air168 Privacy Policy

Introduction

air168 operates as an English-language online casino and sports betting information platform designed for Malaysian adults. This Privacy Policy describes how air168 processes personal data in connection with account registration, identity verification, MYR and e-wallet transactions, customer support and responsible gambling controls.

This policy applies to all individuals who access or register with air168, including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other locations in Malaysia. References to applicable law include the Malaysian Personal Data Protection Act 2010 (PDPA) and any other mandatory legal requirements affecting the user's jurisdiction.

Where this policy uses the terms "we", "our" or "air168", these refer to the operator responsible for the air168 platform. Where this policy uses "you" or "user", these refer to any person who accesses, registers with or otherwise interacts with air168.

Definitions

Personal Data We Collect

air168 may collect the following categories of personal data, depending on the services accessed and the account activity undertaken:

Purposes of Processing

air168 processes personal data for the following purposes:

• creating and managing player accounts and providing the requested platform services;
• verifying the age, identity and address of users as required by applicable rules;
• processing MYR deposits and withdrawals through approved methods such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank and Hong Leong;
• detecting, investigating and preventing fraud, money laundering, account abuse and other unlawful activity;
• operating responsible gambling controls including limit processing, self-exclusion enforcement and problem-gambling outreach;
• complying with anti-money-laundering obligations, applicable law, regulatory requirements and lawful orders from competent authorities;
• handling customer support queries, complaints and dispute resolution;
• improving platform security, stability and features through technical and usage analysis; and
• sending account-related communications and, where applicable consent or legitimate interest exists, relevant promotional updates.

Legal Basis for Processing

air168 relies on the following legal bases when processing personal data:

• Contractual necessity — processing required to open an account, verify identity, execute a payment, settle a bet or provide customer support;
• Legal obligation — processing required to meet anti-money-laundering, tax, age-verification and regulatory requirements under applicable law, including Malaysian PDPA obligations;
• Legitimate interests — fraud prevention, platform security, responsible gambling monitoring, product improvement and internal analytics, where those interests are not outweighed by user rights;
• Consent — where a specific purpose requires consent, such as optional marketing communications or non-essential cookies, and consent can be withdrawn without detriment to core account services.

Data Sharing and Disclosure

air168 does not sell personal data to third parties. Personal data may be shared only in the following circumstances:

• Payment processors — financial institutions, e-wallet providers such as Touch 'n Go eWallet, Boost or GrabPay, DuitNow operators, FPX participants and Malaysian banks, to the extent necessary to complete a transaction;
• Identity verification providers — third-party KYC services used to confirm identity document authenticity and screen against sanctions lists;
• Technology providers — hosting, security, analytics and customer support technology partners who process data as data processors under binding data-processing agreements;
• Legal and regulatory authorities — competent courts, regulators, enforcement bodies or financial intelligence units when required by applicable law or lawful order; and
• Responsible gambling organisations — where a player requests referral or where inter-operator self-exclusion schemes apply.

Third parties engaged as data processors are contractually required to apply appropriate safeguards and to use personal data only for the specified purpose.

Retention Periods

air168 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to mandatory minimum retention periods under applicable law. Indicative periods include:

After the applicable period ends, personal data will be securely deleted or anonymised unless a specific legal obligation requires continued retention. Anonymised data no longer constitutes personal data and may be retained for statistical purposes.

Data Security

air168 applies appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures in place may include:

• HTTPS encryption for all data transmitted between user devices and air168 systems;
• access controls limiting internal data access to personnel with a demonstrable need;
• security monitoring for unusual login patterns, repeated authentication failures and suspected account takeover activity;
• secure handling and storage standards for KYC documents and financial records; and
• periodic security assessments of technical infrastructure.

Users are reminded that no internet transmission or storage system can guarantee absolute security. Users remain responsible for protecting their own credentials. Any suspected unauthorised access to an air168 account should be reported promptly.

