666xp Privacy Policy — How We Handle Your Personal Data

This Privacy Policy is issued by 666xp, the operator of the online gaming platform accessible at 666xp.org (the "Platform"). 666xp acts as the data controller in respect of all personal data collected from users of the Platform. As data controller, 666xp determines the purposes for which personal data is collected and the means by which it is processed.

This Privacy Policy applies to all personal data collected from individuals who:

• Visit or browse the 666xp Platform, including users who do not complete registration.
• Register an Account on the 666xp Platform.
• Deposit funds, place bets, or play casino games on the 666xp Platform.
• Participate in any 666xp promotional offer, loyalty programme, or competition.
• Contact 666xp customer support by any channel including live chat, email, or SMS.
• Interact with 666xp through any mobile-optimised interface or browser-based application.

This Policy does not apply to third-party websites, payment processors, or game providers that may be linked from the 666xp Platform. Those entities operate under their own independent privacy policies, and 666xp is not responsible for their data practices. We encourage you to review the privacy terms of any third-party service before submitting personal information to them.

666xp collects personal data in the following categories. We collect only the data that is necessary and proportionate for the purposes described in this Policy — no more.

2.1 Identity & Contact Data

• Full legal name as it appears on government-issued identification.
• Date of birth (required to verify that you are 21 years of age or older).
• Pakistani mobile number used for account registration and SMS two-factor authentication.
• Email address.
• Residential address (required for KYC verification at the withdrawal stage).
• National Identity Card (CNIC) number and copy of CNIC or passport document submitted during KYC verification.

2.2 Financial & Transaction Data

• JazzCash mobile wallet identifier linked to your Account.
• EasyPaisa mobile wallet identifier linked to your Account.
• Bank account details (HBL, UBL, Meezan Bank, or other approved Pakistani banks) where bank transfer is used.
• USDT TRC20 wallet address where cryptocurrency deposit or withdrawal is used.
• SadaPay account details where applicable.
• Complete deposit and withdrawal transaction history including amounts, timestamps, and payment method references.
• Account balance history.

2.3 Gaming & Betting Activity Data

• Complete betting history including all sports bets, casino game sessions, crash game rounds, and live dealer game activity.
• Wagers placed, outcomes, and settlements.
• Bonus claims, wagering requirement progress, and bonus settlements.
• Game preferences, favourite games, and session frequency patterns.
• Responsible gaming tool activations including deposit limits, self-exclusion, and cool-off periods.

2.4 Technical & Device Data

• Internet Protocol (IP) address and derived geographic location (country and city level).
• Device type, operating system version, and browser type and version.
• Device fingerprint used for fraud detection and multi-account prevention.
• Session timestamps, login times, and logout times.
• Pages visited on the 666xp Platform and interaction patterns.
• Cookie identifiers and similar tracking technologies as described in Section 7.

2.5 Communications Data

• Content of live chat conversations with 666xp customer support agents.
• Email correspondence sent to or from [email protected].
• Formal complaint submissions and 666xp responses.
• Records of promotional communications sent to your registered contact details.

666xp collects personal data through the following channels and mechanisms:

666xp does not purchase personal data from data brokers or third-party list providers. We do not collect data from your social media profiles unless you explicitly provide a social media identifier as part of an account recovery process. We do not use facial recognition or biometric data beyond what is inherent in a standard CNIC photograph submitted during KYC.

666xp processes your personal data under one or more of the following legal bases in accordance with applicable data protection law under our international licensing jurisdiction:

• Contractual Necessity: Processing is necessary to perform our obligations under the Terms and Conditions you accepted at registration — including account management, game operation, bet settlement, deposit and withdrawal processing, and customer support.
• Legal Obligation: Processing is required to comply with obligations under our international gaming licence, anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and obligations to regulatory authorities. This includes the mandatory retention of transaction records and identity verification documents.
• Legitimate Interests: Processing is necessary for 666xp's legitimate business interests including fraud prevention, multi-account detection, platform security, responsible gaming monitoring, and operational improvement — provided those interests are not outweighed by your rights and interests.
• Consent: Where 666xp sends you direct marketing communications including promotional emails, SMS, and bonus notifications, this is based on your consent given at registration or subsequently. You may withdraw this consent at any time by contacting [email protected] or updating your communication preferences within Account Settings.

