Your Privacy Matters
at 666bt

1 Introduction

Welcome to the 666bt Privacy Policy. 666bt is a premier online betting and casino platform serving players across Bangladesh. This Privacy Policy applies to all individuals who access or use the 666bt website, mobile interface, betting platform, live casino, slot games, crash games, and all associated features and services (collectively, the "Platform").

This document explains in plain English: what categories of personal information we collect from you; the specific purposes for which that information is used; the circumstances under which it may be disclosed to third parties; the security measures in place to protect it; how long we retain it; and the rights you can exercise in relation to your own personal data at any time.

By registering an account on 666bt or by continuing to use the Platform after this Privacy Policy has been published or updated, you acknowledge that you have read and understood this document in full and you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should discontinue your use of the Platform immediately.

2 Data Controller

For the purposes of this Privacy Policy, 666bt is the data controller responsible for your personal data. As the data controller, 666bt determines the purposes for which and the means by which personal data is processed. All enquiries relating to data protection, including requests to exercise your data rights, should be directed to the 666bt data protection contact as set out in Section 15 of this document.

666bt operates as an offshore online gaming platform. The registered business address of the operating entity is available upon written request to our compliance team, subject to identity verification. Please contact us via the email address provided in Section 15.

3 Data We Collect

The categories of personal data that 666bt may collect from you, or about you, during the course of your use of the Platform are set out in the table below. The specific data collected in your case will depend on which features of the Platform you use and the level of verification your account has reached.

3.1 Sensitive Data

666bt does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request or a gambling harm support enquiry. Any such information is treated with the highest level of confidentiality and is used solely for the purpose for which it was disclosed.

4 How We Collect Your Data

666bt collects personal data through three primary channels:

4.1 Directly From You

The majority of personal data we hold is provided directly by you in the course of using the Platform. This includes data entered during account registration, identity verification document uploads, payment method setup, support communications, bonus claim forms, and any updates you make to your account settings or preferences.

4.2 Automatically Through Technology

When you visit and interact with the 666bt Platform, certain technical and behavioural data is collected automatically by our systems. This includes your IP address, device fingerprint data, browser information, session duration, pages visited, and game activity logs. This data is collected using server logs, cookies, and similar tracking technologies as described in Section 7.

4.3 From Third-Party Service Providers

In limited circumstances, 666bt may receive personal data about you from third-party service providers engaged to support the Platform's operations. These include:

• Identity verification and KYC service providers, who may confirm the authenticity of identity documents you submit.
• Payment processing partners (including mobile wallet operators such as bKash, Nagad, and Rocket), who confirm transaction status and payment method details.
• Fraud detection and anti-money-laundering screening services, which may flag accounts against watch lists or risk databases.
• Analytics service providers, which help us understand aggregated Platform usage patterns to improve user experience.

In each case, third-party data sharing is governed by data processing agreements that obligate those third parties to handle your data securely and only for the specified purpose.

5 Purpose & Legal Basis for Processing

666bt processes your personal data only for defined, lawful purposes. The table below sets out the main purposes for which we process your data, together with the legal basis that justifies each processing activity.

6 Data Sharing & Third Parties

666bt does not sell, rent, or trade your personal data to any third party. Data is shared externally only in the specific circumstances described in this section, and only to the extent necessary for the stated purpose.

6.1 Service Providers

We engage carefully selected third-party service providers to assist us in operating the Platform. These providers may process personal data on our behalf as data processors, strictly in accordance with our instructions and under binding data processing agreements. Categories of service providers include:

• Payment Processors — bKash, Nagad, Rocket, Upay, and international card processing partners for transaction handling.
• KYC Providers — Identity verification and document authentication services.
• Fraud & AML — Anti-fraud and anti-money-laundering screening platforms.
• IT Infrastructure — Cloud hosting, database management, and cybersecurity providers.
• Analytics — Aggregated, anonymised Platform usage analytics providers.
• Customer Support — Live chat and ticketing system providers used to deliver player support.

6.2 Game Content Providers

Games on the 666bt Platform are provided by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, limited technical session data (such as session token and stake data) may be passed to the relevant game provider to facilitate game delivery. These providers are not permitted to use this data for their own marketing or profiling purposes.

6.3 Legal Disclosures

666bt may disclose personal data to law enforcement agencies, regulatory bodies, or other authorised third parties where required to do so by applicable law, by court order, or in connection with the investigation of fraud, money laundering, match fixing, or other criminal activity. We will notify you of any such disclosure where permitted by law to do so.

6.4 Business Transfers

In the event that 666bt or its operating entity undergoes a merger, acquisition, restructuring, or asset sale, personal data held by 666bt may be transferred to the acquiring entity as part of that transaction. In such circumstances, we will notify affected users prior to the transfer and, where required, seek fresh consent for any material changes to how their data is processed.

7 Cookies & Tracking Technologies

666bt uses cookies and similar tracking technologies to operate the Platform effectively, to remember your preferences, to maintain your login session, and to understand how users navigate the site. The types of cookies we use are described below.

Strictly necessary cookies cannot be disabled as they are essential to the functioning of the Platform. You may disable functional, analytical, and marketing cookies through your browser settings. Note that disabling certain cookies may affect your experience of the Platform — for example, you may need to re-enter preferences on each visit.

8 Data Retention

666bt retains personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal, regulatory, and operational requirements. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your account being active on the Platform, plus a minimum of 5 years following account closure to satisfy anti-money-laundering and fraud prevention record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of 5 years from the date of submission, in line with standard AML record-keeping obligations.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction.
• Customer Support Records: Retained for 3 years from the date of the support interaction, unless the interaction is linked to an open compliance, fraud, or legal matter, in which case it is retained for the duration of that matter plus 2 years.
• Marketing Preferences: Retained for the duration of your account. If you opt out of all marketing, your opt-out record is retained indefinitely to ensure we do not contact you again without fresh consent.
• Technical & Session Logs: Retained for up to 12 months for security and performance monitoring purposes, after which they are either deleted or anonymised.

