six66 Privacy Policy —
How We Protect Your Data

1. Data Controller

For the purposes of this Privacy Policy, the data controller responsible for the processing of personal data collected through the six66 platform is the operator of the six66 brand. References to "six66", "we", "us", or "our" throughout this policy refer to the platform operator and its authorised representatives. For all data-related enquiries, you may contact us via live chat on the platform or at the support email address listed in Section 15 of this policy.

2. Data We Collect

Depending on how you interact with six66, we may collect the following categories of personal data:

2.1 Identity & Contact Data

• Full legal name
• Date of birth
• Residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or other)
• Mobile phone number
• Email address
• National ID (NID) number or passport number (for KYC verification)

2.2 Financial Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers (used for transaction processing only)
• Visa / Mastercard card type and last four digits (full card numbers are not stored on six66 servers)
• Deposit and withdrawal transaction history in BDT (৳)
• Account wallet balance history

2.3 Account & Activity Data

• Username and encrypted password hash
• Betting history, game session data, and casino activity logs
• Bonus and promotion usage history
• Responsible gaming settings (deposit limits, self-exclusion status, session time limits)
• Customer support correspondence and live chat transcripts

2.4 Technical & Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session timestamps and duration
• Cookie identifiers and similar tracking technologies (see Section 10)

3. How We Collect Data

six66 collects personal data through the following channels:

• Direct submission: when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or update your account profile.
• Automated collection: via cookies, server logs, and session tracking as you navigate and interact with the platform.
• Third-party sources: from payment processors (bKash, Nagad, Rocket, Visa, Mastercard) who confirm transaction status; from identity verification providers who validate KYC documents; and from fraud prevention services that flag suspicious activity patterns.
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may pass session-level data to six66 for bet settlement, jackpot tracking, and responsible gaming monitoring.

4. How We Use Your Data

We process personal data for the following purposes. The table below maps each purpose to the data category and legal basis used:

5. Legal Basis for Processing

six66 processes personal data only where a valid legal basis exists. The principal bases we rely on are as follows:

• Contractual necessity: processing required to fulfil our obligations to you under the account agreement — including account creation, transaction processing, and bet settlement.
• Legal obligation: processing required to comply with applicable laws — including anti-money-laundering regulations, age verification obligations, and reporting requirements.
• Legitimate interest: processing that serves six66's genuine business interests (such as fraud prevention, platform security, and service improvement) where those interests are not overridden by your privacy rights.
• Consent: processing that you have explicitly agreed to — principally the sending of marketing and promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

six66 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share personal data with the following categories of recipients, and only to the extent necessary:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard — to facilitate BDT deposits and withdrawals.
• Game providers: Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe — to deliver live casino and slot game services and process bet outcomes.
• Identity verification providers: third-party KYC service providers who validate NID, passport, and age documentation.
• Fraud and AML screening services: providers that screen transactions and account activity against sanctions lists and known fraud patterns.
• IT infrastructure providers: hosting, database, and content delivery network (CDN) providers that support the technical operation of six66.
• Legal and regulatory authorities: where required by applicable law, court order, or regulatory direction.
• Professional advisers: lawyers, auditors, and accountants, where required for business operations and under strict confidentiality obligations.

All third parties with whom we share personal data are required to process that data only for the specific purpose for which it was shared and to maintain appropriate security standards.

7. International Data Transfers

The operation of the six66 platform may involve the transfer of personal data to service providers located outside Bangladesh, including in countries where data protection standards may differ from those applied locally. Where such transfers occur, six66 ensures that appropriate contractual safeguards are in place — such as standard data protection clauses — to protect your personal data to a standard consistent with this Privacy Policy. If you have questions about specific international transfer arrangements, please contact us via the details in Section 15.

8. Data Retention

six66 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our principal retention periods are as follows:

• Active account data: retained for the duration of your account plus a period of up to seven years following account closure, to satisfy legal and regulatory requirements.
• Transaction records (BDT deposits, withdrawals, bets): retained for a minimum of five years from the date of each transaction, in accordance with anti-money-laundering best practices.
• KYC verification documents: retained for a minimum of five years from the date of verification or from account closure, whichever is later.
• Customer support communications: retained for three years from the date of each interaction.
• Marketing consent records: retained for the duration of your consent and for two years after withdrawal, as evidence of your preference history.
• Technical logs and device data: retained for up to 90 days for security and fraud monitoring purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual.

