Privacy Policy

This Privacy Policy ("Policy") is published by toke66 ("toke66", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at toke66.cam (the "Platform"). This Policy describes how toke66 collects, uses, stores, discloses, and otherwise processes personal data relating to registered users and visitors to the Platform ("you", "User", "Player").

toke66 is committed to handling personal data responsibly and in accordance with applicable international data protection standards, including the principles of data minimisation, purpose limitation, storage limitation, accuracy, integrity, and confidentiality. While toke66 serves players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — this Policy applies to all users of the Platform regardless of location.

By registering an account on the Platform or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform immediately.

For the purposes of this Policy, the following terms have the meanings set out below:

toke66 collects personal data in the following categories, depending on how you interact with the Platform:

3.1 Registration Data

When you create an Account, we collect your full legal name, date of birth, residential address, email address, and Malaysian mobile phone number. This data is mandatory — without it, we cannot operate your Account.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and know-your-customer (KYC) obligations, we may collect copies of your Malaysian identity documents (MyKad, Driver's Licence, or Passport), proof of residential address (such as a utility bill or bank statement dated within the past three months), a selfie photograph of you holding your identity document, and evidence of payment method ownership.

3.3 Financial & Transaction Data

We collect records of all deposits, withdrawals, and gaming transactions conducted through your Account. This includes transaction amounts in MYR, payment method type (e.g., Touch 'n Go eWallet, Boost, DuitNow QR, Maybank FPX, CIMB, Public Bank, USDT TRC20), transaction timestamps, and reference numbers. We do not store full payment card numbers or e-wallet PINs — these are handled by our PCI DSS-compliant payment processing partners.

3.4 Usage & Technical Data

We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, session duration, pages visited, game titles accessed, and referring URL. This data is collected primarily through server logs and first-party analytics tools.

3.5 Communications Data

Where you contact toke66 via live chat, email at [email protected], or any other communication channel, we retain records of that correspondence including the content of your messages and any attachments, for the purpose of providing support, resolving disputes, and maintaining operational records.

3.6 Responsible Gambling Data

Where you use self-exclusion tools, deposit limit settings, or reality check features, we record the parameters you have set and the date on which they were activated. This data is used solely to enforce the restrictions you have requested and is treated with the highest level of sensitivity.

toke66 processes personal data on one or more of the following legal bases:

Personal data collected by toke66 is used exclusively for the following purposes:

• Account Management: Creating, maintaining, and securing your Account, including password resets, login notifications, and session management.
• Payment Processing: Executing deposits in MYR through your chosen payment method and processing withdrawal requests to your verified account or wallet.
• Identity Verification: Confirming your identity, age (21+), and residential address in accordance with our KYC obligations under our operating licence.
• Anti-Fraud & Security: Detecting and preventing unauthorised Account access, fraudulent transactions, money laundering activity, and the use of automated systems or bots.
• Customer Support: Responding to your support requests, resolving disputes, and maintaining records of communications for quality assurance purposes.
• Regulatory Compliance: Fulfilling our obligations to regulatory authorities, including the production of transaction records, suspicious activity reports, and player verification data as required.
• Responsible Gambling: Administering self-exclusion requests, deposit limits, and other player protection tools you have activated on your Account.
• Platform Analytics: Aggregated, anonymised analysis of usage patterns to improve the performance, stability, and feature set of the Platform.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may opt out at any time.

toke66 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may, however, share your data with the following categories of recipients where necessary and proportionate:

• Payment Service Providers: Your payment transaction data is shared with our Malaysian payment gateway partners — including processors handling Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX bank transfers (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency settlement providers — solely to execute the payment you have initiated.
• Identity Verification Services: KYC documents may be shared with regulated third-party identity verification providers engaged by toke66 to assist with AML and age verification compliance.
• Cloud Infrastructure Providers: Our servers and databases are operated on cloud infrastructure provided by industry-standard hosting partners. These providers act as Data Processors under written contractual terms that prohibit them from using your data for any purpose other than providing hosting services to toke66.
• Regulatory Authorities: We may disclose personal data to competent regulatory, law enforcement, or anti-financial crime authorities where we are legally required to do so, including but not limited to responses to valid court orders or regulatory investigations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of toke66's business assets, personal data may be transferred to the acquiring entity as part of that transaction, subject to this Policy continuing to apply or the successor entity adopting equivalent protections.

