Aa6 Privacy Policy — Malaysian Player Data Protection

Aa6 ("we", "Platform", or "aa6") operates at aa6.bio and is committed to protecting the privacy of every individual who uses our services. We understand that player trust is our most valuable asset, and protecting your personal data is not merely a legal obligation — it is a moral responsibility we take seriously.

This Privacy Policy is drafted in line with global best practices in data protection and tailored to meet the needs of Malaysian users. It details the types of data we collect, why we need it, how it is used, who it may be shared with, and your rights as the owner of that data.

We uphold the following core principles across all personal data practices: minimum collection (only collecting what is necessary), clear purpose (data used only for stated purposes), robust security (ongoing technical and organisational protections), and full transparency with players regarding our data practices.

Aa6 only collects data that is genuinely necessary to provide safe, legal, and quality betting services. Below are the categories of data we collect:

We do not collect sensitive data such as medical information, religious beliefs, political views, or biometric data unless explicitly required by applicable law.

Your personal data is collected through the following methods:

3.1 Account Registration

When you register an account at aa6, you are required to provide your full name, email address, phone number, and password. This information forms the basic profile of your account and is used to verify your identity and enable access to the platform.

3.2 KYC Process (Identity Verification)

Prior to your first withdrawal or upon reaching certain thresholds, you are required to complete the KYC process by uploading a copy of your identification document (MyKad or passport), a selfie holding that document, and proof of bank account ownership. These documents are used solely for identity verification and anti-money laundering (AML) compliance purposes.

3.3 Active Platform Usage

While you use the aa6 platform, our systems automatically record betting activity, financial transactions, login and logout events, and interactions with platform features. These records are necessary for security purposes, dispute resolution, and service improvement.

3.4 Automatic Technical Data

Your web browser or mobile app automatically sends certain technical information to our servers each time you access aa6 — including IP address, device type, operating system, and browser version. This data is used to detect unauthorised access attempts and optimise the user experience.

Personal data collected by aa6 is used for the following legitimate and transparent purposes:

• Account Management: Creating, verifying, and maintaining your player account, including password recovery and two-factor authentication (2FA).
• Transaction Processing: Processing deposits, withdrawals, and all financial transactions related to your account securely and efficiently.
• KYC and AML Compliance: Meeting legal obligations related to identity verification (Know Your Customer) and anti-money laundering (Anti-Money Laundering).
• Platform Security: Detecting and preventing fraud, unauthorised use, multiple account access, and other suspicious activity.
• Customer Support: Helping you resolve issues, answer enquiries, and settle disputes related to your account or transactions.
• Service Improvement: Analysing aggregated usage patterns to improve user experience, enhance the interface, and develop new features.
• Important Communications: Sending account-related notifications, security updates, policy changes, and other important information relevant to your use of the platform.
• Promotions (if opted in): Sending promotional offers, bonuses, and the latest game updates — only if you opt in, and cancellable at any time.

Aa6 does not sell, rent, or disclose your personal data to third parties for commercial marketing purposes. However, in certain limited and controlled situations, your data may be shared with the following parties:

5.1 Trusted Service Providers

Aa6 works with carefully selected third-party service providers to support platform operations — including payment processing providers (FPX, DuitNow, eWallet), cloud computing service providers, analytics providers, and customer support platforms. All these providers are subject to strict data protection agreements and are only permitted to use your data for the specific services rendered to aa6.

5.2 Legal Requirements

Aa6 may disclose your personal data to the relevant authorities when lawfully required by law, court order, directive from a regulatory body, or a law enforcement agency with valid jurisdiction. In such situations, aa6 will comply with the request to the extent required by law and will notify you if permitted to do so.

5.3 Protection of Legitimate Interests

If aa6 has strong grounds to believe that disclosing data is necessary to prevent fraud, protect the safety of other users, or defend the platform's legitimate interests in legal proceedings, the relevant data may be shared with the appropriate parties.

Aa6 continually invests in technical and organisational security infrastructure to ensure your personal data is always protected from unauthorised access, loss, alteration, or unintended disclosure.

