Privacy Policy — How 666y Collects, Uses and Protects Your Personal Data

1 Introduction and Scope

666y ("we", "us", "our") is committed to protecting and respecting the privacy of every person who uses our platform. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by 666y. It describes the categories of data collected, the purposes for which it is used, the conditions under which it may be disclosed to third parties, and the rights available to you in respect of your personal data.

This Policy applies to all users of the 666y website located at https://666y.io, including registered account holders and visitors who browse the platform without registering. It covers data collected through the website interface, payment processing flows, customer support interactions, marketing communications, and any other touchpoint between you and 666y.

By accessing or using the 666y platform, you confirm that you are at least 21 years of age and that you consent to the data practices described in this Policy. If you do not agree with this Policy, you must discontinue your use of the platform immediately.

2 Personal Data We Collect

666y collects personal data through several channels: directly from you when you register an account or contact support; automatically as you interact with the platform; and from third-party verification and payment partners. The categories of data we collect are described in the table below.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than identity document photographs required for KYC), or health data, except where you voluntarily disclose health-related information in the context of a responsible gaming self-exclusion request.

3 How We Use Your Personal Data

666y processes your personal data for the following specific purposes. We will not use your data for any purpose that is incompatible with the purpose for which it was originally collected without first notifying you and, where required, obtaining your consent.

• Account Creation and Management: To register your account, verify your identity, maintain your player profile and provide access to the full range of 666y platform features.
• Payment Processing: To process deposits made via bKash, Nagad, Rocket, Upay and approved bank transfers, and to process withdrawal requests back to your registered payment method.
• KYC and Fraud Prevention: To verify that you meet the eligibility requirements set out in the Terms & Conditions, to detect and prevent fraudulent activity, multi-accounting, money laundering, and any other prohibited conduct.
• Platform Personalisation: To remember your language and display preferences, to surface game recommendations relevant to your playing history, and to tailor promotional offers to your activity profile.
• Customer Support: To respond to your enquiries, complaints and support requests, and to maintain a record of communications for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor play patterns for signs of problem gambling behaviour and to administer responsible gaming tools including deposit limits, cooling-off periods and self-exclusion at your request.
• Legal and Regulatory Compliance: To fulfil our obligations under applicable anti-money laundering, counter-terrorism financing, and financial crime prevention requirements. This may include reporting certain transactions or account activity to relevant authorities.
• Platform Security and Integrity: To detect and investigate suspicious activity, protect the security of the 666y platform and its users, and enforce our Terms & Conditions.
• Marketing Communications: To send you promotional offers, bonus notifications and platform updates by email or in-platform notification, where you have opted in to receive such communications. See Section 11 for details on managing your marketing preferences.
• Analytics and Improvement: To analyse aggregated, anonymised usage data to understand how players interact with the platform, identify performance issues, and guide product development decisions.

4 Legal Basis for Processing

666y processes your personal data on one or more of the following legal grounds, depending on the specific processing activity involved:

• Performance of a Contract: Processing that is necessary to create and administer your 666y account, process your transactions and deliver the services described in the Terms & Conditions.
• Compliance with a Legal Obligation: Processing required to fulfil applicable legal and regulatory requirements, including identity verification, transaction monitoring and regulatory reporting obligations.
• Legitimate Interests: Processing carried out in pursuit of 666y's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring and product improvement — where those interests are not overridden by your rights and interests.
• Consent: Processing activities for which you have provided your explicit, freely given and informed consent — primarily the sending of marketing communications. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

5 Sharing Your Personal Data

666y does not sell, rent or otherwise commercially exploit your personal data. We may share your data with third parties only in the following limited circumstances, and only to the extent strictly necessary:

• Payment Processors: bKash, Nagad, Rocket, Upay and approved banking partners receive the minimum account and transaction data necessary to process your deposits and withdrawals. All payment partners are contractually bound to process your data solely for payment purposes and to maintain appropriate security standards.
• Identity Verification Providers: Third-party KYC and identity verification services receive identity document data and biometric photographs solely for the purpose of verifying your eligibility to use the platform. Data shared with these providers is not used for any other purpose.
• Technology and Hosting Partners: Cloud infrastructure and platform technology providers who host the 666y platform and its databases may process personal data in the course of delivering their services. All such providers operate under data processing agreements that restrict their use of personal data.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi may receive anonymised session identifiers necessary to deliver their game content. These providers do not receive personally identifiable information such as your name, address or payment details.
• Law Enforcement and Regulatory Bodies: Where required or permitted by applicable law, 666y may disclose personal data to government authorities, law enforcement agencies or financial intelligence units for the purposes of legal compliance, fraud investigation or regulatory supervision. Such disclosures are made only to the extent legally required and are documented internally.
• Business Transfers: In the event of a merger, acquisition, asset sale or restructuring of 666y's business operations, personal data held by 666y may be transferred to the successor entity. You will be notified of any such transfer that materially affects your data rights.

