Privacy Policy — at866 Data Protection Commitment

Welcome to the at866 Privacy Policy. at866 ("we", "us", "our") operates the online gaming platform accessible at https://at866.bio, offering sports betting, live casino, slot games, and togel (Indonesia's traditional numbers lottery) markets to adult players across Indonesia and international markets. We understand that your personal information is valuable and that you have a legitimate interest in knowing how it is handled.

This Privacy Policy describes the types of personal data we collect when you use the at866 platform, the purposes for which that data is processed, the parties with whom it may be shared, the safeguards we apply to protect it, and the rights you hold in relation to your own information. This policy forms part of the at866 Terms & Conditions and should be read in conjunction with that document.

By registering an account with at866, accessing any part of the at866 platform, or otherwise engaging with our services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree with any part of this policy, you must not register an account or continue using the at866 platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, including but not limited to name, date of birth, email address, phone number, postal address, payment details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. at866 is the data controller in respect of all Personal Data collected through the at866 platform.
• "Processor" — a third party that processes Personal Data on behalf of at866 under a contractual data-processing agreement (e.g., payment service providers, KYC verification partners, analytics platforms).
• "KYC" — Know Your Customer identity verification, a regulatory compliance process requiring at866 to confirm the identity of members before processing withdrawals.
• "Cookie" — a small text file stored on your device by your browser when you visit the at866 platform, used to maintain session state, remember preferences, and support analytics.
• "Member" / "You" — any individual who has registered an account on the at866 platform or who accesses the platform in any capacity.
• "Third-Party Providers" — game studios, payment processors, fraud-detection services, analytics vendors, and other external parties whose services are integrated into or support the at866 platform.

at866 collects Personal Data through several channels: directly from you during registration and account management, automatically through your use of the platform, and from third-party sources such as payment processors and KYC verification partners. The categories of data we collect are set out in the table below.

3.1 Data You Are Not Required to Provide

Certain fields in the at866 registration form are optional. Providing optional information (such as a secondary contact number or city of residence) helps at866 personalise your experience but is not a condition of account creation. You may update or remove optional data at any time via your account settings.

3.2 Sensitive Data

at866 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond liveness-check photographs used exclusively for KYC identity confirmation), or health information. If you voluntarily disclose such information through support communications, at866 will treat it with enhanced confidentiality and will not use it for any purpose other than resolving the specific support matter.

at866 processes your Personal Data only for defined, legitimate purposes. We do not use your data for purposes that are incompatible with those stated below without first obtaining your explicit consent or having a separate legal basis to do so.

• Account Management: Creating and maintaining your at866 member account, verifying your identity, authenticating login sessions, and enabling you to access your gaming history, balance, and account settings.
• Service Delivery: Processing deposits and withdrawals via Indonesian payment methods (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and others), settling bets, crediting winnings, and managing promotional bonus credits.
• KYC & Fraud Prevention: Verifying your identity before processing withdrawals, screening for duplicate accounts, detecting suspicious betting patterns, and fulfilling anti-money laundering (AML) obligations as required by at866's international licensing conditions.
• Responsible Gaming: Monitoring gaming activity for signs of problem gambling behaviour, administering deposit limits and self-exclusion tools requested by members, and providing targeted responsible-gaming resources where appropriate.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and audit purposes.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how members navigate the at866 platform, identify friction points, test new features, and improve overall service quality.
• Marketing Communications: Sending you promotional emails, in-platform notifications, and bonus offers where you have opted in to receive such communications. You may withdraw your marketing consent at any time via your account settings or by contacting support.
• Legal Compliance: Meeting obligations imposed by at866's international gaming licence, complying with court orders, responding to law-enforcement requests, and defending against legal claims.
• Security: Protecting the at866 platform and its members from fraud, unauthorised access, distributed denial-of-service attacks, and other cyber threats through real-time monitoring, rate limiting, and anomaly detection.

at866 relies on the following legal bases to process your Personal Data, in accordance with applicable international data protection standards:

• Contractual Necessity: Processing required to perform the contract between you and at866 — including account creation, bet settlement, payment processing, and KYC verification — is necessary for the delivery of the services you have requested.
• Legitimate Interests: at866 processes certain data — including Technical Data, Usage Data, and gaming activity analytics — on the basis of legitimate interests in operating a secure, fraud-free, commercially viable gaming platform. We apply a balancing test to ensure that our legitimate interests do not override your fundamental privacy rights.
• Legal Obligation: at866 is required by its international gaming licence to collect and retain certain identity and financial data for AML and responsible-gaming compliance purposes. This processing is non-optional and cannot be waived by a member.
• Consent: Where at866 processes data for marketing communications or optional personalisation features, it does so on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

at866 does not share your Personal Data with third parties except in the limited circumstances described below. All third-party Processors engaged by at866 are bound by contractual data-processing agreements that impose confidentiality obligations and restrict the use of your data to the specific services they provide to at866.