Cookies and Tracking Technologies

air168 may use first-party cookies and similar session technologies to maintain secure login states, remember interface preferences, prevent duplicate requests and support platform stability. These technically necessary cookies do not require separate consent.

Where air168 deploys optional analytics or performance cookies, a notice will request appropriate consent before those cookies are set. You may adjust browser settings to refuse or delete cookies, although certain air168 functions may not operate correctly without session cookies. air168 does not permit third-party advertising networks to place tracking cookies on user devices through the air168 platform.

Payments and KYC Data

Financial data including MYR deposit and withdrawal records, payment method references and KYC verification documents are among the most sensitive categories that air168 processes. The following specific standards apply:

• Full payment card numbers are not stored on air168 systems where tokenised or reference-based processing can be used instead.
• Verification documents such as MyKad photographs, passport scans, utility bills and selfies are reviewed for identity confirmation and are not used for any unrelated marketing or profiling activity.
• Payment method details must be associated with the verified account holder. A payment from an unverified or third-party source may trigger a review and may result in a return of funds pending confirmation.
• Users should never transmit document photographs or payment credentials through unofficial channels, personal email accounts, unsecured chat services or social media.
• Financial transaction records are retained in accordance with the period stated in Section 7 to meet anti-money-laundering and audit requirements that apply regardless of account closure.

Your Rights

Subject to applicable law, verified air168 account holders may exercise the following rights in relation to their personal data:

• Right of Access — Request a description of the personal data air168 holds about you and how it is being used.
• Right of Correction — Request that inaccurate or incomplete personal data be corrected without undue delay.
• Right of Deletion — Request the deletion of personal data that is no longer required for its stated purpose, subject to legal retention obligations.
• Right to Object — Object to processing based on legitimate interests where your specific circumstances warrant it.
• Right to Withdraw Consent — Where processing is consent-based, withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Complain — Lodge a complaint with the Malaysian Communications and Multimedia Commission or the competent data protection authority in your jurisdiction.

Requests to exercise any of the above rights should be submitted through the support email displayed in the footer. air168 may require identity verification before responding to a rights request to prevent unauthorised disclosure of personal data. Responses will be provided within a reasonable period consistent with applicable requirements.

Minors

air168 is not intended for, and does not knowingly collect personal data from, individuals below the age of 21. The 21+ age standard applies to all account registration, gambling activities and promotional participation on air168. Where air168 identifies that personal data has been collected from a person below this threshold, the data will be deleted and the account closed. Any individual who believes that a person under 21 has registered with air168 should contact support promptly.

International Data Transfers

Where air168 engages data processors or service providers whose infrastructure is located outside Malaysia, personal data may be transferred internationally. Such transfers are conducted under appropriate safeguards, which may include contractual data-transfer clauses, adequacy assessments or other mechanisms recognised under applicable privacy law. air168 will not transfer personal data to a recipient jurisdiction that does not provide an adequate level of protection without first applying a suitable safeguard mechanism.

Changes to This Privacy Policy

air168 may update this Privacy Policy to reflect changes in services, data processing practices, applicable law or technical infrastructure. The effective date at the top of this page identifies the current version. Where a change is material — for example, a new processing purpose or category of sharing — air168 will provide reasonable advance notice through the website or account communication where practicable.

Continued use of air168 after a revised policy becomes effective indicates acceptance of the updated terms. A user who does not accept the revised policy should stop using air168 and contact support to request account closure and data handling guidance.

Contact Us

For questions about this Privacy Policy, to submit a data rights request or to raise a privacy concern, please contact air168 using the support email displayed in the footer of this page. The email address is presented as plain text only and cannot be clicked.

When contacting air168 about a data matter, please include your account username, the nature of your request or concern, and the specific data or processing activity involved. Air168 may ask for identity verification before discussing protected account or personal data details. Requests will be acknowledged and responded to within a reasonable period consistent with applicable law.