The personal data 666xp collects is used for the following specific purposes:

5.1 Account Operation & Platform Services

• Creating and managing your 666xp Account and verifying your identity at registration and KYC stages.
• Processing deposits received via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20.
• Processing withdrawal requests to your registered Pakistani payment method.
• Settling sports bets, casino game results, and crash game outcomes and crediting or debiting your Account accordingly.
• Managing bonus credits, wagering requirement tracking, and loyalty points.
• Providing customer support through live chat and email.

5.2 Legal & Regulatory Compliance

• Verifying that you are 21 years of age or older before granting Account access.
• Conducting ongoing AML screening of transactions to detect patterns consistent with money laundering or terrorist financing.
• Maintaining financial transaction records as required by our gaming licence for regulatory audit purposes.
• Responding to lawful requests from regulatory authorities, law enforcement bodies, or financial institutions.

5.3 Responsible Gaming & Player Protection

• Monitoring betting and gaming patterns to identify potential signs of problematic gambling behaviour.
• Enforcing deposit limits, session limits, loss limits, cool-off periods, and self-exclusion settings activated by you.
• Contacting players identified as at risk of gambling-related harm to offer support resources.
• Preventing self-excluded players from accessing the Platform during their exclusion period.

5.4 Security & Fraud Prevention

• Detecting and preventing multiple account registrations by the same individual.
• Identifying and blocking automated bot activity, scripted betting systems, and collusion patterns.
• Monitoring login attempts and triggering account security alerts for anomalous access patterns.
• Investigating suspected fraudulent transactions and coordinating with payment providers where necessary.

5.5 Marketing Communications (Consent-Based)

• Sending promotional emails and SMS notifications about 666xp bonuses, new game releases, PSL betting specials, and platform updates — only where you have given explicit consent.
• Personalising promotional offers based on your gaming preferences and activity history — for example, cricket-specific promotions for players who primarily use the 666xp sportsbook for PSL matches.

666xp shares personal data with third parties only in the following limited and necessary circumstances:

6.1 Payment Service Providers

When you make a deposit or request a withdrawal, your relevant payment details are shared with the applicable payment service provider (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, or blockchain network validators for USDT TRC20) solely for the purpose of processing that specific transaction. These providers act as independent data controllers under their own privacy policies and are regulated financial institutions subject to their own data protection obligations.

6.2 Casino Game & Software Providers

Third-party game software providers whose games are accessible through the 666xp Platform may receive limited technical session data (such as a pseudonymous player identifier and game session parameters) necessary to operate the game. These providers do not receive your name, CNIC, Pakistani mobile number, or financial details. All third-party game providers that 666xp works with are contractually bound to data confidentiality obligations consistent with this Policy.

6.3 Regulatory & Legal Authorities

666xp will disclose personal data to regulatory authorities, law enforcement agencies, financial intelligence units, or courts where legally required to do so under applicable law, under our gaming licence obligations, or in response to a valid legal order. 666xp will not contest such disclosures where legally compelled and will notify affected users where permitted by law to do so.

6.4 Identity Verification Services

666xp uses independent identity verification services to assist with KYC document processing. CNIC or passport images submitted during KYC may be processed by a contracted verification provider operating under a data processing agreement with 666xp. These providers process data solely on 666xp's instructions and are prohibited from retaining or using KYC data for their own purposes.

6.5 Business Successors

In the event of a merger, acquisition, or sale of 666xp or any of its material assets, personal data held about registered users may be transferred to the successor entity as part of that transaction. In such an event, 666xp will notify affected users via email to their registered address no later than 30 days before any such transfer, and the successor entity will be required to honour this Privacy Policy.

The 666xp Platform uses cookies and similar technologies to ensure the Platform functions correctly and to improve the user experience for Pakistani players. A cookie is a small text file stored on your device by your browser at the instruction of the 666xp Platform.

You can control non-essential cookies through your browser settings. Most modern browsers on Android and iOS devices — including Chrome (used by the majority of Pakistani mobile users), Safari, and Firefox — provide settings to view, delete, and block cookies. Blocking essential session or security cookies will prevent you from logging into your 666xp Account and using Platform features that require authentication.

