Privacy Policy
Your Data. Your Rights.

Pavilion66 is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy sets out, in clear and accessible terms, the categories of personal data we collect from you, the purposes for which that data is processed, the legal bases on which we rely to process it, and the rights you hold in relation to your personal data.

Pavilion66 operates as an online casino and sports betting platform serving users globally, with a primary focus on the Malaysian market. We understand that our users — whether based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere — place significant trust in us when they share their personal information. That trust is not taken lightly, and this Policy reflects our concrete obligations to you.

This Policy applies to all personal data collected through the Pavilion66 website at pavilion66.cam, all associated account management interfaces, live chat support systems, and any communications between Pavilion66 and its registered users. It does not apply to third-party websites or services that may be linked from our platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies, or is reasonably capable of identifying, a living individual, directly or indirectly, including name, email address, identity card number, IP address, and device identifiers.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, and deletion.
• "Data Controller" — Pavilion66, the entity that determines the purposes and means of processing Personal Data collected through this Platform.
• "Data Subject" — any identified or identifiable individual whose Personal Data is processed by Pavilion66 as Data Controller — in practical terms, any registered Player or website visitor.
• "Third Party" — any natural or legal person other than the Data Subject, Pavilion66, or persons authorised to process Personal Data under the direct authority of Pavilion66.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a stated purpose.
• "KYC" — Know Your Customer verification procedures undertaken to confirm the identity, age, and payment ownership of Players in accordance with our licensing and anti-money laundering obligations.

Pavilion66 collects the following categories of Personal Data, grouped by the context in which they arise:

Pavilion66 collects Personal Data through the following channels and mechanisms:

4.1 Direct Collection

Data you provide directly to us when you create a Pavilion66 account, complete the KYC verification process, make a deposit or withdrawal, contact our support team via live chat or email, respond to a survey or promotional questionnaire, or update your account profile and settings.

4.2 Automated Collection

Technical data collected automatically as you navigate and interact with the Pavilion66 platform, including IP addresses, browser and device identifiers, session timestamps, page visit sequences, and in-game interaction data. This data is collected via server-side logging and, where consented, via browser cookies and similar tracking technologies (see Section 9 for full cookie details).

4.3 Third-Party Sources

Where permitted under applicable law and subject to appropriate data sharing agreements, Pavilion66 may receive limited Personal Data from third-party service providers including payment processors (for transaction verification), fraud detection partners (for anti-money laundering screening), and identity verification providers (for KYC document authentication). Data received from third-party sources is subject to this Privacy Policy.

Pavilion66 processes your Personal Data for the following clearly defined purposes:

1. Account Creation and Management: To register, activate, authenticate, and maintain your Pavilion66 account, including password recovery and account settings management.
2. Identity and Age Verification (KYC): To verify that you are 21 years of age or older and to confirm the legitimacy of your identity in accordance with our licence obligations and anti-money laundering requirements.
3. Payment Processing: To facilitate deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Connect, and other supported payment channels, and to process withdrawal requests to verified payment methods.
4. Platform Operation and Game Delivery: To deliver our casino, live dealer, and sports betting services, record game outcomes and wager histories, and maintain the integrity of all gaming activities.
5. Customer Support: To respond to your enquiries, resolve disputes, process complaints, and maintain a record of support interactions for quality assurance purposes.
6. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, money laundering, underage access, multiple account abuse, and other prohibited activities.
7. Responsible Gambling Compliance: To monitor gaming behaviour for signs of problem gambling, enforce self-exclusion and deposit limit settings, and comply with our responsible gaming programme obligations.
8. Legal and Regulatory Compliance: To fulfil obligations under our international gaming licence, applicable anti-money laundering regulations, and any lawful request from a competent authority.
9. Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, user experience, and product development.
10. Marketing Communications: To send you promotional offers, bonus notifications, and news about Pavilion66 — only where you have provided explicit consent or where permitted under legitimate interest, and always with a clear opt-out mechanism.

Pavilion66 relies on the following legal bases to process Personal Data lawfully:

• Contractual Necessity: Processing required to perform the contract between you and Pavilion66 — namely, delivering our gaming services, processing payments, and maintaining your account.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC obligations under our gaming licence, and anti-money laundering laws.
• Legitimate Interests: Processing carried out to pursue the legitimate business interests of Pavilion66, including fraud prevention, platform security, responsible gambling monitoring, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily applicable to marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.1 We Do Not Sell Your Data

Pavilion66 does not sell, rent, trade, or otherwise commercially transfer your Personal Data to any third party for their own marketing or commercial purposes. This is an unconditional commitment.

