Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by rebate66 ("we", "us", "our", "the Operator") and governs the collection, use, storage, sharing, and protection of personal data belonging to users ("you", "User", "Player", "Member") of the rebate66 online gaming platform accessible at rebate66.cam.

rebate66 operates an online casino and sports betting service targeted at Malaysian players, processing transactions in Malaysian Ringgit (MYR) and supporting local payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks such as Maybank, CIMB, Public Bank, and Hong Leong Bank. Our player base spans across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam.

By registering an account on rebate66, making a deposit, or using any part of our service, you acknowledge that you have read and understood this Privacy Policy and you consent to the processing of your personal data as described herein. This Policy is to be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the complete agreement governing your use of the rebate66 platform.

If you do not agree with any part of this Privacy Policy, you should not register an account or use the rebate66 Platform.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

3 Data We Collect

rebate66 collects personal data across several categories depending on the nature of your interaction with our Platform. The categories are described below:

Personal IdentifiersFinancialTechnicalBehavioural

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used for mandatory 21+ age verification).
• Email address and Malaysian mobile phone number.
• Chosen username and encrypted password.
• Country and city of residence (e.g., Kuala Lumpur, Petaling Jaya, Penang).

3.2 Identity Verification (KYC) Data

• Scan or photograph of a valid Malaysian government-issued photo ID: MyKad (NRIC), Driver's Licence, or Passport.
• Proof of address document: utility bill, bank statement, or official correspondence issued within the last three months.
• Selfie or live photograph taken while holding your identification document.
• Proof of payment method ownership (e.g., e-wallet screenshot, bank account statement).

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts, timestamps, and method details (e-wallet, bank, or cryptocurrency).
• Payment method identifiers (e.g., partial account number, e-wallet registered phone number) used for transaction matching and fraud prevention.
• Transaction history, including all wagering activity, bonus credits, and balance movements.
• Cryptocurrency wallet addresses used for USDT TRC20 or BTC transactions.

3.4 Technical & Device Data

• IP address and approximate geographic location derived from IP data.
• Device type, operating system, and browser information.
• Session duration, login timestamps, and access logs.
• Cookie identifiers and similar tracking technologies as described in Section 7.

3.5 Behavioural & Gaming Activity Data

• Games played, bet amounts, game session durations, and wagering patterns.
• Sports betting selections, live betting activity (e.g., EPL, Liga Super Malaysia, UFC markets), and in-play behaviour.
• Bonus opt-in history and promotional engagement records.
• Responsible gambling tool activations (deposit limits, self-exclusion requests, session time limits).

3.6 Communications Data

• Content of live chat transcripts, support emails sent to [email protected], and WhatsApp messages exchanged with our support team.
• Feedback, complaints, and dispute correspondence.
• Responses to promotional communications where you have opted in to receive them.

4 How We Use Your Data

rebate66 processes personal data for the following specific and legitimate purposes:

rebate66 does not use your personal data for any purpose not listed above without first obtaining your explicit consent or being required to do so by law.

5 Legal Basis for Processing

rebate66 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the contract between you and rebate66 — including account creation, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable laws, including KYC identity verification, AML reporting, age verification (21+), and regulatory record-keeping.
• Legitimate Interests: Processing carried out in pursuit of rebate66's legitimate business interests, including fraud prevention, platform security, abuse detection, and improving service quality — where these interests do not override your fundamental rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily applicable to marketing communications and non-essential cookies. You may withdraw consent at any time without detriment to your account.

6 Data Sharing & Disclosure

rebate66 may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment Service Providers: Malaysian e-wallet operators (Touch 'n Go, Boost, GrabPay), bank payment processors (for DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank), and cryptocurrency processing services (for USDT TRC20 and BTC transactions) — solely to facilitate your deposit and withdrawal requests.
• KYC & Identity Verification Providers: Third-party identity verification service providers engaged under data processing agreements to support our KYC compliance obligations. These providers are contractually prohibited from using your identity documents for any purpose other than identity verification on our behalf.
• Game Content Providers: Licensed third-party game developers and live dealer studios who supply casino and sports betting content to the rebate66 Platform. Minimal technical data (session tokens, bet identifiers) is shared to facilitate game delivery; no unnecessary personal data is transmitted.
• Regulatory Authorities: Competent authorities, licensing bodies, or law enforcement agencies where disclosure is required by law, court order, or regulatory direction — including AML reporting obligations.
• Fraud Prevention Agencies: Industry fraud prevention databases and shared intelligence networks used to identify multi-accounting, identity fraud, and financial crime patterns.
• Professional Advisors: Legal counsel, auditors, and accountants engaged under strict professional confidentiality obligations as necessary for legitimate business and compliance purposes.

