Privacy Policy a6stra Personal Data Protection

This Privacy Policy is published by a6stra ("we", "Platform") and applies to all users who access or use the a6stra platform, including the official website at a6stra.net, mobile apps for iOS and Android, and all related services.

This document is drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA, Act 709) and internationally recognised data protection standards. We believe every user deserves to know exactly how their information is managed — not just vague answers wrapped in confusing legal language.

By using the a6stra platform, you agree to the data collection and usage practices described in this Privacy Policy. If you do not agree with any part of this policy, please stop using the platform immediately and contact us to close your account.

This policy should be read together with Terms and Conditions a6stra, which forms part of the overarching agreement between you and our platform.

A6stra only collects information that is genuinely necessary to provide a safe, compliant, and high-quality service. The following are the categories of information we collect:

Information You Provide Directly:

• Registration information: Full name, email address, phone number, date of birth, and the password you set.
• Identity verification information (KYC): A copy of your identity document (MyKad), a selfie for facial verification, and any other supporting documents required to fulfil our compliance obligations.
• Financial information: Bank account details, e-wallet account numbers (Touch 'n Go, GrabPay), and deposit and withdrawal transaction records.
• Communication with us: Live chat conversation records, support emails, and feedback you submit to our team.

Automatically Collected Information:

• Technical data: IP address, device type, operating system, browser version, screen resolution, and language settings.
• Usage data: Pages visited, games played, session duration, login frequency, and interactions with platform buttons or features.
• Location data: General geographic location based on IP address for geo-compliance and account security purposes.
• Cookie data: Session cookies, preference cookies, and device identifiers to enhance user experience.

Every piece of data we collect is used for a specific and legitimate purpose. We do not use your data for purposes unrelated to the services you have chosen to use. The following outlines each purpose of data use in detail:

• Account management: To create, verify, and manage your account on the a6stra platform, including the KYC process required by regulations.
• Transaction processing: To process your deposits and withdrawals securely and accurately, and to resolve any transaction disputes that may arise.
• Security & fraud prevention: To detect suspicious activity, prevent unauthorised access, and protect your account from misuse.
• Legal compliance: To fulfil legal obligations, including anti-money laundering (AML) requirements and identity verification mandated by the relevant authorities.
• Service improvement: To analyse aggregated usage patterns in order to improve platform performance, enhance the user interface, and introduce more useful new features.
• Service communications: To send important notifications related to your account, including transaction confirmations, security alerts, and material updates to our terms.
• Customer support: To resolve complaints, respond to enquiries, and provide the technical assistance you need.
• Marketing (with consent): To send you promotional information, bonus offers, and platform news — only if you have given explicit consent to receive such communications.

A6stra does not sell, does not rent, and does not trade your personal information to any third party for commercial purposes. However, there are limited situations where we may need to share your information, namely:

All third parties we work with are bound by strict data protection agreements and are only permitted to use your information for the purposes specified in those agreements. We ensure every partner adheres to data security standards equal to or higher than our own.

A6stra continuously invests in the latest security infrastructure to ensure your personal data is always protected. The key security measures we implement include:

• Data encryption in transit: All communications between your device and a6stra's servers are protected using TLS 1.3 protocol and 256-bit SSL encryption, ensuring no third party can intercept your data in transit.
• Data encryption at rest: Sensitive data such as identification document details and banking information is stored in encrypted format using the internationally recognised AES-256 standard.
• Two-factor authentication (2FA): 2FA is available for all accounts to add an extra layer of protection during the Login process.
• 24/7 security monitoring: Our security team continuously monitors systems to detect and respond to any threats or unusual activity.
• Internal access controls: Access to user data within a6stra is restricted based on the principle of least privilege — only staff who genuinely require access are permitted.
• Regular security audits: Our platform undergoes regular penetration testing and independent security audits to identify and address any potential vulnerabilities.

While we take all reasonable steps to protect your data, no system can guarantee absolute security. In the event of a data breach affecting your information, we will notify you within 72 hours of becoming aware of it, in line with international data protection best practices.

A6stra uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit our platform.

Types of cookies we use:

• Session cookies (required): These cookies are required for the platform to function properly, including maintaining your login status during active sessions. They cannot be disabled without affecting core platform functionality.
• Preference cookies: Stores your personal settings such as preferred language, display theme, and game configuration so you do not need to reconfigure them each time you log in.
• Analytics cookies (anonymised): Helps us understand how users interact with the platform in aggregate, without identifying specific individuals, for continuous improvement purposes.
• Security cookies: Used to detect suspicious activity, prevent fraud, and protect the integrity of your account.

You can manage your cookie settings through your web browser at any time. However, disabling certain cookies may affect the functionality of some parts of the a6stra platform.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal information held by a6stra:

To exercise any of the above rights, contact our data protection team via live chat or email. We will process your request within 30 calendar days.

A6stra retains your personal data only for as long as necessary to fulfil the original purpose for which it was collected, or as required by applicable law.

• Active account data: Retained for the duration your account is active and for a reasonable period after account closure.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's Anti-Money Laundering (AMLA) legal requirements and tax regulations.
• KYC documents: Retained for 5 years after the date of termination of the business relationship, or longer if required by the relevant authorities.
• Support communication logs: Retained for 2 years for reference and dispute resolution purposes.
• Cookie and analytics data: Session data is deleted after each session ends; aggregated analytics data is retained indefinitely in a non-personally identifiable form.

When data is no longer needed, we will securely delete it using irreversible deletion methods. To request early deletion ahead of the standard retention period, please contact our team — we will process your request taking into account all applicable legal obligations.

A6stra reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments. Whenever this policy is updated, the "Last Updated" date at the top of this document will be revised to reflect the date of the latest amendment.

For material and significant changes, we will notify you through one or more of the following methods:

• In-platform notifications appearing upon your next login.
• Email sent to the address registered in your account.
• Notices prominently displayed on the platform's main page for a reasonable period.

Continued use of the a6stra platform after any changes to this policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints about how a6stra handles your personal data, our Data Protection Officer (DPO) team is ready to assist.

You can reach us through the following methods:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom right corner of the platform.
• Email: Send your privacy enquiries to [email protected] — we will respond within 2 business days.
• Help Centre: Visit the FAQ us for answers to frequently asked questions about privacy and account security.

If you believe your complaint has not been resolved satisfactorily by a6stra, you have the right to file a formal complaint with the Department of Personal Data Protection Malaysia under PDPA 2010.