666xp implements a comprehensive, multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. The following technical and organisational measures are in place and are subject to independent audit as a condition of our gaming licence:

• Encryption in Transit: All data transmitted between your device and the 666xp Platform is encrypted using 256-bit TLS 1.3 protocol. The padlock symbol in your browser address bar confirms this encryption is active during your session.
• Encryption at Rest: Personal data, KYC documents, and financial records stored in 666xp's database infrastructure are encrypted at rest using AES-256 encryption.
• Access Control: Internal access to personal data is restricted on a strict need-to-know basis. Database access requires multi-factor authentication and is logged for audit purposes. 666xp development and support staff cannot access your password — it is stored as a cryptographic hash.
• Segregated Data Storage: Player financial data and KYC documents are stored in segregated systems with additional access restrictions beyond the standard Platform infrastructure.
• Penetration Testing: 666xp's security infrastructure undergoes independent penetration testing not less than annually, with findings remediated according to criticality-based timelines.
• Incident Response: 666xp maintains a documented data breach incident response procedure. In the event of a breach affecting Pakistani player personal data, affected users will be notified by email within 72 hours of 666xp becoming aware of the breach, together with information about what data was affected and the steps being taken.

666xp retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, comply with legal obligations, and resolve disputes. The following retention periods apply:

After the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised aggregated data (such as statistical analysis of platform usage with no individual identifiers) may be retained indefinitely for business analysis purposes.

As a 666xp user, you hold the following rights in respect of your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "DATA RIGHTS REQUEST" and include your registered mobile number and Account username for identification purposes. 666xp will respond to all data rights requests within 30 days.

If 666xp becomes aware or has reasonable grounds to believe that an Account has been registered by or is being used by an individual under 21 years of age, that Account will be immediately suspended pending investigation. All funds in the Account will be frozen during the investigation. If the investigation confirms that the registered user is under 21, the Account will be permanently closed and all funds — including any winnings — will be forfeited.

If you are a parent or guardian and believe that a minor under your care has registered an Account with 666xp or has accessed the Platform in any way, please contact [email protected] immediately with details of the situation. 666xp will investigate and take appropriate action promptly. We encourage parents and guardians to use parental control software to restrict minors' access to online gambling platforms.

666xp does not create marketing materials targeted at or designed to appeal to individuals under 21 years of age. All 666xp advertising and promotional communications contain clear 21+ age restriction notices.

666xp is an internationally licensed gaming operator and its infrastructure, including server facilities and certain service providers, may be located outside Pakistan. As a result, your personal data may be transferred to, stored in, and processed in countries other than Pakistan.

When personal data is transferred internationally, 666xp implements appropriate safeguards to ensure that the data receives an equivalent level of protection to that which it would receive within Pakistan. These safeguards include:

• Contractual data protection clauses in all agreements with international third-party processors, requiring them to process data only on 666xp's documented instructions and to implement security measures consistent with this Policy.
• Data processing agreements that prohibit third-party processors from using Pakistani player data for their own independent purposes or sharing it with sub-processors without 666xp's prior written approval.
• Selection of international service providers who are themselves subject to recognised data protection frameworks in their home jurisdictions.

By registering an Account with 666xp and accepting this Privacy Policy, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described above. If you require further information about these international transfer safeguards, contact [email protected].

13.1 Updates to This Privacy Policy

666xp may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or changes in our international gaming licence conditions. The version number and effective date at the top of this document will be updated whenever the Policy is revised.

Where an update is material — meaning it significantly changes how 666xp uses your personal data or your data rights — 666xp will notify registered users by email to their registered address no fewer than 14 days before the revised Policy takes effect. Your continued use of the 666xp Platform after the effective date of a revised Policy constitutes your acceptance of the revised terms. If you do not accept a material change to this Policy, you may close your Account by contacting [email protected] before the revised Policy takes effect.

13.2 How to Contact 666xp About Privacy

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact 666xp using the details below. We aim to acknowledge all privacy-related inquiries within 48 hours and to provide a substantive response within 30 days.

If you are not satisfied with 666xp's response to a privacy concern, you have the right to escalate the matter to the supervisory authority under the jurisdiction of our gaming licence. Details of the applicable supervisory authority are available upon request from [email protected].