6.1 Technical Security Measures

• 256-bit SSL/TLS Encryption: All data transmitted between your device and aa6 servers is encrypted using the latest SSL/TLS protocol, ensuring no third party can intercept or read your information while it is in transit.
• Stored Data Encryption: Sensitive data such as bank details, identity card numbers, and KYC documents are encrypted at rest in our database using AES-256 encryption standards.
• Two-Factor Authentication (2FA): aa6 supports 2FA for all player accounts as an additional layer of security against unauthorised access.
• Continuous Monitoring: Our 24/7 security monitoring system detects and blocks suspicious activity, intrusion attempts, and traffic anomalies in real time.
• Regular Security Testing: aa6 conducts regular penetration testing and security audits by independent experts to identify and address vulnerabilities before they can be exploited.

6.2 Internal Access Controls

Access to player personal data within the aa6 organisation is strictly limited based on the principle of least privilege. Only staff who genuinely require access to specific data to perform their duties are permitted to do so, and all access is recorded in an audit log.

Aa6 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Retention periods vary by data type:

• Active Account Data: Retained throughout the period your account is active and for a reasonable period after account closure for compliance and dispute resolution purposes.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date, in accordance with applicable accounting and financial legal requirements in Malaysia.
• KYC Documents: Retained for a minimum of 5 years after the business relationship ends, in accordance with AML/CFT legal requirements.
• Technical and Security Logs: Retained for 12 months for security investigation and technical troubleshooting purposes.
• Support Communication Data: Conversation records with the support team are retained for 3 years for quality assurance and dispute resolution purposes.
• Marketing Data (if applicable): Retained until you withdraw consent or request deletion, whichever comes first.

Once the retention period expires, your personal data will be securely deleted or anonymised so that it can no longer be personally associated with you.

As an aa6 player, you have the following rights regarding your personal data that we hold:

• Right of Access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to Rectification: If the data we hold is inaccurate or incomplete, you have the right to request an immediate correction.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data, subject to legal obligations that prevent such deletion.
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain situations, such as when you dispute the accuracy of the data.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: If data processing is based on your consent, you may withdraw that consent at any time without affecting the validity of any processing that took place prior to withdrawal.

The aa6 platform uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how players interact with our platform.

9.1 Types of Cookies Used

• Essential Cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how web pages are used to help us improve performance and user experience. All data is collected anonymously.
• Functional Cookies: Saving your preferences such as language, display settings, and other choices so you do not need to reconfigure them each time.
• Analytics Cookies: Used to analyse platform usage patterns in aggregate for service improvement purposes. Analytics data is not linked to your personal identity.

9.2 Managing Cookies

You can control and manage cookie settings through your web browser settings. Most modern browsers allow you to view, delete, or block cookies from specific websites. Please note that disabling essential cookies may affect the functionality of the aa6 platform.

The aa6 platform is strictly restricted to individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. Account registration requires date of birth verification, and our KYC process validates this information through accepted government-issued identification documents.

Should we discover that a child's personal data has been collected without knowledge or inadvertently, we will take immediate steps to delete that data and terminate the relevant account. Parents or guardians who believe their child may have registered an account at aa6 should contact us immediately at [email protected].

Aa6 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements in how we protect your information. We are committed to informing you of any significant changes.

Each time this Privacy Policy is updated, the "Updated" date shown at the top of this page will be changed to reflect the latest revision date. For changes that are material and significant, aa6 will send you a notification via email or an in-platform notice at least 14 days before those changes take effect.

Continued use of the aa6 platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, please stop using the platform and contact us to close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or how aa6 handles your personal data, please do not hesitate to reach our team through the following channels:

• Live Chat: Available 24/7 directly from the aa6 platform — the fastest way to get an immediate response.
• Email: [email protected] — we will respond within 24 business hours.

For data rights requests (access, correction, deletion), please clearly state the type of request and include sufficient information for us to verify your identity before processing. This is to ensure your data is only disclosed to you and not to any unauthorised party.