spade66 Privacy Policy

1. Introduction and Data Controller Identity

spade66.win ("spade66," "we," "us," or "our") operates an international online gaming platform serving players in Malaysia and across Southeast Asia. This Privacy Policy ("Policy") describes how spade66 collects, uses, stores, discloses, and protects personal data submitted by users ("you," "Member") in connection with your use of the spade66 website at spade66.win and all associated platform services.

spade66 is the data controller for personal data processed under this Policy. By registering for an account or using the spade66 platform, you acknowledge that you have read and understood this Policy. Where spade66 relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

This Policy applies to data collected through the spade66 website, mobile browser interface, email communications, and live chat support channels. It does not apply to the data practices of third-party game studios or payment processors, whose own privacy policies govern their respective data processing activities.

2. Personal Data We Collect

spade66 collects the following categories of personal data from members and platform visitors:

spade66 does not knowingly collect sensitive personal data (such as health information, racial or ethnic origin, or political opinions) unless specifically required for responsible gaming assessment purposes and then only with your explicit consent.

3. How We Collect Your Personal Data

spade66 collects personal data through the following channels:

3.1 Direct Collection

Data you provide directly when you register a spade66 account, complete KYC verification, make a deposit or withdrawal, contact support, participate in a promotion, or update your account profile.

3.2 Automated Collection

Technical and usage data collected automatically when you visit spade66.win or use the platform, including through cookies, server logs, session tracking software, and device fingerprinting technologies. See Section 7 for details on cookies.

3.3 Third-Party Sources

Identity verification data from KYC service providers; fraud and financial crime screening data from anti-money laundering (AML) databases; payment processing data from our licensed payment service providers including Malaysian eWallet operators and banking channels; and geolocation data to ensure compliance with jurisdictional restrictions.

4. How We Use Your Personal Data

spade66 uses personal data for the following purposes:

• To create, maintain, and manage your spade66 member account.
• To verify your identity and age (21+ requirement) and conduct ongoing KYC and AML checks as required by our licensing obligations.
• To process deposits, withdrawals, and in-platform transactions via Malaysian payment channels.
• To provide, personalise, and improve the spade66 platform, game lobby, sportsbook, and customer support services.
• To detect, investigate, and prevent fraudulent transactions, collusion, bonus abuse, and other prohibited activities.
• To administer promotional offers and loyalty programme benefits where you are eligible and have not opted out.
• To send service-related communications, including transaction confirmations, security alerts, account notifications, and updates to these Terms or this Policy.
• To send marketing communications where you have consented, or where we have a legitimate interest and you have not opted out.
• To comply with legal obligations, including responding to lawful requests from regulatory authorities and law enforcement agencies.
• To support responsible gaming monitoring, including identification of patterns consistent with problem gambling, in accordance with our licensing obligations.

5. Legal Basis for Processing

spade66 processes your personal data on the following legal bases:

• Contractual necessity — processing required to deliver the services you have registered for, including account management, gaming access, and payment processing.
• Legal obligation — processing required to comply with applicable law, including KYC verification, AML reporting, and responsible gaming obligations under our international gaming licence.
• Legitimate interests — processing for fraud prevention, platform security, abuse detection, service improvement, and aggregate analytics, where our interests are not overridden by your fundamental rights.
• Consent — marketing communications and optional data processing activities where we have obtained your prior consent. You may withdraw consent at any time by updating your marketing preferences in account settings or by contacting support.

6. Disclosure and Sharing of Personal Data

spade66 does not sell or rent personal data. We may share personal data with the following categories of third parties:

6.1 Service Providers

Third-party vendors engaged by spade66 to provide platform infrastructure, KYC and identity verification services, payment processing (including Malaysian eWallet and banking channel providers), fraud prevention, customer support tools, and email delivery. These providers are contractually bound to process data only on spade66's instructions and in accordance with this Policy.

6.2 Game Studios and Content Providers

Licensed game studios integrated into the spade66 platform may receive limited gaming session data (such as a session token and stake amounts) necessary to deliver game content. These providers are required to maintain appropriate data protection standards consistent with their licensing obligations.

6.3 Regulatory and Law Enforcement Authorities

spade66 will disclose personal data to competent regulatory authorities, tax authorities, or law enforcement agencies where required to do so by applicable law or valid legal process, or where disclosure is necessary to protect the rights, property, or safety of spade66, its members, or others.

6.4 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of spade66's assets, personal data may be transferred to the successor entity, subject to the same protections described in this Policy.

