Privacy Policy — How 666m Protects Your Data

666m collects personal data across several categories depending on how you interact with the platform. The following table summarises the primary data categories, the specific data points within each, and the context in which they are collected.

Sensitive Data: 666m does not intentionally collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, political opinions, or health data unless specifically required by a responsible gaming programme intervention (for example, a self-exclusion request that references a gambling-related health concern). Where sensitive data is provided voluntarily in this context, it is processed solely for the purpose of delivering the responsible gaming service requested and is not used for any commercial purpose.

Data from Minors: The 666m platform is strictly for individuals aged 18 and above. 666m does not knowingly collect personal data from persons under the age of 18. If we become aware that personal data from a minor has been collected, we will delete it immediately and close the associated account. If you believe a minor has provided data to 666m, please contact us at [email protected] without delay.

666m does not sell, rent, or trade your personal data. We share personal data only in the following limited, controlled circumstances:

• Payment Service Providers: When you make a deposit or withdrawal, the minimum data necessary to process the transaction (such as your registered bKash or Nagad mobile number, or your Visa/Mastercard details) is shared with the relevant payment provider. These providers process your payment data under their own privacy policies and are contractually required to handle your data securely and only for the purpose of processing the transaction.
• Game Studio Providers: When you play a live casino game hosted by a third-party studio (such as Evolution Gaming, Pragmatic Play Live, or Ezugi), a session token and minimal technical data is shared with that provider to authenticate your game session. Game studio providers do not receive your full personal profile; they receive only the data required to deliver the game session you have initiated.
• KYC and Identity Verification Partners: 666m may engage specialist third-party identity verification services to assist with document authentication during the KYC process. These providers are bound by strict data processing agreements and are authorised to use your data only for verification purposes on 666m's behalf.
• Fraud Prevention and Anti-Money-Laundering Services: 666m may share transaction and identity data with third-party fraud prevention platforms and financial intelligence databases to detect and prevent financial crime. These providers process data as data processors under 666m's instruction, not as independent data controllers.
• Legal and Regulatory Authorities: 666m may disclose personal data to competent law enforcement authorities, financial intelligence units, regulatory bodies, or courts when required to do so by applicable law or when 666m has a good-faith belief that disclosure is necessary to comply with a legal obligation, protect the rights or safety of 666m or its players, or prevent financial crime.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of 666m's business, player personal data may be transferred to the acquiring entity as part of that transaction. Players will be notified in advance of any such transfer and of any change to this Privacy Policy that results from it, with a minimum of 30 days' notice before the new policy takes effect.

All third parties with whom 666m shares personal data are subject to data processing agreements or equivalent contractual safeguards that require them to maintain the confidentiality and security of the data shared, use it only for the specified purpose, and comply with applicable data protection standards.

666m retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory requirements, and to resolve disputes or enforce agreements. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active account and for a minimum of 5 years following permanent account closure. This retention period supports anti-money-laundering obligations and allows 666m to respond to regulatory enquiries relating to historical account activity.
• Financial Transaction Records: Retained for a minimum of 7 years following the date of each transaction. This period reflects standard financial record-keeping requirements applicable to payment service operators.
• KYC Verification Documents: Retained for the duration of the account and for 5 years following closure. Where an account was closed due to a compliance breach or confirmed fraud, documents may be retained for longer in support of ongoing investigations or legal proceedings.
• Customer Support Communications: Live chat transcripts, email correspondence, and WhatsApp message records are retained for 3 years following the date of the communication. This period supports dispute resolution and quality assurance.
• Technical and Usage Data: Aggregated, anonymised platform analytics data is retained indefinitely for platform improvement purposes. Non-anonymised session logs and IP address records are retained for 12 months and then deleted or anonymised.
• Marketing Preference Data: Retained for the duration of your active account or until you withdraw consent to marketing communications, whichever is earlier. Suppression records (confirming that you have opted out of marketing) are retained indefinitely to ensure we do not inadvertently contact you again after an opt-out.

When personal data is no longer required and no legal retention obligation applies, it is securely deleted or anonymised in accordance with 666m's data deletion procedures. Deletion requests submitted by players are processed within 30 days, subject to the legal retention obligations described above — data covered by a legal retention obligation cannot be deleted ahead of the applicable retention period even upon player request, but it will be restricted from all non-compliance processing during the retention period.

666m takes the security of player personal data seriously and applies a layered set of technical and organisational security measures designed to protect data against unauthorised access, accidental loss, destruction, and disclosure. These measures include:

• 256-Bit SSL/TLS Encryption: All data in transit between your device and the 666m platform is encrypted using industry-standard TLS protocols. This applies to account login sessions, game sessions, payment flows, and customer support interactions.
• Encryption at Rest: Sensitive data stored in 666m's databases — including identity documents, KYC records, and financial data — is encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the data they protect, using hardware security modules (HSMs).
• Access Controls: Access to 666m's player data systems is restricted to authorised personnel on a strict need-to-know basis. All internal access to personal data is authenticated using multi-factor authentication and is logged for audit purposes. Access privileges are reviewed quarterly and revoked immediately upon staff departure.
• Vulnerability Management: 666m's platform infrastructure undergoes regular security assessments, including automated vulnerability scanning and periodic penetration testing conducted by independent security specialists. Critical vulnerabilities are patched within 24 hours of identification; non-critical vulnerabilities are addressed within a defined remediation schedule.
• Incident Response: 666m maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to player data, affected players will be notified without undue delay and in any case within 72 hours of 666m becoming aware of the breach. Notifications will describe the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address it.
• Staff Training: All 666m staff with access to personal data receive data protection training at onboarding and on an annual basis. Staff are required to adhere to 666m's internal data handling policy and are subject to disciplinary procedures for any confirmed misuse of player data.

Your Role in Security: While 666m takes extensive measures to secure the platform, account security is a shared responsibility. You are responsible for maintaining the confidentiality of your login credentials, not sharing your password with any third party, and notifying 666m support immediately if you suspect unauthorised access to your account. 666m will never ask for your password via email, live chat, or any other communication channel.