Privacy Policy — How 666f Collects,
Uses & Protects Your Personal Data

This Privacy Policy ("Policy") describes how 666f — accessible at 666f.blog — collects, processes, stores, and shares personal data in connection with the operation of its online casino and sports betting platform. This Policy applies to all registered players, visitors, and any other individuals whose personal data 666f processes in connection with the platform.

This Policy should be read alongside the 666f Terms & Conditions and Responsible Gaming Policy, all of which form part of the contractual framework between you and 666f. In the event of any conflict between this Policy and the Terms & Conditions regarding data processing matters, this Policy shall prevail.

By registering a 666f account, depositing funds, placing bets, or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you must not use the 666f platform.

666f is the data controller in respect of all personal data collected and processed through the 666f platform at 666f.blog. As data controller, 666f determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

For all data protection enquiries, requests to exercise your data rights, or complaints regarding 666f's handling of your personal data, please contact our designated data protection contact at:

[email protected] — please mark your subject line with "Privacy / Data Request" for prioritised handling by the relevant team member.

666f will respond to all legitimate data subject requests within 30 calendar days of receipt. In cases of particular complexity, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons therefor within the initial 30-day period.

666f collects the following categories of personal data in connection with the operation of the platform:

Identity & Contact Data:

Financial & Transaction Data:

Gaming & Behavioural Data:

Technical & Device Data:

666f collects only the data that is reasonably necessary for the purposes described in Section 5. We do not collect special categories of sensitive personal data (such as health data, biometric data, or political opinions) except where expressly required by KYC or responsible gaming compliance obligations.

666f collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, set responsible gaming limits, or submit any form on the 666f platform.
• Automatically: Through your use of the platform — including login activity, game play, navigation behaviour, session data, and device/browser information collected via cookies and similar technologies. See Section 9 for full details of our cookie practices.
• From third-party identity verification providers: 666f may use third-party KYC and identity verification services to cross-check the accuracy of identity and age information you provide. These providers operate under their own privacy policies and data processing agreements with 666f.
• From payment processing partners: When you transact via JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, Visa, or MasterCard, our payment processing partners provide 666f with confirmation of transaction status and certain account reference identifiers necessary to reconcile your 666f account balance.
• From fraud prevention and analytics services: 666f uses fraud detection systems that may receive technical data (IP address, device fingerprint) to identify anomalous patterns of activity on the platform.

666f processes your personal data for the following purposes:

• Account creation and management: To register and maintain your 666f account, authenticate your login sessions, and provide you with access to all platform features.
• Age verification and KYC compliance: To verify that you are aged 21 or above 21+ and to satisfy our identity verification obligations under applicable compliance requirements.
• Processing financial transactions: To handle PKR deposits and withdrawals via JazzCash, EasyPaisa, and all other supported payment methods, and to maintain accurate financial records.
• Delivering gaming services: To operate the casino, sportsbook, bingo, and all other gaming products on 666f, and to credit winnings and process bet settlements accurately.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other illegal or prohibited conduct on the platform.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide ongoing account assistance.
• Responsible gaming: To implement and monitor responsible gaming tools you have activated, including deposit limits, self-exclusion records, and session monitoring.
• Marketing communications: To send you information about 666f promotions, bonuses, and new features — but only where you have provided your consent for such communications. You may withdraw this consent at any time.
• Platform improvement: To analyse aggregate usage patterns and improve the 666f user experience, game selection, and payment processing efficiency.
• Legal and regulatory compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory authorities, and maintain records as required by law.

666f processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and 666f — including account management, transaction processing, game operation, and customer support.
• Legal obligation: Processing required to comply with applicable laws and regulations — including KYC verification, anti-money-laundering obligations, and record-keeping requirements.
• Legitimate interests: Processing carried out in pursuit of 666f's legitimate business interests — including fraud prevention, platform security, abuse detection, and responsible gaming monitoring — where such interests do not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where your prior consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.