On expiry of the applicable retention period, personal data is securely deleted from our systems or irreversibly anonymised so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical and research purposes.

9 Data Security

666bt implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 666bt servers.
• Encryption of sensitive data fields (including identity document copies and financial data) at rest.
• Role-based access controls that restrict employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for all internal staff accessing production systems.
• Regular automated vulnerability scans and periodic penetration testing by independent security professionals.
• Segregated network architecture to prevent lateral movement in the event of a security incident.
• Incident response procedures that enable us to detect, contain, and report data breaches promptly.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, 666bt will notify affected users without undue delay using the contact details held on your account, and will take all reasonable steps to mitigate the impact of the breach.

10 Your Data Rights

As a user of the 666bt Platform, you hold a number of rights in relation to your personal data. 666bt is committed to honouring these rights promptly and without charge. The rights available to you are summarised below:

• Right of Access: You have the right to request a copy of all personal data that 666bt holds about you. We will provide this in a structured, commonly used format within 30 days of your request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For most account data, you can update this directly within your account settings without needing to contact us.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing based on legitimate interest. Note that this right is subject to overriding legal retention obligations — for example, we are required to retain transaction records for anti-money-laundering purposes and cannot erase these upon request.
• Right to Restrict Processing: You may request that we restrict the processing of your data in certain circumstances — for example, while the accuracy of your data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, you have the right to receive your personal data in a portable, machine-readable format so that you can transfer it to another service.
• Right to Object: You have the right to object at any time to the processing of your personal data where that processing is based on legitimate interest. You also have the right to object to the processing of your data for direct marketing purposes at any time, without giving any reason.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.1 How to Exercise Your Rights

To exercise any of the rights listed above, please submit a written request to the 666bt data protection contact at [email protected]. Please include your registered username and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing your request. We will respond to all valid requests within 30 days. Where a request is complex or numerous, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reasons for it.

11 Marketing Communications

Where you have opted in to receive marketing communications at the time of registration or subsequently through your account settings, 666bt may contact you by email or SMS with information about promotions, bonuses, new games, seasonal offers (such as Eid or Pohela Boishakh specials), BPL match betting opportunities, and other Platform news. All marketing communications will clearly identify 666bt as the sender and will include a straightforward mechanism to opt out of future communications.

11.1 Opting Out

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email sent by 666bt.
• Updating your communication preferences in the notifications section of your 666bt account settings.
• Contacting our support team at [email protected] with a written opt-out request.

Opt-out requests will be processed within 5 business days. Please note that opting out of marketing communications does not affect our ability to send you transactional or service-related communications, such as deposit confirmations, withdrawal notifications, account security alerts, or important policy updates. These non-marketing communications are an essential part of the service and cannot be disabled.

11.2 No Third-Party Marketing

666bt does not share your personal data with third parties for the purpose of those third parties sending you marketing communications about their own products or services. Your contact details will only ever be used by 666bt to communicate with you directly about the 666bt Platform.

12 Minors & Under-Age Users

The 666bt Platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Registration requires users to confirm they are 21 or older, and identity verification procedures are in place to detect and prevent underage access.

If 666bt becomes aware — through identity verification, a third-party report, or any other means — that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant account, return any funds to the deposited payment method, and permanently delete all personal data associated with that account from our systems.

13 International Data Transfers

As an offshore platform serving players in Bangladesh, 666bt's operations involve the storage and processing of personal data on servers that may be located outside Bangladesh. When personal data is transferred internationally, 666bt ensures that appropriate safeguards are in place to maintain the same standard of protection that applies within the Platform's core operational jurisdiction.

Safeguards used for international data transfers include:

• Standard contractual clauses incorporated into data processing agreements with all third-party service providers handling personal data outside the primary hosting jurisdiction.
• Technical controls including end-to-end encryption of data in transit and at rest during cross-border transfers.
• Vendor due diligence assessments to confirm that third-party providers operating in different jurisdictions maintain security standards equivalent to those required by 666bt's internal data protection policy.

By using the 666bt Platform, you acknowledge and consent to your personal data being transferred to and processed in countries other than Bangladesh in the manner described in this section. If you have any concerns about international data transfers, please contact us using the details provided in Section 15.

14 Changes to This Privacy Policy

666bt reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates to our data processing practices, new features introduced on the Platform, changes in applicable law, or guidance issued by relevant data protection authorities. The effective date at the top of this document will always reflect when the most recent version came into force.

When material changes are made to this Privacy Policy — that is, changes that significantly affect how we collect, use, or share your personal data — we will notify you by email to your registered address and by placing a prominent notice on the Platform for a period of at least 14 days before the changes take effect. For minor or administrative changes that do not materially alter your rights, we may update this document without prior notice, though the effective date will always be updated.

Your continued use of the Platform after an updated Privacy Policy has come into effect constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how 666bt handles your personal data. Previous versions of this Privacy Policy are available upon written request to [email protected].

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 10, please contact the 666bt data protection team using the following details:

• Email: [email protected]
• Subject Line: Please use "Privacy Request — [Your Username]" in the subject line of your email so our team can prioritise your enquiry correctly.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full response within 30 days.
• Support Hours: 24 hours a day, 7 days a week, including public holidays in Bangladesh.
• Language: All privacy-related correspondence is handled in English.

When submitting a data rights request, please include your registered username, a clear description of the right you wish to exercise, and any relevant details that will help us locate and process your personal data accurately. We may ask you to verify your identity before processing your request in order to protect you against unauthorised access to your data.