6.1 Payment Service Providers

To process deposits and withdrawals, at866 shares the minimum necessary financial data (account name, account number, transaction amount) with the relevant Indonesian bank or e-wallet operator (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, LinkAja). These entities process your data under their own privacy policies and applicable Indonesian banking regulations.

6.2 KYC & Identity Verification Partners

at866 may use third-party KYC technology providers to assist with automated document authentication, liveness checks, and sanctions screening. These providers receive only the identity documents and data necessary to complete the verification process and are prohibited from using your data for any other purpose.

6.3 Game Content Providers

Third-party game studios integrated into the at866 platform (including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) may receive anonymised or pseudonymised session identifiers to deliver game content and process round results. These providers do not receive your full name, contact details, or financial information.

6.4 Analytics & Fraud Prevention

at866 uses analytics and fraud-detection platforms that process Technical Data and Usage Data to help identify suspicious activity, optimise platform performance, and improve user experience. Data shared with these providers is anonymised or pseudonymised to the greatest extent practicable.

6.5 Legal & Regulatory Disclosure

at866 may disclose Personal Data to courts, law-enforcement agencies, regulatory bodies, or licensing authorities where required to do so by law, by court order, or in connection with the investigation of fraud, money laundering, or other criminal activity. at866 will notify you of any such disclosure to the extent permitted by applicable law.

at866 uses cookies and similar tracking technologies (local storage, session storage, pixel tags) to operate the platform effectively, remember your preferences, maintain login sessions, and gather analytics data. The following categories of cookies are used on the at866 platform:

7.1 Managing Cookies

You may control the use of non-essential cookies through your browser settings. Most modern browsers allow you to block, delete, or restrict cookies from specific domains. However, disabling strictly necessary cookies will prevent you from maintaining a logged-in session on the at866 platform and may impair core functionality. at866 does not currently support a cookie-preference centre; cookie management is handled at the browser level.

at866 retains your Personal Data for only as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and licensing obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of your membership and for five years after the date of account closure, in accordance with standard AML record-keeping requirements applicable to international gaming operators.
• KYC Documents: Retained for a minimum of five years after the date of submission, or longer if required by at866's licensing jurisdiction. KYC documents are stored in encrypted form on access-controlled servers.
• Financial Transaction Records: Retained for five years from the date of each transaction, in accordance with anti-money laundering and financial record-keeping standards.
• Gaming Activity Logs: Retained for three years from the date of each gaming session for dispute resolution, responsible-gaming monitoring, and game-integrity audit purposes.
• Support Communications: Retained for two years from the date of closure of each support ticket, to support quality assurance and recurring complaint management.
• Marketing Consent Records: Retained for the duration of your membership and for two years following account closure, to document consent and opt-out decisions.
• Technical & Usage Logs: Retained for up to 12 months in identifiable form, after which data is anonymised or deleted.

Where Personal Data is no longer required for any stated purpose or legal obligation, at866 will securely delete or anonymise it. Anonymised data (which cannot identify any individual) may be retained indefinitely for statistical and research purposes.

at866 employs a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security programme includes the following measures:

• Transport Encryption: All data transmitted between your device and the at866 platform is encrypted using TLS 1.3 with 256-bit AES encryption. The at866 domain enforces HTTPS at all times; plain HTTP connections are automatically redirected.
• Data-at-Rest Encryption: All databases containing Personal Data — including KYC documents, financial records, and account credentials — are encrypted at rest using AES-256. Encryption keys are managed through a dedicated key management service with strict access controls.
• Access Controls: Access to systems containing Personal Data is restricted to at866 personnel with a demonstrated need. Access is governed by role-based permissions, multi-factor authentication, and regular access reviews. All access events are logged.
• Intrusion Detection: at866 operates real-time intrusion detection and prevention systems (IDS/IPS) that monitor network traffic for anomalous patterns indicative of unauthorised access attempts or data-exfiltration activity.
• Vulnerability Management: at866 conducts regular penetration testing and vulnerability scans on all customer-facing and internal systems. Critical vulnerabilities are remediated within 24 hours; high-severity findings are addressed within seven days.
• Incident Response: at866 maintains a documented data-breach response plan. In the event of a Personal Data breach that poses a risk to your rights and freedoms, at866 will notify affected members within 72 hours of becoming aware of the breach, in accordance with applicable data-protection standards.

As an at866 member, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact at866 support at [email protected]. at866 will respond to verified requests within 30 calendar days.