666f does not sell, rent, or trade your personal data to unaffiliated third parties for their marketing or commercial purposes. Your data may be shared with the following categories of third parties for the limited purposes described:

• Payment processing partners: JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, Visa, and MasterCard processing networks — solely to the extent necessary to process your PKR deposits and withdrawals.
• Identity verification providers: Third-party KYC service providers who assist 666f in verifying the identity and age of account holders as part of our compliance programme.
• Game software providers: Casino game providers whose titles are hosted on the 666f platform may receive technical game-play data (game outcomes, bet amounts) necessary to operate and reconcile their games. These providers do not receive your personally identifiable contact or financial data.
• Fraud detection and security services: Technology partners providing fraud scoring, bot detection, and account security monitoring services.
• Customer support infrastructure: Third-party platforms used to deliver live chat and email support services, operating under data processing agreements with 666f.
• Regulatory and law enforcement authorities: Where 666f is required by law, court order, or regulatory directive to disclose personal data, we will comply with such requirements. Where legally permissible, we will notify you of such disclosure.

All third-party processors engaged by 666f are required to process personal data only for the specified purposes and in accordance with 666f's instructions. 666f maintains data processing agreements with all such processors to ensure appropriate data protection standards are maintained.

Given 666f's focus on the Pakistani market, the platform processes a significant volume of PKR transactions via JazzCash, EasyPaisa, and local banking channels. The following specific provisions apply to the processing of financial and payment data:

• Full card numbers (Visa/MasterCard) are never stored by 666f. Card data is tokenised through our payment processing partner and only a non-sensitive token reference is retained in 666f's systems.
• JazzCash and EasyPaisa mobile wallet numbers are stored in encrypted form and used solely for the purpose of processing your transactions and verifying payment method ownership for withdrawal purposes.
• Your complete PKR transaction history — all deposits, withdrawals, bets, wins, losses, and bonus credits — is retained for the full duration of your account plus a minimum of five years following account closure, in accordance with financial record-keeping obligations.
• Source of funds documentation submitted for KYC compliance (bank statements, payslips, etc.) is stored securely and accessed only by authorised compliance personnel on a need-to-know basis.

666f uses cookies and similar tracking technologies on the platform for the following purposes:

• Essential cookies: Required for the platform to function — including session authentication, account login state, and security tokens. These cannot be disabled without preventing access to core platform features.
• Functional cookies: Used to remember your preferences — such as language settings, responsible gaming tool configurations, and display preferences — so you do not need to reset them on each visit.
• Analytics cookies: Used to collect aggregate, anonymised data about how players navigate and use the 666f platform, enabling us to improve the user experience. This data does not identify individual players.
• Marketing cookies: Where you have provided consent, used to deliver relevant 666f promotions and to measure the effectiveness of marketing campaigns. You may withdraw this consent at any time.

You can manage your cookie preferences through your browser settings. Note that disabling essential cookies will impair or prevent your ability to use the 666f platform. Most browsers allow you to view, manage, block, and delete cookies through the browser's privacy or settings menu.

666f does not permit third-party advertising networks to place tracking cookies on the platform that would collect data for the purpose of building advertising profiles for use beyond 666f's own services.

666f retains your personal data for as long as is necessary for the purposes for which it was collected and to fulfil applicable legal retention obligations. The following indicative retention periods apply:

• Active account data (identity, contact, gaming history): Retained for the full duration of your active 666f account plus five years following account closure.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction, in accordance with financial record-keeping obligations.
• KYC and identity documents: Retained for five years following the end of your relationship with 666f, or longer if required by applicable anti-money-laundering regulations.
• Self-exclusion records: Retained for a minimum of five years following the end of any self-exclusion period to prevent re-registration during excluded periods and to satisfy responsible gaming record-keeping requirements.
• Marketing consent records: Retained for three years from the date of consent, or until consent is withdrawn, whichever is earlier.
• Technical and device data (logs): Retained for 12 months from collection, unless required for an ongoing investigation or legal proceeding.

