Reference

How on66 Handles Your Personal Information

When you open an account with us, we collect only what we need to run your account, process payments and keep things secure.

Account data kept secureLocal payment privacy: Touch 'n Go eWallet, Boost, GrabPayYour rights, clearly statedContact us to update or remove dataApplies where local law permits
on66 How on66 Handles Your Personal Information
PRIVACY CONTACT PATHS

How to Reach Us on Privacy Matters

If you want to access the data we hold on your account, request a correction or ask us to delete information that is no longer needed, contact our support team directly. We aim to acknowledge your request promptly and resolve it within the timeframe required by applicable law. For straightforward account updates — like changing your registered email or contact number — the Account Settings section handles those without needing to contact us.

Team online

Live Chat

Reach our account support team via the live chat icon in the lobby. Available for privacy queries, data access requests and account verification questions.

Email Support

Send your data request or privacy concern to our support email address found in the Account section. Include your registered account name for faster handling.

Account Settings

Minor personal details — name spelling, contact number, preferred language — can be updated directly inside your account without submitting a formal request.

HOW WE PROTECT IT

Data Handling, Cookies, Security and Retention

We apply standard encryption to data in transit and at rest, which means your account details and payment records are not readable in plain text if intercepted. Account access uses a one-time password (OTP) sent to your registered mobile number each time you log in from a new device — this is the first line of defence against unauthorised access. Cookies are used for session management and preference storage only; you can adjust cookie settings in your browser at any time. We hold your account data for as long as your account is active and for the period required under applicable Malaysian financial regulations after it closes.

Encryption in Transit All data moving between your device and our servers is encrypted. This covers your login session, account wallet balance and any payment reference passed via Touch 'n Go eWallet or Boost.
OTP Login Verification Every new-device login triggers an OTP to your registered number. If you receive an OTP you did not request, contact support immediately and we will lock the session.
Cookie Controls We use session cookies and preference cookies. No advertising or cross-site tracking cookies are placed without your consent. Browser settings let you clear or block cookies at any time.
Data Retention Active account data is retained while your account is open. After closure, we keep only what Malaysian financial regulations require for the mandatory period, then delete the rest.

Your Privacy Questions, Answered Directly

These are the questions we get asked most often about how we handle account data, payment records and your rights under this privacy policy. If your question is not covered here, live chat or email support can give you a specific answer based on your account.

We store your registration details, contact information, date of birth, transaction history and device session logs. We do not store your full e-wallet credentials or banking PINs.

We share only what is necessary with payment processors like Touch 'n Go eWallet, Boost, GrabPay and FPX to complete your transactions. We do not sell your data to marketers or data brokers.

Contact our support team via live chat or email with your registered account name. We will compile and send your data summary within the timeframe required by applicable law.

Yes. Submit a deletion request through support. We will remove data that is no longer required, retaining only what Malaysian financial regulations oblige us to keep for a set period.

Payment references are stored in encrypted form. We receive a transaction ID from the processor — not your full wallet credentials. Your PIN stays only within the GrabPay or Boost app itself.

Your active account data is deactivated immediately. We retain transaction and identity records for the period required under applicable regulations in Malaysia, then permanently delete them.
Reference

Privacy Policy

Service availability depends on eligible regions and local law. Users should check local rules before opening an account.

Access may be available only where local law permits.