amendments take effect constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns or complaints regarding the way a6tar handles your personal data, or if you wish to exercise any of your privacy rights, please contact us through the following channels:

• Privacy Email: support@a6tar.com (please include "Privacy Enquiry" or "Data Privacy Rights Request" in the email subject line)
• Live Chat: Available 24/7 via the chat icon on the a6tar platform — please indicate that you would like to discuss a data privacy matter

The a6tar team aims to respond to all written privacy enquiries within 7 business days. For more complex requests such as data access or data deletion requests, we may require up to 21 business days to fully process your request.

We take every privacy enquiry and complaint seriously and will work to resolve each issue in a fair and transparent manner. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.