duit668 Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") applies to duit668.org ("the Platform"), operated by duit668 ("we", "us", "our"). It describes our practices regarding the collection, use, disclosure, and safeguarding of personal data submitted by or collected from users ("you", "your") who access or register on the Platform.

1.2 duit668 operates in compliance with applicable data protection legislation and the requirements imposed by our international gaming authority licence. We take your privacy seriously and are committed to maintaining the confidentiality and security of your personal information at all times.

1.3 This Policy should be read in conjunction with the duit668 Terms & Conditions. Capitalised terms not defined herein carry the meanings given in the Terms & Conditions.

1.4 If you are accessing the Platform from Malaysia, your data is processed in accordance with this Policy and any applicable provisions of Malaysian personal data protection law including the Personal Data Protection Act 2010 (PDPA) to the extent it applies to online gaming operators serving Malaysian residents.

2. Personal Data We Collect

2.1 duit668 collects personal data in several ways: directly from you during registration and account use, automatically through your use of the Platform, and from third parties as part of our verification and compliance obligations.

2.1 Data Provided by You

• Full legal name, date of birth, and gender;
• Residential address, city, and postcode (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru);
• Email address and mobile phone number;
• Username and password (password stored in hashed form only);
• Government-issued identity documents submitted for KYC verification (MyKad, passport);
• Payment method details, including e-wallet account identifiers (Touch 'n Go, Boost, GrabPay) and bank account details (Maybank, CIMB, Public Bank, Hong Leong);
• Communications submitted via customer support channels.

2.2 Data Collected Automatically

• IP address and approximate geographic location;
• Device type, operating system, and browser version;
• Pages visited, session duration, and navigation paths on the Platform;
• Betting and gaming activity including wagers placed, games accessed, and transaction history;
• Cookie data and similar tracking technologies (see Section 6).

2.3 Data from Third Parties

• Identity verification data from KYC/AML service providers;
• Fraud risk signals from payment processors;
• Responsible gaming flags from self-exclusion registries where applicable.

3. How duit668 Uses Your Personal Data

3.1 duit668 processes your personal data for the following purposes:

4. Legal Basis for Processing

4.1 duit668 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the agreement between you and duit668, including account creation, game provision, and payment processing.
• Legal Obligation: Processing required to comply with KYC, AML, age verification, and other regulatory requirements imposed by our gaming licence.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics — where such interests are not overridden by your rights.
• Consent: Marketing communications and optional personalisation features, where you have given express consent. Consent may be withdrawn at any time.

5. Data Sharing & Disclosure

5.1 duit668 does not sell personal data to any third party. We may share data in the following limited circumstances:

• Service Providers: KYC/identity verification providers, payment processors (including local Malaysian e-wallet operators), IT infrastructure providers, and customer support platforms — all contractually bound to handle data only as instructed by duit668.
• Game Providers: Certified third-party game studios may receive session identifiers and bet data necessary to operate the games you play on duit668. These providers are contractually obligated to maintain data confidentiality.
• Regulatory & Legal Authorities: Where duit668 is legally required to disclose information to gaming regulators, financial intelligence units, law enforcement agencies, or courts.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, personal data may be transferred to a successor entity subject to equivalent data protection obligations.

5.2 Any data shared with third parties is limited to the minimum necessary for the stated purpose.

6. Cookies & Tracking Technologies

6.1 duit668 uses cookies and similar technologies (including local storage and session tokens) to operate and improve the Platform. Categories of cookies used include:

• Strictly Necessary: Required for login sessions, security tokens, and payment flow integrity. Cannot be disabled without impairing Platform functionality.
• Functional: Remember your preferences (language, session settings) across visits to duit668.
• Analytics: Aggregate, anonymised data on Platform usage to inform performance improvements. No personally identifiable data is transmitted to analytics providers.
• Marketing: Used to serve relevant promotional content to opted-in users. Active only with your consent.

6.2 You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the core duit668 Platform, though some convenience features may be affected.

7. Data Retention

7.1 duit668 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal and regulatory retention requirements.

7.2 Account data and transaction records are retained for a minimum of five (5) years following account closure, in accordance with AML and gaming regulatory obligations. This period may be extended where required by applicable law or ongoing investigations.

7.3 Marketing preference data is retained until you withdraw consent or close your account. Support communications are retained for a period of two (2) years.

7.4 Following the expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

8.1 duit668 implements technical and organisational security measures appropriate to the nature of the personal data processed. These include:

• 256-bit SSL/TLS encryption for all data in transit;
• Password hashing using industry-standard cryptographic algorithms;
• Two-factor authentication available for all player accounts;
• Role-based access controls limiting staff access to personal data;
• Regular security assessments and penetration testing;
• Secure data centres with physical access controls and intrusion detection systems.

8.2 While duit668 takes reasonable measures to protect your data, no transmission over the internet or electronic storage system is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

8.3 In the event of a data breach that poses a risk to your rights, duit668 will notify affected users in accordance with applicable data protection law notification requirements.

9. Your Data Rights

9.1 Subject to applicable law, you have the following rights regarding your personal data held by duit668:

• Right of Access: Request a copy of personal data duit668 holds about you;
• Right to Rectification: Request correction of inaccurate or incomplete data;
• Right to Erasure: Request deletion of your data, subject to legal retention obligations;
• Right to Restriction: Request that we limit processing of your data in certain circumstances;
• Right to Data Portability: Receive your data in a structured, machine-readable format;
• Right to Object: Object to processing based on legitimate interests, including direct marketing;
• Right to Withdraw Consent: Withdraw consent for marketing or optional processing at any time without affecting prior processing.

9.2 To exercise any of these rights, contact duit668 support through the channels listed in Section 13. We will respond within 30 days of receiving a verifiable request.

10. Children & Minors

10.1 The duit668 Platform is strictly for individuals aged 21 years or older. We do not knowingly collect personal data from anyone under the age of 21.

10.2 If duit668 discovers or is informed that an account has been registered by a person under 21, the account will be immediately suspended, all funds will be held pending investigation, and the personal data associated with the account will be handled in accordance with applicable child data protection requirements.

10.3 If you believe a minor is using or attempting to use the duit668 Platform, please contact our support team immediately.

11. Third-Party Links

11.1 The duit668 Platform may contain links to third-party game providers' interfaces and payment processor portals. These third parties operate under their own privacy policies, which duit668 does not control.

11.2 duit668 is not responsible for the privacy practices of third-party providers. We recommend reviewing the privacy policies of any third-party service you interact with through the Platform.

12. Changes to This Privacy Policy

12.1 duit668 may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational factors.

12.2 Material changes will be communicated to registered users via email or a prominent notice on the Platform at least seven (7) days before taking effect. The "Last Updated" date at the top of this Policy will be revised accordingly.

12.3 Your continued use of the Platform following any update constitutes acceptance of the revised Policy. If you do not agree to changes, you may close your account in accordance with the Terms & Conditions.

13. Contact Us

13.1 For all data protection enquiries, access requests, or complaints regarding duit668's handling of your personal data, please contact our Data & Privacy team through the customer support channels available on this Platform.

13.2 Our Malaysian support team operates daily from 8AM to 2AM (MYT). You may reach us at: [email protected]

13.3 We aim to acknowledge all data-related requests within 72 hours and provide a substantive response within 30 calendar days.