Privacy Policy — 666d2

This Privacy Policy applies to the online gaming and sports betting platform operated under the brand name 666d2, accessible at https://666d2.net ("the Platform", "666d2", "we", "us", "our"). 666d2 operates under an international gaming licence and serves registered players across Pakistan.

For the purposes of this Privacy Policy, 666d2 acts as the data controller — meaning we determine the purposes and means by which your personal data is collected and processed. Where we engage third-party service providers to process data on our behalf, those parties act as data processors and are contractually bound to handle your data only as directed by 666d2, in accordance with this policy.

This Privacy Policy should be read in conjunction with 666d2's Terms & Conditions and Responsible Gaming Policy. By registering a 666d2 account and using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

666d2 collects personal data through several channels: directly from you during registration and ongoing account use, automatically through your interaction with the platform, and in certain cases from third-party verification providers we engage for KYC purposes. The categories of personal data we collect are as follows:

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond CNIC photo for identity verification purposes), or health data, unless you voluntarily provide health-related information in the context of a responsible gaming self-exclusion request.

666d2 uses your personal data strictly for the purposes described in this policy. We do not use your data for any purpose that is incompatible with these stated aims without first obtaining your explicit consent. The primary purposes for which we process your personal data are as follows:

• Account registration and management: To create and maintain your 666d2 player account, verify your identity through CNIC-based KYC, and ensure that only the registered account holder accesses the account.
• Payment processing: To facilitate deposits via JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, and to process withdrawal requests to your registered payment accounts in PKR.
• Service delivery: To provide you with access to cricket betting, live casino, slot games, Fortune Bingo, Ganesh Fortune, and all other 666d2 platform features.
• Fraud prevention and security: To monitor platform activity for signs of fraud, money laundering, collusion, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory compliance: To fulfil our obligations under applicable anti-money laundering (AML) requirements, Know Your Customer (KYC) standards, and the conditions of our international gaming licence.
• Responsible gaming: To administer deposit limits, session reminders, cooling-off periods, and self-exclusion tools you activate, and to monitor for behavioural patterns that may indicate problem gambling.
• Customer support: To respond to your queries, process complaints, investigate disputes, and maintain records of all support communications.
• Marketing (with your consent): To send you promotional offers, PSL-related betting promotions, bonus notifications, and platform updates, where you have opted in to receive such communications. You can withdraw marketing consent at any time via your account settings.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, features, and user experience of the 666d2 platform.

Every data processing activity carried out by 666d2 is grounded in one of the following lawful bases. We do not process your personal data without a valid legal justification for doing so.

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted when registering your 666d2 account — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including AML obligations, KYC verification mandates, and reporting requirements under our gaming licence.
• Legitimate interests: Processing carried out to pursue 666d2's legitimate business interests, provided those interests are not overridden by your privacy rights. This includes fraud detection, platform security monitoring, dispute resolution, and anonymised analytics for service improvement.
• Consent: Processing for which you have given a clear, specific, and freely given consent — primarily marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Where processing is based on legitimate interests, 666d2 has carried out a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms. Details of these assessments are available on written request to [email protected].

666d2 shares your personal data only in the specific circumstances described below. In all cases, data sharing is limited to what is strictly necessary for the stated purpose, and all third-party recipients are subject to contractual obligations that require them to protect your data to at least the same standard as 666d2.

• Licensed game providers: Game studios and live casino operators whose products are available on the 666d2 platform receive your player identifier and session data necessary to run game rounds and settle bets. They do not receive your full identity or payment details.
• Payment processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum financial data required to process your deposit or withdrawal transaction. Payment providers are subject to their own regulatory data protection obligations.
• KYC verification providers: Specialist identity verification services process your CNIC data on behalf of 666d2 to confirm your identity and age during the account verification process.
• Regulatory and law enforcement authorities: 666d2 may be required to disclose your data to competent authorities in connection with AML investigations, fraud inquiries, or court orders. Such disclosures are made only to the extent legally required.
• IT infrastructure and hosting providers: Our hosting and technology partners who operate the servers and infrastructure that power the 666d2 platform process data as part of routine infrastructure operations, under strict data processing agreements.

666d2 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or our gaming licence obligations. The retention periods applicable to the main categories of data we hold are set out below.

Once a retention period expires, personal data is securely deleted or anonymised in a manner that prevents its reconstruction. Anonymised, aggregated data (from which you cannot be identified) may be retained indefinitely for platform analytics and statistical reporting purposes.

666d2 uses cookies and similar tracking technologies on the platform to ensure core functionality works correctly, to analyse how players use our services, and — where you have consented — to personalise your experience. A cookie is a small text file placed on your device by your browser when you visit a website.