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised. Anonymised aggregate data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

You have the following rights in respect of your personal data held by 666f. These rights may be exercised at any time by contacting [email protected] with the subject line "Privacy / Data Request":

666f will respond to all valid data rights requests within 30 calendar days. We may request proof of identity before processing certain requests to ensure data is not disclosed to unauthorised individuals. Exercising your data rights will not affect the quality of service you receive from 666f, except where the data requested to be deleted is necessary to operate your account.

The 666f platform is strictly for individuals aged 21 years and above. 21+ 666f does not knowingly collect personal data from any person under the age of 21.

If 666f becomes aware that personal data has been collected from an individual under 21, the associated account will be closed immediately, all data relating to that individual will be deleted to the extent not required for legal or regulatory compliance purposes, and any deposited funds will be returned to the originating payment method.

Parents or guardians who believe that a minor may have registered a 666f account should contact us immediately at [email protected]. We will investigate and take appropriate action within 48 hours of receiving such a report.

666f strongly recommends that parents and guardians in Pakistan use parental control software to restrict access to online gaming platforms on devices accessible to minors.

666f implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Transport encryption: All data transmitted between your device and the 666f platform is encrypted using TLS 1.2 / 1.3 (256-bit SSL). The presence of HTTPS in your browser's address bar confirms this encryption is active.
• Data-at-rest encryption: Sensitive personal data stored in 666f's databases — including identity documents, payment method details, and KYC information — is encrypted at rest using AES-256 encryption.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo privacy and security training and are subject to confidentiality obligations.
• Two-factor authentication: 666f offers two-factor authentication on player accounts as an additional layer of login security. We strongly encourage all players to enable 2FA from their account security settings.
• Incident response: 666f maintains a documented data breach response procedure. In the event of a data breach likely to result in significant risk to affected individuals, we will notify the relevant regulatory authority and affected players within the timeframes required by applicable law.

Notwithstanding the security measures described above, no method of electronic transmission or storage is completely secure. You play a role in your own account security — use a strong, unique password for your 666f account, enable 2FA, and never share your login credentials with anyone.

As an online platform operating under international licensing standards, certain of 666f's service providers and data processors may be located outside Pakistan. Where personal data is transferred to processors in other countries, 666f takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Appropriate safeguards for international transfers may include:

• Standard contractual clauses or data processing agreements with internationally recognised data protection provisions
• Transfers to jurisdictions that maintain data protection standards recognised as adequate by the relevant supervisory authorities
• Binding corporate rules where applicable within group companies

You may request further information about the specific safeguards in place for any particular international transfer by contacting 666f's data protection contact at [email protected].

666f reserves the right to update or amend this Privacy Policy at any time. The date of the most recent update is displayed prominently at the top of this page. When material changes are made to this Policy, 666f will provide notice to registered players via the email address associated with their account and/or by displaying a prominent notification upon next login to the platform.

We recommend that you review this Privacy Policy periodically to stay informed of how 666f handles your personal data. Changes will take effect from the date of publication unless otherwise stated. Your continued use of the 666f platform following the publication of a revised Policy constitutes your acknowledgment of the revisions.

If any change to this Policy significantly and negatively affects your rights in relation to your personal data, we will provide at least 14 days' advance notice before the change takes effect and give you the opportunity to close your account if you do not accept the revised terms.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how 666f has handled your personal data, please contact us in the first instance using the details below:

• Email: [email protected] — please use the subject line "Privacy / Data Request" for prioritised handling.
• Response time: 666f aims to acknowledge all privacy-related contacts within 48 hours and provide a full response within 30 calendar days.

If you are not satisfied with 666f's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority applicable in 666f's operating jurisdiction. 666f will provide details of the appropriate supervisory authority upon written request.