7.2 Service Providers

We share Personal Data with carefully selected third-party service providers who process data on our behalf and under our instruction, strictly for the purposes described in this Policy. These include payment gateway operators, KYC verification providers, fraud detection services, cloud hosting providers, and customer support platform operators. All service providers are bound by contractual data processing agreements that prohibit independent use of your data.

7.3 Legal Disclosures

Pavilion66 may disclose Personal Data to law enforcement agencies, gaming regulators, financial intelligence units, or other competent authorities where required to do so by law, court order, or in connection with a lawful investigation into suspected fraud, money laundering, or other criminal activity.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of Pavilion66 or a material portion of its assets, Personal Data held by Pavilion66 may be transferred to the acquiring entity, subject to the same privacy protections as set out in this Policy. Users will be notified of any such transfer in advance.

Pavilion66 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active Account plus a minimum period of five (5) years following Account closure, in accordance with anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the relevant transaction, consistent with financial regulatory obligations.
• KYC Documents: Retained for a minimum of five (5) years following the completion of KYC verification or Account closure, whichever is later.
• Gaming Activity Records: Retained for a minimum of three (3) years from the date of each recorded gaming session, for regulatory reporting and dispute resolution purposes.
• Support Communications: Retained for a period of two (2) years from the date of the interaction, unless retention beyond that period is necessary for an ongoing dispute or investigation.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which relevant data is removed from active marketing lists within 30 days.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

9.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They enable the website to recognise your device, remember your preferences, and deliver a consistent and personalised experience across sessions. Pavilion66 uses cookies and similar tracking technologies (such as web beacons and local storage) on the Platform.

9.2 Categories of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session authentication, security tokens, and load balancing. These cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, language settings, and personalisation choices to enhance your experience on Pavilion66.
• Analytics Cookies: Used to collect anonymised data on how users interact with the Platform, including pages visited, session duration, and navigation paths, for the purpose of improving Platform performance and usability.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised account access, and abuse of Platform features.

9.3 Managing Cookies

You can manage your cookie preferences through your browser settings, which allow you to block, delete, or restrict cookies. Please note that disabling strictly necessary cookies will impair your ability to use the Pavilion66 Platform. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

As a Data Subject, you hold the following rights in relation to your Personal Data held by Pavilion66. You may exercise any of these rights by contacting our support team via live chat or the email address provided in Section 15 of this Policy.

Pavilion66 will respond to all valid data subject requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further two months, with written notification to you of the extension and the reasons for it. There is no charge for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request.

Pavilion66 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Pavilion66 Platform;
• Encryption of sensitive data fields (including KYC documents and financial data) at rest in our database systems;
• Role-based access controls ensuring that only authorised personnel with a genuine business need can access Personal Data;
• Multi-factor authentication requirements for internal administrative access to systems holding Personal Data;
• Regular penetration testing, vulnerability scanning, and security audits conducted by qualified third-party security professionals;
• Incident response procedures with defined escalation timelines, including notification procedures in the event of a personal data breach.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, Pavilion66 will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach. No data security system is entirely impenetrable, and Pavilion66 cannot guarantee absolute security. You are responsible for maintaining the security of your own account credentials.

The Pavilion66 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that we have inadvertently collected Personal Data from a person under the minimum age requirement, we will take immediate steps to delete that data and permanently close the associated account.

If you believe that a person under the age of 21 has registered an account on Pavilion66, or that we may have inadvertently collected data from such a person, please notify us immediately via the contact details in Section 15.

The Pavilion66 Platform may, from time to time, contain references to or integrations with third-party services such as payment gateways (e.g., DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay) and identity verification providers. When you interact with these third-party services — for example, when completing a payment via your Maybank or CIMB online banking interface — you are subject to the privacy policies of those respective services. Pavilion66 is not responsible for the privacy practices of third-party services and encourages you to review their privacy policies directly.

Pavilion66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or regulatory requirements. Where a material change is made to this Policy, we will notify registered users by email to the address associated with their account, or by displaying a prominent notice on the Platform, at least 14 days before the change takes effect.

Continued use of the Pavilion66 Platform following the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. The "Last Updated" date at the top of this Policy indicates when the most recent revision was published. We recommend reviewing this Policy periodically to remain informed of how we handle your Personal Data.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your Personal Data, you may contact the Pavilion66 Data Protection team through the following channels:

For formal data subject access requests, erasure requests, or complaints regarding our data processing practices, please contact us via email clearly marked with the subject line "Data Subject Request". We will acknowledge your request within 3 business days and aim to fulfil it within 30 days.