Mobile / Casino
This Privacy Policy sets out what information tm66 collects when you open and use your account, how that information is stored, and the choices available to you. Access to our platform and the application of this policy depends on local law and is available where local law permits.
When you register with tm66, we collect the details you enter — your name, contact address, and the credentials you set for your account. When a transaction is processed through Touch 'n Go eWallet, DuitNow, or Boost, we receive a record of that transaction: the amount, the method used, and the timestamp. We do not store your full e-wallet PIN or banking password at any point. Device information — browser type, operating system, and screen resolution — is recorded to keep your account session consistent across visits. This data serves a specific purpose: verifying your identity, processing your wallet activity, and maintaining the security of your account. We retain transaction records for as long as required by applicable law in the regions where this service is available. Behavioural data — pages visited, game sessions opened — is collected in aggregate to improve the account flow. Where a third-party payment processor handles your Touch 'n Go eWallet or DuitNow transfer, that processor operates under its own data agreement, which we link from the relevant account page. You can request a summary of the data held under your account at any time through the support channel listed on this page.
This policy covers the tm66 platform as accessed through a supported browser or the mobile interface. It applies to account registration, session activity, and wallet transactions processed through our platform. Services or links that take you outside tm66 — such as a payment processor's own portal — are governed by that service's separate terms. The table below outlines what falls inside and outside the scope of this policy.
Login activity, session tokens, and account credential storage fall fully within this policy. We manage these records directly and you can request a copy or correction through the support contact path on this page.
Records of Touch 'n Go eWallet, DuitNow, and Boost activity processed through our platform are within scope. The payment processor's own handling of your e-wallet credentials is outside our scope and covered by their policy.
Your game session data — which category you opened, how long a session lasted — is collected in aggregate form within this policy. Individual game outcomes are processed by the game studio and sit outside our direct data scope.
External links, third-party analytics tools, and any service accessed outside the tm66 domain are not covered here. Check each linked service's own policy before sharing personal information with them.
Several actions are available to you under this policy, and each one starts from your account rather than requiring a formal written request. To check what data is held against your profile, log in and head to the account settings section — the summary shown there reflects the current record. If any detail is incorrect, such as a contact address or display name, you can edit it directly from the same screen. For information that cannot be self-edited — such as identity verification records or historical transaction logs — a written request to the support team is the correct path. The response time for data queries depends on the volume of requests at that point and the complexity of what is being asked, but every request receives an acknowledgement. Where this platform operates in a region where data rights are defined by local law, those rights apply as specified by that law. The support contact details are listed in the section below.
After logging in, open account settings to see the profile data currently held. The page shows contact details, session history and linked wallet methods in one place.
Name, contact email and display preferences can be updated directly from account settings without contacting support. Changes take effect at the next login.
For records that are not self-editable — identity documents, verification history — submit a written request through the support channel. Every query receives a written acknowledgement.
Where local law grants the right to request deletion of personal data, you may submit that request through the support contact path. The outcome depends on applicable legal retention requirements at the time.
Privacy queries go to the same support team that handles account and wallet questions. Use the channel that works for you — live chat is available through the account dashboard after login, and email is the correct path for detailed written requests about your data. When contacting us about a privacy matter, include your registered account email address so the team can locate your record without asking for additional identification.
Open the chat widget from your account dashboard after login. State that your query relates to privacy or personal data so the agent routes it correctly.
Send written data requests by email. Include your registered account address in the message. This is the correct path for deletion requests and historical record queries.
For self-service changes to contact details or wallet preferences, log in and open account settings. Most routine corrections can be made there without contacting support.
Account security and data retention are handled consistently across the platform. Sessions are protected by standard encryption in transit, and stored records are access-controlled so that only authorised processes can retrieve them. Cookies are used to keep your account session active and to record which device you last logged in from — this supports the returning-user flow so the account loads in the state you left it. Retention periods follow the requirements of applicable law in the regions where this platform is accessible. When a retention period ends and no legal hold applies, the relevant data is scheduled for deletion in the next processing cycle. Policy updates are posted on this page; the date at the top of the policy reflects the version currently in effect.
Data moving between your device and the platform — including Touch 'n Go eWallet and DuitNow transaction details — is encrypted during transfer. This applies whether you access the account from a phone browser or a desktop.
Session cookies keep you logged in across pages and remember your last device. Analytics cookies record aggregate page activity. You can manage cookie preferences through your browser settings at any time.
Transaction records are retained for the period required by applicable law in your region. Account data not subject to a legal hold is deleted after your account has been inactive for the period specified in the current policy version.
When this policy changes, the updated version is published here with a revised date at the top. Continued use of the account after a policy update constitutes acceptance of the revised terms, where permitted by local law.
These questions cover what visitors most often ask about how personal data is handled, what rights apply to their account, and how to act on those rights.
Registration collects your name, contact email, and the password you set. When you link a payment method such as Touch 'n Go eWallet or DuitNow, a transaction reference is recorded. We do not store your full e-wallet PIN or bank login credentials.
Log in and open account settings to view the profile data currently on record. For a fuller export — including transaction history and session logs — send a written request through the email support channel with your registered account address included.
Retention periods follow applicable law in the region where this service is accessed. Transaction records linked to Touch 'n Go eWallet or DuitNow transfers are kept for the legally required period. When that period ends and no hold applies, the data enters the deletion schedule.
Data is shared only where necessary to process a transaction — for example, with the payment processor handling a DuitNow or Boost transfer. We do not sell personal data to third parties for marketing purposes. Each payment processor operates under its own data agreement.
Most details — contact email, display name — can be updated directly from account settings after login. For identity verification records or documents that cannot be self-edited, contact the support team by email with your account address and the correction needed.
Closing the account initiates a review against legal retention requirements. Data subject to a mandatory hold stays on record for the required period. Once that period ends, the relevant records are scheduled for deletion in the next processing cycle.