All third-party data processors engaged by rebate66 are required to maintain equivalent data protection standards and are prohibited from processing your personal data for any purpose other than the specific purpose for which they were engaged.

7 Cookies & Tracking Technologies

rebate66 uses cookies and similar tracking technologies to maintain session continuity, improve platform performance, and — where consent is provided — to personalise your experience and analyse usage patterns.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling essential cookies will impair the functionality of the rebate66 Platform and may prevent you from logging in or placing wagers. Withdrawal of consent for non-essential cookies will not affect your account status.

8 Data Retention

rebate66 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account's active status plus a minimum post-closure period as required for legal and regulatory compliance.
• KYC & Identity Documents: Retained for a minimum of five (5) years following account closure, in accordance with AML regulatory requirements applicable to gaming operators.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required for financial record-keeping and AML audit purposes.
• Support Communications: Retained for up to three (3) years from the date of the communication to support dispute resolution and quality assurance.
• Marketing Consent Records: Retained from the date consent is given until withdrawal of consent plus one (1) year, to maintain evidence of lawful marketing activity.
• Technical & Log Data: Typically retained for up to twelve (12) months for security and fraud analysis purposes.

Upon expiry of applicable retention periods, personal data is securely deleted or permanently anonymised in accordance with our data destruction procedures.

9 Data Security

Our security infrastructure includes the following protections:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and our Platform is encrypted using TLS 1.2 or higher. Look for the padlock icon in your browser address bar before submitting any personal information.
• Password Hashing: Account passwords are stored using cryptographic hashing with salt. rebate66 employees cannot view or access your password in plaintext at any time.
• Multi-Factor Authentication (MFA): Optional but strongly recommended MFA is available for all accounts to provide an additional layer of access security.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Employee access is logged and audited regularly.
• Segregated Storage: Player funds and sensitive KYC documents are stored in segregated, access-controlled systems separate from general operational databases.
• Regular Security Reviews: Our security posture is reviewed periodically to assess vulnerabilities and align with current best practices.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, rebate66 will notify affected users without undue delay and take all reasonable steps to mitigate the impact of the breach.

10 Your Rights

As a data subject, you hold the following rights in respect of your personal data held by rebate66. To exercise any of these rights, contact our support team via live chat or at [email protected]:

• Right of Access: You have the right to request a copy of all personal data rebate66 holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held on your account.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to overriding legal retention obligations (e.g., AML record-keeping requirements).
• Right to Restriction of Processing: You may request that rebate66 restrict the processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of your data for transfer to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interests. Where your objection relates to direct marketing communications, we will cease such communications immediately upon receipt of your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

rebate66 will respond to all data subject rights requests within thirty (30) calendar days of receipt. In complex or high-volume circumstances, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

11 Minors & Age Restriction

The rebate66 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect or process personal data from individuals under the age of 21. Date of birth information collected during registration is used specifically to verify compliance with this age restriction.

Where rebate66 discovers that personal data has been collected from a user who is under 21 years of age, we will immediately suspend the account, delete all associated personal data (subject to any overriding legal obligations), and return any deposited funds via the original payment method. If you believe that a person under 21 has registered an account on our Platform, please notify us immediately at [email protected].

12 International Data Transfers

rebate66 is operated under an international gaming licence and some of our data processors — including game content providers, KYC verification services, and cloud infrastructure providers — may process data in jurisdictions outside Malaysia. Where personal data is transferred outside of your country of residence, rebate66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding local requirements.

Such safeguards may include: contractual data protection clauses incorporated into our agreements with data processors, adequacy decisions recognised by applicable regulatory authorities, or binding corporate rules where relevant. Details of the specific safeguards applicable to any international transfer may be requested by contacting our support team.

13 Third-Party Links & Services

The rebate66 Platform may contain references to third-party services or resources for informational purposes. This Privacy Policy applies solely to data collected and processed by rebate66 in connection with your use of our Platform. rebate66 is not responsible for the privacy practices, data collection methods, or content of third-party websites or services. We encourage you to review the privacy policies of any third-party service you interact with independently of our Platform.

14 Policy Amendments

rebate66 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered users via email and/or a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date displayed at the top of this Policy will reflect the date of the most recent revision.

Your continued use of the rebate66 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you should discontinue use of the Platform and request account closure prior to the effective date of the updated Policy.

15 Contact Us

For all privacy-related enquiries, data subject rights requests, or concerns regarding the handling of your personal data, please contact rebate66 through the following channels:

When submitting a data subject rights request by email, please include your registered account username and a brief description of your request. For identity verification purposes, we may ask you to confirm your identity before processing the request.