666dc Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how 666dc ("666dc", "we", "us", "our"), the operator of the online gaming platform accessible at https://666dc.net ("the Platform"), collects, uses, discloses, retains, and protects personal data provided by users ("you", "your", "User", "Player") in connection with the use of the 666dc Platform and its associated services.

This Policy is incorporated by reference into the 666dc Terms & Conditions and should be read alongside them. By registering an account on the 666dc Platform or by continuing to use the Platform after this Policy has been communicated to you, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data in the manner described herein.

666dc is committed to processing personal data in a manner that is transparent, fair, and lawful, and to implementing appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. The Platform serves players primarily across Pakistan — including Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, and beyond — and this Policy has been drafted with the needs and expectations of Pakistani users firmly in mind.

For the purposes of applicable data protection law, 666dc is the data controller of personal data collected through the Platform. As the data controller, 666dc determines the purposes and means of processing your personal data and is responsible for ensuring that processing activities are lawful and appropriately documented.

If you have any questions about how 666dc processes your personal data, or if you wish to exercise any of your data subject rights described in Section 12 of this Policy, please contact us using the details set out in Section 16.

666dc collects the following categories of personal data in connection with the operation of the Platform:

Information you provide when creating a 666dc account, including your full legal name, date of birth, gender, nationality, and national identity number (CNIC) or passport number where required for KYC verification purposes.

Your mobile phone number, email address, and residential address as provided during registration or subsequent account verification. This data is used to communicate with you about your account, process transactions, and deliver support services.

Details of payment methods linked to your 666dc account including JazzCash wallet identifiers, EasyPaisa mobile account numbers, bank account details for HBL, UBL, and Meezan Bank transactions, SadaPay identifiers, and USDT TRC20 wallet addresses. 666dc does not store full card numbers or complete payment credentials — financial transactions are processed through third-party payment processors who maintain their own security certifications.

Records of all deposits, withdrawals, bets placed, games played, bonus activations, and balance history on your 666dc account. This data is maintained as part of 666dc's regulatory and operational records and is essential for the accurate operation of your account.

Copies of identity documents, address verification documents, and payment method ownership documentation submitted to 666dc as part of the Know Your Customer (KYC) process. These documents are retained securely and used solely for the purpose of verifying your identity, age, and right to use the Platform.

Your IP address, device type, operating system, browser type and version, screen resolution, device identifiers, session duration, pages visited within the Platform, and similar technical data collected automatically when you access 666dc. This data is used for security monitoring, fraud prevention, and improving the Platform's performance.

Records of communications between you and the 666dc support team via live chat, email, or any other communication channel, including the content of those communications and timestamps. These records are maintained for quality assurance, dispute resolution, and regulatory compliance purposes.

Records of any responsible gaming tools you activate on your account, including deposit limits set, self-exclusion requests, and cooling-off periods. This data is processed to give effect to your responsible gaming preferences and to comply with 666dc's obligations under its operating licence.

666dc collects personal data through the following means:

• Directly from you — information you provide during account registration, KYC verification, deposit and withdrawal requests, bonus claim processes, and communications with the support team.
• Automatically through Platform use — technical and device data collected via cookies, web beacons, server logs, and similar technologies when you access the 666dc Platform. See Section 9 for detailed cookie information.
• From third-party payment providers — transaction confirmation data and payment status information received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT processors in connection with your deposits and withdrawal requests.
• From identity verification services — where 666dc uses third-party KYC service providers to assist with identity verification, those providers may share verification results and risk assessments with 666dc.
• From fraud prevention and AML services — information from third-party anti-money-laundering screening services used to comply with 666dc's regulatory obligations.

666dc processes your personal data for the following specific purposes:

666dc processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contract performance: Processing necessary to open, maintain, and operate your 666dc account and to deliver the gaming and betting services you have requested.
• Legal obligation: Processing required to comply with 666dc's obligations under its international gaming licence, anti-money-laundering regulations, and other applicable laws — including KYC verification and transaction reporting requirements.
• Legitimate interests: Processing carried out for 666dc's legitimate business interests where those interests are not overridden by your fundamental rights — such as fraud prevention, platform security monitoring, and improvement of the Platform's functionality.
• Consent: Processing of your personal data for marketing and promotional communication purposes, which we carry out only where you have provided clear, specific, and freely given consent. You may withdraw this consent at any time through your account settings or by contacting support.

666dc does not sell your personal data to third parties. We may share your personal data with the following categories of recipients strictly on a need-to-know basis and only to the extent necessary for the specified purpose:

• Payment processing partners — JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and crypto processing services, for the purpose of executing deposits and withdrawals on your behalf.
• Identity and KYC verification providers — third-party services that assist 666dc in verifying the identity and age of account holders as required by its licensing obligations.
• Anti-money-laundering screening services — providers that assist 666dc in conducting the AML checks required under its operating licence.
• Game content providers — software and live casino platform providers whose games are made available on 666dc, to the extent required for game delivery and dispute resolution.
• IT infrastructure and hosting providers — cloud and server infrastructure providers who process data on 666dc's behalf under data processing agreements.
• Regulatory and licensing authorities — 666dc's licensing authority and relevant regulatory bodies, where disclosure is required as part of 666dc's ongoing compliance obligations.
• Law enforcement and government authorities — where 666dc is legally required to disclose information in response to a valid court order, subpoena, or lawful request from a government authority.