6 Cookies and Similar Technologies

The 666y website uses cookies and similar browser-based technologies to provide a functional, personalised and secure experience. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on the 666y platform:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, load-balancing cookies and security tokens. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences such as display settings and responsible gaming tool configurations. These cookies do not track your activity across other websites.
• Analytics Cookies: Used to collect anonymised, aggregated data about how players navigate and use the platform. This data is used internally to identify usability issues and inform product improvements. 666y does not share analytics data with third-party advertising networks.

666y does not use third-party advertising cookies, retargeting pixels, or any tracking technology that follows your activity across external websites. You may manage or disable non-essential cookies through your browser settings at any time, though doing so may affect certain platform features.

7 Data Retention

666y retains personal data for the minimum period necessary to fulfil the purposes outlined in this Policy, subject to any longer retention period required by law or regulation. The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship, plus a period of five years following account closure to satisfy anti-money laundering record-keeping obligations.
• Transaction Records: Financial transaction records are retained for a minimum of seven years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC and Identity Documents: Retained for five years following account closure or the completion of the relevant verification event, whichever is later.
• Customer Support Communications: Retained for three years from the date of the interaction, or longer where the communication relates to an open dispute or legal matter.
• Marketing Preferences: Retained until you withdraw your consent or request deletion. Records of consent withdrawal are retained for three years to demonstrate compliance.
• Usage and Analytics Data: Anonymised analytics data may be retained indefinitely. Identifiable usage logs are retained for twelve months.

When data reaches the end of its applicable retention period, it is securely deleted or irreversibly anonymised. Deletion requests submitted by players are processed within 30 calendar days, subject to any applicable legal hold requirements.

8 Your Data Rights

As a 666y account holder, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request. We will acknowledge all valid requests promptly and provide a substantive response within 30 calendar days.

Please note that certain rights are subject to conditions and exceptions under applicable law. For example, erasure requests cannot override legal data retention obligations, and access requests may be subject to identity verification before data is disclosed. We will explain any applicable limitations when responding to your request.

9 Data Security Measures

666y implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and 666y servers is encrypted using industry-standard TLS 1.2 or higher protocols.
• Encryption at Rest: Sensitive data fields including payment details, identity document data and passwords are stored in encrypted form using strong cryptographic algorithms. Passwords are stored as salted hashes and are never stored or transmitted in plaintext.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Intrusion Detection and Monitoring: The 666y platform operates continuous security monitoring to detect and respond to anomalous access patterns, unauthorised login attempts and potential data breaches in real time.
• Penetration Testing: The platform undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident Response: In the event of a data security incident that is likely to affect your rights and interests, 666y will notify affected players promptly and take all necessary remedial action.

While 666y takes all reasonable precautions to secure your data, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying 666y promptly if you suspect any unauthorised access to your account.

10 Children's Privacy

The 666y platform is strictly for individuals aged 21 years and above. 666y does not knowingly collect, store or process personal data belonging to persons under the age of 21. If you are under 21 years of age, you must not use the 666y platform or submit any personal data to 666y.

If 666y becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted immediately and the associated account will be permanently closed without right of appeal. If you believe that 666y may have inadvertently collected data from a minor, please contact us at [email protected] immediately.

11 Marketing Communications

666y may send you promotional emails and in-platform notifications about bonuses, new games, seasonal offers tied to events such as the BPL, IPL, Eid, Pohela Boishakh and Victory Day, and other platform news. Marketing communications are sent only to players who have actively opted in to receive them during registration or through their account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your account dashboard after 666y Login
• Clicking the unsubscribe link included in any marketing email
• Contacting the support team at [email protected] with a request to opt out

Withdrawal of marketing consent will not affect the delivery of transactional or account-management communications, such as deposit confirmations, withdrawal notifications, security alerts or responses to your support enquiries. These communications are sent on the basis of contract performance and cannot be opted out of while your account remains active.

12 Changes to This Privacy Policy

666y reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, operational requirements or applicable regulations. The revised Policy will be published on this page with an updated effective date at the top of the document.

Where changes to the Policy are material — meaning they significantly affect the way in which your personal data is collected or used — 666y will notify registered account holders via the email address associated with their account at least seven days before the revised Policy takes effect. Your continued use of the 666y platform after the revised Policy is published constitutes your acceptance of the updated terms.

We encourage you to review this page periodically to stay informed of how 666y protects your personal data. The current effective date is always displayed in the document header and in the table of contents sidebar.

13 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a concern about the way in which 666y is handling your personal data, please contact our Data Protection team through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available inside your account dashboard after 666y Login, staffed 24 hours a day, 7 days a week
• Response Language: All enquiries submitted in English will be answered in English
• Support Hours: Bangladesh Standard Time (BST, UTC+6), around the clock

Please include your registered account username and a clear description of your request or concern when contacting us. For data access, rectification or erasure requests, we may require you to verify your identity before we can process the request. We aim to respond to all data-related enquiries within five business days and to resolve them fully within 30 calendar days.