six66 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how six66 ("six66", "we", "us", or "our") collects, uses, stores, and shares personal data relating to individuals who access or use the six66 Platform — including the website, mobile interface, casino games, sportsbook, live dealer products, and all associated services (collectively, the "Platform").

six66 takes its privacy obligations seriously. We recognise that Pakistani players entrust us with sensitive personal and financial information, and we are committed to handling that information with transparency, security, and respect. This Policy is intended to give you a clear and complete picture of our data practices so that you can make informed decisions about your use of six66.

This Policy should be read alongside the six66 Terms & Conditions and Responsible Gaming Policy, both of which are available on this website and are incorporated into this Policy by reference where relevant.

2 Data Controller

For the purposes of applicable data protection law, six66 is the data controller in respect of personal data collected through the Platform. This means six66 determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that processing is lawful and fair.

If you have questions or concerns about how six66 processes your personal data, or if you wish to exercise any of the rights described in Section 11 of this Policy, you may contact our Data Protection contact point using the details provided in Section 16.

3 Data We Collect

six66 collects personal data in the categories set out below. Not all categories apply to every user — the data we hold about you depends on your level of engagement with the Platform.

We do not intentionally collect sensitive personal data (such as health information, political opinions, or religious beliefs) unless strictly required by regulatory obligation. Where such collection is necessary, we will obtain your explicit consent prior to processing.

4 How We Collect Your Data

six66 collects personal data through the following means:

• Directly from you: When you register a six66 Account, complete identity verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or respond to any communication from six66.
• Automatically through the Platform: Technical and usage data is collected automatically as you access and interact with the six66 Platform, including via cookies, log files, and session tracking technologies (see Section 9).
• From third-party verification providers: When processing your identity verification, six66 may receive confirmation data from licensed Know Your Customer (KYC) and Anti-Money Laundering (AML) service providers.
• From payment processors: Transaction confirmation data is received from JazzCash, EasyPaisa, and partner banking institutions (HBL, UBL, Meezan Bank) when you make deposits or request withdrawals.
• From publicly available sources: Where relevant to fraud prevention or regulatory compliance, we may consult publicly available records or databases.

5 How We Use Your Data

six66 processes your personal data for the following specific purposes:

• Account creation and management: To register, verify, maintain, and close your six66 Account in accordance with our Terms & Conditions.
• Payment processing: To process deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and bank transfer, and to maintain accurate transaction records in PKR.
• Identity and age verification: To verify that you are at least 21 years of age and to confirm your identity as required by our licensing obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeover attempts, and other prohibited conduct on the Platform.
• Customer support: To respond to your queries, resolve complaints, and provide assistance with account issues through our 24/7 live chat and email support channels.
• Regulatory compliance: To fulfil our obligations under applicable anti-money laundering laws, gaming licensing conditions, and financial crime prevention requirements.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the six66 Platform experience for all players.
• Responsible gaming: To monitor player activity for indicators of problem gambling and to apply responsible gaming tools where applicable.
• Marketing communications: To send you promotional offers and news about six66, where you have consented to receive such communications or where we have a legitimate interest in doing so.

6 Legal Basis for Processing

six66 processes your personal data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

• Contract performance: Processing necessary to provide the six66 Platform services to you in accordance with our Terms & Conditions — including account management, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including AML/KYC obligations under our gaming licence framework, tax reporting requirements, and financial crime prevention laws.
• Legitimate interests: Processing for purposes that are in our legitimate business interest and do not override your fundamental rights — including fraud detection, platform security, internal analytics, and responsible gaming monitoring.
• Consent: Where we rely on your consent as the legal basis — for example, for certain marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing already carried out.

7 Data Sharing & Disclosure

six66 does not sell, rent, or commercially license your personal data to any third party. We share data only in the following specific circumstances and only to the extent necessary for the stated purpose:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment processors receive the minimum financial data necessary to execute your deposit or withdrawal transaction.
• Identity verification services: Licensed KYC/AML service providers receive identity documents and verification data under strict confidentiality obligations for the purpose of confirming player eligibility.
• Game providers: Certified third-party game software providers may receive pseudonymised technical data necessary for the operation and audit of their games on the six66 Platform.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory directive, six66 will disclose personal data to competent authorities. We will notify you of such disclosure where legally permitted to do so.
• Fraud prevention agencies: In cases of suspected fraud, money laundering, or other criminal conduct, data may be shared with relevant investigative agencies.
• Corporate transactions: In the event of a merger, acquisition, or asset sale involving six66, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

All third parties with whom six66 shares personal data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than the one for which it was disclosed.