Where we engage third-party Data Processors, we require them to maintain adequate technical and organisational security measures and to process personal data only on our documented instructions.

toke66 may process or store personal data on servers located outside of Malaysia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to Malaysia, we implement appropriate safeguards, which may include:

• Standard contractual clauses or equivalent data transfer agreements with the receiving entity.
• Encryption of data in transit and at rest, such that the transferred data cannot be read or accessed by any party other than the intended recipient.
• Contractual restrictions limiting the receiving entity's use of transferred data to the purposes specified in the data processing agreement.

You may request details of the specific safeguards applied to any international transfer of your personal data by contacting us at the address set out in Section 14 of this Policy.

toke66 retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account any applicable legal or regulatory retention obligations. Our general retention schedule is as follows:

Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised, such that it can no longer be attributed to an identifiable individual.

toke66 implements technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL). Our Platform operates exclusively over HTTPS.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Personnel with access to sensitive data are subject to confidentiality obligations and undergo regular security training.
• Two-Factor Authentication: All toke66 accounts support two-factor authentication (2FA) to protect against unauthorised login. We strongly recommend that all players activate 2FA.
• Vulnerability Management: Our Platform undergoes regular security assessments and penetration testing. Known vulnerabilities are remediated in accordance with a documented patching schedule.
• Incident Response: toke66 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users as soon as practicable in accordance with applicable requirements.

toke66 uses cookies and similar technologies on the Platform for the following limited purposes:

toke66 does not place advertising or cross-site tracking cookies. You may manage or disable non-essential cookies through your browser's privacy settings; however, disabling strictly necessary cookies will impair your ability to use the Platform.

Subject to applicable law and any overriding legal obligations (such as our AML record-keeping requirements), you have the following rights in relation to your personal data held by toke66:

To exercise any of the above rights, please submit a written request to toke66 via the live chat function in your Account dashboard or by email at [email protected]. We will respond to all verified rights requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, and we will notify you accordingly.

The toke66 Platform is strictly intended for individuals aged 21 years and above. toke66 does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been submitted by or on behalf of an individual who does not meet this age threshold, we will immediately suspend the relevant Account, delete the personal data collected, and return any deposits made, subject to identity verification.

If you believe that a minor has registered an Account on toke66 or has submitted personal data to us, please notify us immediately at [email protected] so that we may investigate and take prompt corrective action.

Parents and guardians who share devices with family members are strongly encouraged to use parental control software to restrict access to gambling websites and to ensure that toke66 Account credentials are not accessible to minors.

toke66 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. The current version of this Policy, with its effective date, will always be published at toke66.cam/privacy-policy.

Where a proposed change to this Policy is material — that is, where it significantly affects the manner in which we use your personal data or the rights available to you — we will notify you by email to your registered address at least 14 calendar days before the change takes effect. For minor or administrative amendments, we may update the Policy without advance notice.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the amended terms. If you do not agree with the changes, you should close your Account and cease using the Platform before the effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy or toke66's data processing activities, you may contact us through the following channels:

• Live Chat Support: Available 24 hours a day, seven days a week, directly from your toke66 Account dashboard. This is the fastest channel for urgent data-related requests, including immediate marketing opt-out or self-exclusion requests.
• Email: [email protected] — please include your registered username, Account email address, and a clear description of your enquiry or request. For formal rights requests, please indicate in the subject line that your email is a "Data Subject Rights Request" or "Privacy Enquiry".

Where your query concerns a specific transaction, game outcome, or Account action, please include the relevant reference number or timestamp to help us locate the relevant records and respond efficiently.