9. Security Measures

six66 implements a range of technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive stored data including identity documents and financial records.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular security audits and vulnerability assessments of platform infrastructure.
• Two-factor authentication options available to players for account login.
• Continuous fraud monitoring and anomaly detection systems.

While six66 takes all reasonable steps to protect your data, no method of electronic transmission or storage is entirely without risk. In the event of a data security incident that materially affects your personal data, six66 will notify affected players promptly and take immediate remediation steps.

10. Cookies & Tracking Technologies

10.1 What Cookies We Use

six66 uses cookies and similar tracking technologies (such as pixel tags and local storage) to operate and improve the platform. The principal types of cookies we use are:

• Essential cookies: necessary for the platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without affecting platform functionality.
• Functional cookies: used to remember your preferences such as language, odds format, and previously viewed game categories.
• Analytics cookies: used to understand how players navigate the platform — which pages are visited most, where sessions typically begin and end, and how features are used. This data is used in aggregate and anonymised form.
• Fraud prevention cookies: used by our security systems to detect unusual patterns of behaviour that may indicate fraudulent account use.

10.2 Managing Cookies

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will prevent the six66 platform from operating correctly, and you will be unable to log in or place bets. Disabling functional or analytics cookies will not affect your ability to use core platform features. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

11. Your Privacy Rights

Depending on applicable data protection law, you may have the following rights in relation to your personal data held by six66:

• Right of access: the right to obtain a copy of the personal data we hold about you.
• Right to rectification: the right to request correction of inaccurate or incomplete personal data.
• Right to erasure: the right to request deletion of personal data where it is no longer necessary, or where you withdraw consent (subject to legal retention obligations).
• Right to data portability: the right to receive personal data in a structured, machine-readable format for transfer to another service.
• Right to restrict processing: the right to request that we limit processing of your data in certain circumstances.
• Right to object: the right to object to processing based on legitimate interest, including profiling for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, please contact the six66 support team via live chat or email. We will respond within 30 days of receiving a valid request. We may need to verify your identity before processing a rights request. Some rights may be subject to limitations where legal obligations require us to retain or continue processing certain data.

12. Children & Minors

The six66 platform is strictly prohibited to individuals under the age of 21 years. We do not knowingly collect personal data from anyone under 21. If we become aware that personal data has been provided by or on behalf of an individual under this age, we will immediately suspend the relevant account, return any deposited funds, and delete all associated personal data. If you believe that a minor has registered an account on six66, please contact our support team immediately so we can take appropriate action.

13. Marketing Communications

six66 may send you promotional communications relating to cricket betting offers, BPL event specials, slot bonuses, casino promotions, and seasonal campaigns (such as Eid, Pohela Boishakh, or Victory Day specials) only where you have given explicit prior consent to receive such messages. Marketing communications may be sent via SMS to your registered Bangladeshi mobile number, or via email to your registered address.

You may withdraw your marketing consent at any time by updating your preferences within your account settings, or by contacting the six66 support team via live chat. Withdrawal of marketing consent does not affect your ability to use the platform or receive essential transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts).

14. Changes to This Policy

six66 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, new purposes for processing, or new third-party recipients — we will notify registered players via their contact details on file, or by displaying a prominent notice on the platform, at least seven days before the changes take effect. The effective date at the top of this policy will always reflect the date of the most recent version. Continued use of the six66 platform after the effective date of any amendment constitutes acceptance of the revised policy.

15. Contact & Complaints

If you have questions, concerns, or complaints about how six66 handles your personal data, or if you wish to exercise any of your privacy rights, you may contact us through the following channels:

• Live Chat: available 24/7 directly on the six66 platform — average response time 2–5 minutes.
• Support Email: [email protected] (plain text — not a clickable link).
• Operating Hours: 24/7, Bangladesh Standard Time (UTC+6).

We take all privacy complaints seriously and aim to respond fully within 30 days of receipt. If you are not satisfied with our response, you may have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.