Privacy Policy

This Privacy Policy ("Policy") is published by touchngo66 ("the Company", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://touchngo66.cam ("the Platform"). It describes how we collect, use, store, share, and protect personal data relating to users who access or use our Services ("you", "User", "Player").

touchngo66 is committed to handling personal data responsibly and in compliance with applicable data protection laws and international standards governing the processing of personal information in the online gambling industry.

By registering an Account, depositing funds, or otherwise using the Platform, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal data as described herein. This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" means touchngo66, which determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of touchngo66 pursuant to a written agreement.
• "KYC Data" means identity and address verification documents collected as part of Know Your Customer procedures.
• "Cookies" means small text files stored on your device by the Platform for the purpose of maintaining session state, preferences, and analytics.
• "Services" means all products and features available through the touchngo66 Platform, including sports betting, live casino, slots, and account management.
• "Third-Party Service Providers" means payment processors, identity verification services, customer support platforms, and other vendors engaged by touchngo66 to support the delivery of Services.

touchngo66 collects Personal Data in the following categories:

3.1 Registration Data

When you create an Account, we collect: full legal name, date of birth, email address, mobile phone number, and chosen username and password (stored in hashed form).

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) and player protection obligations, we may collect: copies of government-issued identification documents (MyKad, Passport, Driver's Licence), proof of address (utility bill or bank statement dated within 3 months), selfie images for liveness verification, and payment method verification documents.

3.3 Financial Data

Transaction records including deposit amounts, withdrawal requests, payment method details (partial card or account numbers — full payment credentials are handled by our PCI-DSS compliant payment processors and are not stored by touchngo66 directly), and currency amounts in MYR or cryptocurrency equivalents.

3.4 Gameplay and Betting Data

Records of bets placed, games played, wagering amounts, winnings, bonuses claimed, and session durations. This data is used for regulatory compliance, responsible gambling monitoring, and personalisation of your experience.

3.5 Technical and Device Data

IP address, device type and model, operating system, browser type and version, time zone, language settings, and Platform usage logs including pages visited, features used, and clickstream data.

3.6 Communications Data

Records of your communications with our customer support team, including live chat transcripts, email correspondence, and any feedback or complaints submitted.

We collect Personal Data through the following channels:

• Directly from you — when you register an Account, complete KYC verification, make deposits or withdrawals, contact customer support, participate in promotions, or submit feedback.
• Automatically via the Platform — through cookies, web beacons, server logs, and similar tracking technologies that record technical and behavioural data as you interact with the Platform.
• From Third-Party Service Providers — identity verification agencies, payment processors (including Touch 'n Go eWallet, DuitNow, FPX operators, and cryptocurrency exchange services), and fraud detection partners may provide us with data relevant to the provision of Services.
• From publicly available sources — where necessary for fraud prevention, AML screening, or compliance with regulatory obligations, we may supplement our data with information from public registers, sanctions lists, or adverse media databases.

touchngo66 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to at registration — including account management, payment processing, and delivery of Services.
• Legal Obligation: Processing required to comply with applicable laws including KYC/AML regulations, responsible gambling obligations, tax reporting requirements, and regulatory record-keeping mandates.
• Legitimate Interests: Processing necessary for fraud prevention, network and information security, customer support quality assurance, and improving the Platform — where such interests are not overridden by your privacy rights.
• Consent: Where we rely on consent as a legal basis (e.g., for optional marketing communications), you may withdraw that consent at any time by contacting support or updating your account preferences.

We use your Personal Data for the following purposes:

1. Account Administration: Creating, maintaining, and securing your Account; processing login requests; managing password resets and account settings.
2. Identity Verification: Conducting KYC checks to verify your identity, age (21+), and eligibility to use the Platform in compliance with regulatory requirements.
3. Payment Processing: Facilitating deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels; processing withdrawal requests to verified accounts.
4. Fraud and AML Prevention: Detecting and preventing fraudulent activity, money laundering, unauthorised account access, and other financial crimes.
5. Responsible Gambling: Monitoring gameplay patterns to identify potential problem gambling behaviour and to apply player protection measures in accordance with our Responsible Gambling obligations.
6. Customer Support: Responding to enquiries, resolving disputes, and providing technical assistance.
7. Service Improvement: Analysing usage patterns, conducting research, and improving Platform features, game selection, and user experience.
8. Marketing Communications: Sending promotional offers, bonus notifications, and service updates to users who have opted in. You may opt out at any time.
9. Legal and Regulatory Compliance: Meeting our obligations under applicable gambling licences, financial regulations, and data protection laws; responding to lawful requests from regulatory authorities and law enforcement.

touchngo66 does not sell your Personal Data. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

7.1 Payment Processors

Authorised payment service providers including Touch 'n Go eWallet, DuitNow operators, FPX banking partners, and cryptocurrency exchange services receive the transaction data necessary to execute deposits and withdrawals. These providers are contractually obligated to protect your data and may not use it for independent commercial purposes.