8 International Data Transfers

As an internationally licensed gaming platform serving Pakistani players, six66 may transfer personal data to servers and service providers located outside of Pakistan. Where such transfers occur, six66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable privacy law.

Safeguards we implement for international transfers include contractual data protection clauses with receiving parties, processor agreements that impose equivalent privacy obligations, and, where applicable, adequacy assessments of the receiving jurisdiction's data protection framework.

By using the six66 Platform, you acknowledge and consent to the transfer of your personal data to servers and service providers in other jurisdictions as described in this section.

9 Cookies & Tracking Technologies

The six66 Platform uses cookies and similar tracking technologies to deliver and improve the Platform experience. Cookies are small data files stored on your device that allow the Platform to recognise you across sessions and personalise your experience.

We use the following categories of cookies on six66:

• Strictly necessary cookies: Essential for the Platform to function, including authentication cookies that maintain your logged-in session after you complete the six66 Login process. These cannot be disabled.
• Functional cookies: Enable the Platform to remember your preferences, such as preferred language or last-played games, to provide a personalised experience.
• Performance and analytics cookies: Collect anonymised data about how players interact with the Platform — including pages visited, session duration, and error events — to help us improve Platform performance.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts on the Platform.

10 Data Retention

six66 retains your personal data for the period necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. Our standard retention periods are as follows:

• Active account data: Retained for the duration of your registered Account on six66, plus a minimum of five years following account closure, as required by AML and gaming licence obligations.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, consistent with financial crime prevention regulatory requirements.
• Identity verification documents: Retained for the duration of the Account plus five years from closure, or longer where required by applicable law.
• Customer support communications: Retained for three years from the date of each interaction, for quality assurance and dispute resolution purposes.
• Technical and usage logs: Typically retained for up to 12 months from collection, unless required longer for security investigations.

When personal data is no longer required for any of the purposes described above, six66 will securely delete or anonymise it in accordance with our internal data lifecycle procedures.

11 Your Privacy Rights

As a data subject, you hold a number of rights in relation to the personal data that six66 processes about you. These rights are set out below. To exercise any of these rights, please contact six66 using the details in Section 16.

six66 will respond to all valid rights requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you accordingly. Requests are processed free of charge unless manifestly unfounded or excessive.

12 Children's Privacy

The six66 Platform is strictly restricted to adults aged 21 and above. six66 does not knowingly collect, process, or store personal data relating to individuals under the age of 21. If we become aware that a user is under 21 years of age, we will immediately close their Account, refund any remaining balance to the original payment source, and securely delete all associated data.

If you are a parent or guardian and believe that a minor in your care has registered a six66 Account, please contact our support team immediately via live chat. We take underage access extremely seriously and will act on such reports without delay.

13 Security Measures

six66 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and six66 servers
• Bcrypt hashing with salting for all stored passwords — plain-text passwords are never stored on six66 systems
• Multi-factor authentication options including JazzCash and EasyPaisa OTP verification for account access
• Role-based access controls ensuring that six66 staff can only access personal data to the extent required for their specific job function
• 24/7 security monitoring with automated anomaly detection for unusual access patterns or account activity
• Regular security audits and penetration testing of Platform infrastructure
• Encrypted storage for all sensitive data at rest on six66 servers

While six66 takes all reasonable precautions, no data transmission or storage system can be guaranteed to be 100% secure. In the event of a data security incident that poses a risk to your rights, six66 will notify you and the relevant regulatory authorities in accordance with applicable notification obligations.

14 Third-Party Links

The six66 Platform may contain links to third-party websites or services, including game provider demonstration pages or payment gateway interfaces. This Privacy Policy does not apply to third-party websites or services, and six66 does not accept responsibility for the privacy practices or content of any third-party site.

We encourage you to review the privacy policies of any third-party website you visit through a link on the six66 Platform before submitting any personal data to that site.

15 Updates to This Policy

six66 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or regulatory guidance. When we make material changes to this Policy, we will:

• Post the revised Policy on this page with an updated effective date
• Send a notification email to all registered six66 Account holders at their registered email address
• Display a prominent notice on the six66 Platform for a period of not less than 14 days following the update

Your continued use of the six66 Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any change, you should discontinue use of the Platform and contact support to request account closure.

16 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data six66 holds about you — including requests to exercise any of the rights described in Section 11 — please contact our support team through the following channels:

• Live Chat: Available 24/7 directly through your logged-in six66 Account dashboard — typically the fastest way to reach us
• Email: [email protected]

When submitting a data rights request by email, please include your full name, the email address associated with your six66 Account, and a clear description of your request. This will allow us to locate your Account and process your request efficiently. six66 may need to verify your identity before fulfilling certain requests to ensure the security of your data.