Given that 666dc operates as an international online gaming platform, your personal data may be transferred to and processed in countries outside of Pakistan. This may include transfers to jurisdictions where the data protection laws differ from those applicable in Pakistan.

Where such international transfers occur, 666dc takes steps to ensure that your personal data remains protected to a standard consistent with applicable international data protection principles. This may include entering into data transfer agreements with recipient organisations, ensuring that recipients are located in jurisdictions recognised as providing adequate data protection, or implementing other appropriate safeguards as required.

By using the 666dc Platform, you acknowledge and consent to the transfer of your personal data to international destinations as described in this section, subject to the protections described above.

Cookies are small text files placed on your device when you visit a website. The 666dc Platform uses cookies and similar tracking technologies to operate essential Platform functions, remember your preferences, analyse Platform usage patterns, and deliver relevant content.

• Essential cookies: Required for the Platform to function correctly — including session management, login authentication, and security functions. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and regional settings to personalise your 666dc experience.
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform — pages visited, time spent, error messages encountered — helping 666dc improve Platform performance and user experience.
• Security cookies: Used for fraud detection, bot prevention, and maintaining the security integrity of the 666dc Platform and your account.

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to use the 666dc Platform, including logging in to your account. Non-essential cookies can generally be declined or deleted without affecting core Platform functionality.

666dc retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or 666dc's regulatory obligations. The following general retention principles apply:

• Active account data — retained for the duration of your account's active status plus a minimum of five (5) years following account closure, to comply with anti-money-laundering record-keeping requirements.
• KYC and identity verification documents — retained for a minimum of five (5) years from the date of account closure or from the date of the most recent transaction, whichever is later.
• Transaction records — retained for a minimum of five (5) years in accordance with financial regulatory requirements applicable under 666dc's operating licence.
• Customer support communications — retained for three (3) years from the date of the relevant interaction, unless the communication relates to an ongoing dispute in which case it is retained until the dispute is fully resolved.
• Marketing consent records — retained for the duration of your consent plus a reasonable period thereafter to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any individual.

666dc implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL (Secure Sockets Layer) encryption for all data transmitted between your device and 666dc's servers.
• Encryption of sensitive data at rest, including KYC documents and financial account identifiers.
• Role-based access controls limiting internal access to personal data to personnel who require it for their specific job functions.
• Regular security vulnerability assessments and penetration testing of the Platform's technical infrastructure.
• Secure, access-controlled data storage environments with audit logging of all access to personal data systems.
• Multi-factor authentication requirements for internal systems containing personal data.
• Staff training on data protection obligations and security best practices.

Subject to applicable data protection law and certain exceptions, you hold the following rights in relation to your personal data processed by 666dc. To exercise any of these rights, please contact us using the details in Section 16.

666dc will respond to all legitimate data subject rights requests within thirty (30) days of receipt. In complex cases this period may be extended by a further two months, in which case 666dc will notify you of the extension and the reason for it within the initial thirty-day period.

The 666dc Platform is strictly intended for adults aged twenty-one (21) years and over. 666dc does not knowingly collect personal data from individuals under the age of 21. If 666dc becomes aware that personal data has been collected from a person under the minimum age requirement, that data will be deleted promptly and the associated account will be closed.

If you are a parent or guardian and you believe that your child may have provided personal data to 666dc without your knowledge, please contact us immediately using the details in Section 16 and we will take prompt action to investigate and, where confirmed, delete the data in question.

With your consent, 666dc may send you promotional communications about bonuses, new game launches, special offers, and other 666dc platform news via SMS to your registered mobile number, or to your registered email address. This consent is optional and is not a condition of creating or maintaining a 666dc account.

You may withdraw your consent to receive marketing communications from 666dc at any time by:

• Updating your communication preferences in your 666dc account settings.
• Contacting 666dc support via live chat and requesting removal from marketing lists.
• Using the unsubscribe mechanism included in any email communication you receive from 666dc.

Withdrawal of consent for marketing communications will not affect the lawfulness of any marketing processing carried out before your withdrawal, and will not affect your continued receipt of essential service communications about your 666dc account (such as deposit confirmations, withdrawal notifications, and security alerts).

666dc reviews and updates this Privacy Policy periodically to reflect changes in its data processing practices, changes in applicable law, or changes to the Platform's functionality. The most current version of this Policy is always available at https://666dc.net/privacy-policy and is identified by the effective date shown at the top of the document.

Where changes to this Policy are material — meaning they significantly affect how 666dc processes your personal data or the rights available to you — 666dc will provide notice to registered account holders via the contact details held on their account before the updated Policy takes effect. For non-material updates, the revised Policy will be published on the Platform and your continued use of the Platform following publication will constitute your acknowledgement of the update.

For any questions, concerns, or requests relating to this Privacy Policy or to 666dc's handling of your personal data — including the exercise of your data subject rights — please contact the 666dc team through the following channels:

• Live Chat: Available 24/7 within the 666dc Platform at https://666dc.net — the fastest route to a response for all privacy and data queries.
• Email: [email protected] — for written privacy enquiries, data subject rights requests, and data breach reporting. Please include "Privacy" in the subject line of your email to ensure your enquiry is directed to the appropriate team.

666dc will acknowledge receipt of all privacy-related communications within five (5) business days and aims to provide a substantive response or resolution within thirty (30) days.