7. Cookies and Tracking Technologies

spade66 uses cookies and similar tracking technologies on spade66.win to deliver and improve the platform experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function, including maintaining your login session and processing in-platform transactions. These cannot be disabled.
• Performance and analytics cookies: Collect aggregate data on how members use the platform to help spade66 improve functionality and content. No personally identifiable information is shared with analytics providers.
• Functional cookies: Remember your preferences such as language, game lobby layout, and notification settings to provide a personalised experience.
• Marketing cookies: Used to deliver relevant promotional messages within the spade66 platform based on your activity. We do not use third-party advertising networks on spade66.win.

You may manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of parts of the spade66 platform. Session cookies are deleted when you close your browser; persistent cookies remain for the period specified at the time of placement.

8. Data Retention

spade66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or regulatory reporting requirements. The following general retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, in accordance with AML and gaming licence retention obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years following the date of the relevant transaction, as required by financial record-keeping regulations applicable to licensed gaming operators.
• Communications data: Support communications retained for three (3) years for quality assurance, complaint management, and dispute resolution purposes.
• Marketing preference records: Retained for the duration of the membership and for two (2) years following account closure to evidence consent or opt-out status.
• Technical and log data: Server and access logs retained for twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

9. Security Measures

spade66 implements appropriate technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Our security measures include:

• Transmission of personal data via the spade66 platform encrypted using TLS 1.2 or higher (HTTPS throughout).
• Storage of personal data encrypted at rest using AES-256 encryption.
• Passwords stored in hashed, salted form using a cryptographically secure hashing algorithm. spade66 support staff cannot view your password.
• Two-factor authentication (2FA) available to all members and enforced for administrative access.
• Role-based access controls limiting staff access to personal data to only what is necessary for their specific function.
• Regular security assessments, penetration testing, and vulnerability management processes.
• Automated monitoring for unusual access patterns and potential fraud indicators.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights with respect to personal data held by spade66:

• Right of access: You may request a copy of the personal data spade66 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. You can update most account details directly from your account profile page.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction: You may request that spade66 restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data.
• Right to data portability: Where processing is based on consent or contract, you may request a machine-readable copy of personal data you have provided to spade66.
• Right to object: You may object to processing of your personal data based on legitimate interests, including for direct marketing purposes. All marketing emails include an unsubscribe link.
• Rights related to automated decision-making: spade66 does not make solely automated decisions that produce legal or similarly significant effects on members without human review being available upon request.

To exercise any of the above rights, contact spade66 support via live chat or email at [email protected]. spade66 will respond to verified requests within 30 calendar days. Identity verification will be required before disclosing or modifying any personal data.

11. Children and Minors

The spade66 platform is strictly intended for persons aged 21 years and above. spade66 does not knowingly collect personal data from persons under the age of 21. If spade66 discovers that a member account has been created by a person under 21, the account will be immediately closed, any funds returned, and the relevant personal data deleted in accordance with our data retention policy.

If you are a parent or guardian and have reason to believe that a person under 21 in your care has created a spade66 account or provided personal data to spade66, please contact support immediately so that we can take appropriate action.

12. Cross-Border Data Transfers

As an international platform, spade66 may transfer personal data to service providers and infrastructure located outside of Malaysia. Where such transfers occur, spade66 implements appropriate safeguards to ensure the protection of your personal data, including the use of standard contractual clauses, data processing agreements, and transfers only to jurisdictions that provide an adequate level of data protection.

Where technically and operationally feasible, spade66 prefers to process Malaysian member data using infrastructure with data residency within the Asian region to minimise cross-border transfer risk. Our KYC and payment service providers serving Malaysian members are selected in part based on their compliance with applicable data protection standards.

13. Changes to This Privacy Policy

spade66 reserves the right to update this Privacy Policy at any time. Where changes are material, we will notify registered members via the email address on file at least 14 days before the revised Policy takes effect. The "Last Updated" date at the top of this page indicates the date of the most recent revision.

We encourage you to review this Policy periodically. Your continued use of the spade66 platform after the effective date of a revised Policy constitutes your acceptance of those changes.

14. Contact and Data Subject Requests

For privacy-related enquiries, data subject access requests, complaints, or questions about this Privacy Policy, please contact the spade66 Data Protection team:

Email: [email protected]

spade66 will acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within 30 calendar days, or within such shorter period as may be required by applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

For account security concerns or suspected unauthorised access to your spade66 account, contact support immediately via live chat, which is available 24 hours a day, 7 days a week.