7.2 Identity Verification Providers

Third-party KYC and AML service providers receive document images and verification data necessary to complete identity checks. All such providers are subject to appropriate data processing agreements.

7.3 Technology and Infrastructure Partners

Cloud hosting providers, content delivery networks, and Platform infrastructure vendors may process technical and operational data on our behalf. These processors operate under strict data processing agreements and are not permitted to use your data for their own purposes.

7.4 Regulatory Authorities and Law Enforcement

Where required by applicable law, court order, or regulatory directive, touchngo66 may disclose Personal Data to relevant authorities, including gambling regulators, financial intelligence units, and law enforcement agencies.

7.5 Corporate Transactions

In the event of a merger, acquisition, or sale of assets, Personal Data may be transferred to the relevant successor entity subject to equivalent privacy protections being maintained.

touchngo66 uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are described below:

You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will impair or prevent access to the Platform. touchngo66 does not use cookies for third-party advertising or behavioural profiling for external marketing purposes.

touchngo66 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and Registration Data: Retained for the duration of the account relationship plus a minimum of five (5) years following account closure, to satisfy AML record-keeping obligations.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable regulatory obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years to comply with financial regulation requirements.
• Customer Support Records: Retained for three (3) years from the date of the relevant interaction.
• Marketing Preferences: Retained until consent is withdrawn, plus a short period necessary to process opt-out requests.
• Technical and Log Data: Typically retained for twelve (12) months for security monitoring and then deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted or rendered permanently anonymous in accordance with recognised data destruction standards.

touchngo66 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption on all data transmissions between your device and our servers.
• Encrypted data storage for sensitive Personal Data and KYC documents at rest.
• Two-Factor Authentication (2FA) available to all account holders.
• Role-based access controls restricting staff access to Personal Data on a strict need-to-know basis.
• Regular security assessments including penetration testing and vulnerability scanning.
• Incident response procedures ensuring prompt detection, containment, and notification in the event of a security breach.

While we apply industry-standard security practices, no system is entirely immune to risk. You are responsible for maintaining the security of your own login credentials and for notifying us immediately if you suspect your account has been compromised. touchngo66 will never ask for your full password, banking PIN, or one-time passwords (OTPs) via email, live chat, or any other channel.

Subject to applicable law and certain exceptions, you have the following rights in relation to your Personal Data held by touchngo66:

To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 days. We may need to verify your identity before processing the request. Requests that are manifestly unfounded or excessive may be subject to a reasonable administrative fee or may be declined, with reasons provided.

The touchngo66 Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect Personal Data from anyone under the age of 21. Age verification is conducted as part of the KYC process, and accounts belonging to persons below the minimum age threshold will be closed immediately upon discovery.

If you have reason to believe that a person under 21 has registered on our Platform, please notify us immediately at [email protected] and we will take prompt action to investigate and close the account. Any deposits made by underage users will be returned to the originating payment method.

In order to deliver our Services, Personal Data may be processed in countries outside of Malaysia. Where such international transfers occur, touchngo66 ensures that appropriate safeguards are in place — including contractual data transfer mechanisms, binding corporate rules, or transfers to jurisdictions recognised as providing adequate levels of data protection.

Specifically, where we engage Third-Party Service Providers located outside Malaysia — such as cloud infrastructure providers or identity verification agencies — we require those providers to operate under data processing agreements that impose equivalent privacy protections to those described in this Policy.

touchngo66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal obligations, or the Services we offer. When we make material changes, we will notify registered users by email or via a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page indicates the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendments constitutes your acceptance of the revised Policy.

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by touchngo66, please contact our Data Protection team using the details below:

For responsible gambling-related concerns, including self-exclusion requests and deposit limit settings, please visit our Responsible Gambling page.