A6stra Privacy Policy — Malaysian Member Personal Data Protection

1 Introduction

A6stra ("we", "Platform", or "company") values the privacy of every member and user of our services. This Privacy Policy has been established in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices.

This document applies to all information collected through the a6stra website, mobile app, and all other associated service channels. By using our platform, you agree to the terms set out in this Privacy Policy.

We understand that trust is the foundation of our relationship with you. That is why we strive to be open and transparent about every aspect of how your personal data is handled — from how it is collected, to how it is protected, and ultimately deleted when no longer needed.

2 Information We Collect

A6stra collects various types of information to enable us to provide a secure, personalised, and high-quality service to every member. The following are the categories of information we collect:

Information You Provide Directly:

• Full name as stated on your official identification document.
• Date of birth for age verification.
• An active email address and Malaysian mobile number.
• Current residential address including postcode and state.
• Bank account or e-wallet details for deposit and withdrawal purposes.
• Identity documents (MyKad, passport) submitted during the KYC process.

Information Collected Automatically:

• Your device's IP address and location data.
• Device type, operating system, and browser version used.
• In-platform activity history, including wagering records and transactions.
• Login and logout session data including timestamps.
• Cookie data and related tracking technologies.
• Communication records between you and our support team.

3 How We Use Your Data

Every piece of information we collect is used for a clear and lawful purpose. We will not use your data for any other purpose without informing you in advance. The following are the primary purposes for which your data is used:

For marketing communications specifically, we will only send you promotional notifications, bonus offers, and the latest updates if you have given your consent during the registration process or through your account settings. You may withdraw this consent at any time.

4 Information Sharing

A6stra does not sell or rent your personal data to any third party. However, in the course of operating the platform safely and in compliance with the law, we may share your information with the following parties:

• Payment Service Providers: Payment gateway providers such as FPX, Touch 'n Go, and GrabPay that process your transactions. They only receive the data necessary to process those payments.
• KYC Service Providers: Third-party identity verification companies that help us process KYC verification automatically and securely.
• Regulatory Authorities: If required by Malaysian law or the relevant authorities, we are obligated to disclose certain information.
• Technology Partner: Cloud infrastructure and cybersecurity providers that help us operate the platform securely. They are bound by strict confidentiality agreements.
• Business Transfers: In the event of any merger, acquisition, or sale of company assets, you will be notified in advance and your privacy rights will be upheld.

5 Data Security

The security of your personal data is the top priority for a6stra. We implement multiple layers of security to ensure your information is always protected from unauthorized access, data breaches, or misuse.

• 256-bit SSL Encryption: All data transmitted between your device and our servers is protected using the latest TLS 1.3 encryption protocol — the same standard adopted by major banking institutions.
• Layered Access Control: Only authorized personnel may access user data, and all access is logged and continuously monitored.
• Two-Factor Authentication (2FA): Member accounts can be protected with two-factor authentication to prevent unauthorized access.
• Regular Security Audits: Our platform undergoes regular penetration testing and security audits by independent cybersecurity experts.
• 24/7 Monitoring: Our automated monitoring system operates around the clock to detect and respond to any suspicious activity.
• Secure Data Backup: Data is regularly backed up to separate data centers to ensure service continuity and recovery in the event of a technical incident.

6 Cookies & Tracking Technologies

A6stra uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use:

• Essential Cookies: Required for core platform functions such as login session verification and security. These cookies cannot be disabled.
• Functional Cookies: Stores your preferences such as language selection and display settings to make your platform experience more convenient.
• Analytics Cookies: Helps us understand how users interact with the platform so we can make continuous improvements. This data is collected in aggregate and does not identify individuals.
• Marketing Cookies: Used to display relevant promotional content to you based on your interests and activity — only with your consent.

You can manage your cookie settings through your browser at any time. However, disabling essential cookies may affect overall platform functionality.

7 Your Privacy Rights

As an a6stra member and data subject under Malaysia's PDPA, you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to Rectification: If any information we hold is inaccurate or outdated, you have the right to request immediate correction.
• Right to Withdraw Consent: You may withdraw consent for marketing communications at any time via your account settings or by contacting us.
• Right to Object to Processing: In certain circumstances, you have the right to object to how we process your data, particularly for marketing purposes.
• Right to Erasure: You may request the deletion of your personal data, subject to our legal obligations to retain certain records.
• Right to Data Portability: You have the right to receive a copy of your data in a machine-readable format for transfer to another platform.

To exercise any of the above rights, please contact our privacy team via email or live chat. We will process your request within 30 business days.

8 Data Retention & Deletion

A6stra retains your personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by Malaysian law.

• Active Account Data: Retained for as long as your account remains active and in use.
• Transaction & Financial Data: Retained for a minimum of 7 years in accordance with Malaysia's accounting and AML legal requirements.
• KYC Records: Retained for 5 years after account closure or the date of the last transaction.
• Support Communication Logs: Retained for 2 years for quality assurance and dispute resolution purposes.
• Marketing Data: Deleted immediately upon withdrawal of consent for marketing communications.

Once the retention period expires, your data will be securely deleted using methods that comply with international security standards, ensuring it cannot be recovered.

9 Child Privacy

The a6stra platform is strictly for individuals aged 21 and above. We do not knowingly collect or process personal data from any individual under the age of 21.

If we discover that personal data of a minor has been collected without proper verification, we will promptly delete that information and close the relevant account. Parents or guardians who believe their child may have registered on our platform are urged to contact us immediately.

10 Third-Party Links

The a6stra platform may contain links to third-party websites for informational convenience. This Privacy Policy applies solely to the a6stra platform and does not cover the privacy practices of those third-party websites.

We are not responsible for the content, privacy policies, or practices of any third-party websites. You are advised to read the privacy policy of each website you visit separately. a6stra has no control over how third-party websites handle your data.

11 Privacy Policy Amendment

A6stra reserves the right to amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or platform service improvements.

• Any significant amendments will be communicated to you via your registered email or an in-platform notice at least 14 days before taking effect.
• The "Updated" date at the top of this document will always reflect the date the latest amendment was made.
• Continued use of the platform after the effective date of any amendment constitutes your acceptance of the latest version of the Privacy Policy.
• If you disagree with any amendments made, you have the right to close your account before the effective date.

12 Contact Us

For any inquiries, concerns, or requests regarding this Privacy Policy or the handling of your personal data, our privacy team is here to help:

• Live Chat: Available on the platform 24/7, including weekends and public holidays.
• Privacy Email: [email protected] — we aim to respond within 2 business days.
• Frequently Asked Questions: Visit page FAQ us for quick answers to frequently asked questions.

For issues related to responsible gaming or self-exclusion, please visit our Responsible Gaming us, which offers a range of resources and self-help tools.