The types of cookies used on the 666d2 platform are as follows:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in, security tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as preferred language, account settings, and game lobby layout. Disabling these will not prevent you from using the platform but may affect your experience.
• Analytics cookies: Collect anonymised data about how players navigate and interact with the platform — which pages are visited, how long sessions last, and where errors occur. This data is used exclusively to improve the 666d2 platform.
• Responsible gaming cookies: Track session duration on your device to power session time reminder tools when you have activated them in your account settings.

666d2 does not use third-party advertising cookies or allow any external advertising network to place tracking cookies on the platform. You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging into your 666d2 account.

As a registered 666d2 player, you hold a set of rights over your personal data. These rights are available to you at any time and can be exercised by submitting a written request to [email protected]. 666d2 will acknowledge all rights requests within 48 hours and aim to fulfil them within 30 calendar days.

Please note that some rights are subject to exemptions. For example, the right to erasure does not apply where 666d2 is legally required to retain your data under AML regulations or our gaming licence conditions. In such cases, we will explain the applicable exemption in our response to your request.

666d2 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the 666d2 platform is encrypted using TLS (Transport Layer Security) protocol. You will always see HTTPS in your browser address bar when using the platform.
• Encryption at rest: Sensitive data fields — including CNIC numbers, payment account details, and authentication credentials — are encrypted at rest using AES-256 encryption in our database systems.
• Access controls: Access to player personal data within 666d2's internal systems is restricted to authorised personnel whose job roles require it. All internal access is logged and audited.
• Two-factor authentication: 666d2 supports and encourages two-factor authentication (2FA) on player accounts as an additional layer of account security.
• Intrusion detection: 666d2 operates automated intrusion detection and anomaly monitoring systems that flag unusual access patterns for immediate security review.
• Penetration testing: The 666d2 platform undergoes regular third-party security penetration testing to identify and remediate vulnerabilities before they can be exploited.

In the event of a personal data breach that poses a risk to your rights and freedoms, 666d2 will notify affected players without undue delay, and no later than 72 hours after becoming aware of the breach, in accordance with our licensing obligations.

666d2 is an adult-only platform. Registration, access, and use of 666d2 is strictly limited to individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from anyone under the age of 21.

Our CNIC-based KYC verification process is specifically designed to confirm that every active 666d2 account holder is a verified adult meeting our minimum age requirement. Any account where KYC verification reveals that the holder is under 21 years of age will be immediately closed, all funds will be returned to the payment source, and the data will be securely deleted.

If you have reason to believe that a person under 21 has registered or is using a 666d2 account — including a minor in your household — please contact our support team immediately via live chat or at [email protected]. We take under-age gambling concerns with the utmost seriousness and will act promptly on all reports.

666d2 operates under an international gaming licence, and our platform infrastructure, game provider partners, and certain support service providers may be located in jurisdictions outside Pakistan. As a result, your personal data may be transferred to, stored in, and processed in countries other than Pakistan.

When transferring your personal data internationally, 666d2 ensures that appropriate safeguards are in place to protect your data to at least the standard described in this Privacy Policy. These safeguards include:

• Contractual clauses in agreements with all data processors, requiring them to implement equivalent data protection standards.
• Transfers limited to jurisdictions or service providers that operate under equivalent data protection frameworks.
• Regular review of the data protection standards maintained by all international service providers with whom 666d2 shares player data.

By registering a 666d2 account and using our services, you acknowledge and consent to the transfer of your personal data to the jurisdictions in which our service providers and infrastructure partners operate, subject to the safeguards described above.

666d2 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When changes are made, the updated policy will be posted on this page with a revised effective date displayed at the top of the document.

For material changes — meaning changes that significantly affect how your data is collected, used, or shared — 666d2 will provide at least seven (7) calendar days' advance notice to registered players via the email address associated with your account. Your continued use of the 666d2 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

If you do not agree to a revised Privacy Policy, you should cease using the platform and submit a voluntary account closure request to [email protected]. Upon account closure, your data will be retained only for the legally mandated periods described in Section 6 of this policy, and will not be used for any active processing purpose.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 8, or have a concern about how 666d2 has handled your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 in the bottom-right corner of every page on the 666d2 website. For general privacy queries, live chat is the fastest route to a response.
• Email: [email protected] — for formal data access requests, erasure requests, and written complaints. Include your registered username and a clear description of your request or concern to help us respond efficiently.

All formal privacy complaints will be acknowledged within 48 hours of receipt and will receive a substantive written response within fifteen (15) business days. In complex cases where additional investigation is required, 666d2 will notify you of the expected resolution timeframe before the 15-day deadline.

If you are not satisfied with 666d2's response to your privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction applicable under our gaming licence, or to seek independent legal advice regarding your rights.