Privacy Policy — How 666m Protects Your Data

01 Introduction

666m is an internationally regulated online casino and sports betting platform built specifically for Pakistani players. We operate the website accessible at 666m.bio and all associated sub-pages, the mobile-optimised interface, and any apps or progressive web applications we may release in the future. As part of providing these services, 666m collects and processes certain personal information about the individuals who register and use our platform.

This Privacy Policy explains — in plain, accessible English — exactly what data 666m collects from Pakistani users, the lawful bases on which we process that data, with whom we share it, how long we retain it, and the rights you have as a data subject. We have written this policy to be comprehensive without being unnecessarily technical, because we believe our users in Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan deserve transparency about how their data is handled.

This Policy should be read alongside the 666m Terms & Conditions, which govern your overall use of the platform. Any defined terms used in this Policy carry the same meanings as assigned in the Terms & Conditions unless this Policy explicitly states otherwise.

02 Data Controller

For the purposes of applicable data protection law, the data controller responsible for the personal information processed in connection with the 666m platform is the 666m operating entity holding the relevant international gaming licence under which the platform is authorised to operate. The 666m data controller can be contacted using the details provided in Section 15 of this Policy.

As data controller, 666m determines the purposes for which your personal data is processed and the means by which that processing is carried out. Where 666m engages third-party service providers to process data on its behalf — such as payment processors or fraud prevention vendors — those providers act as data processors under binding data processing agreements that impose strict obligations on how your data may be used.

03 Personal Data We Collect

The following table summarises the categories of personal data that 666m collects from users, together with specific examples of the data types within each category:

04 How We Collect Your Data

4.1 Directly From You

The majority of personal data 666m holds about you is information you provide directly when you register an account, complete KYC verification, make a deposit or withdrawal, contact our customer support team, or update your account settings. You are in control of what information you submit at each of these stages.

4.2 Automatically During Platform Use

When you access and use the 666m platform, we automatically collect certain technical and usage data through the use of cookies, server logs, and similar tracking technologies. This includes your IP address, browser fingerprint, device identifiers, and detailed records of your interactions with the platform. This automated collection is necessary to maintain platform security, detect fraud, and improve service performance.

4.3 From Third Parties

In limited circumstances, 666m may receive personal data about you from third parties, including:

• Identity verification and KYC service providers who confirm the validity of identity documents submitted during registration.
• Payment processors such as JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank, who share transaction confirmation data necessary to credit your 666m wallet.
• Fraud prevention and AML screening services that cross-reference user data against sanctions lists and fraud databases.
• Analytics partners who provide aggregated insights about platform usage patterns — only anonymised or pseudonymised data is used for this purpose.

05 Purpose & Legal Basis for Processing

666m processes your personal data for the following purposes, each of which rests on a clearly identified lawful basis:

06 Data Sharing & Disclosure

6.1 Service Providers

666m shares personal data with carefully selected third-party service providers who assist in operating the platform. These include KYC and identity verification vendors, payment gateway operators, fraud detection specialists, customer support software providers, and cloud infrastructure partners. All such providers are contractually bound to process your data only on 666m's instructions and to maintain appropriate security measures.

6.2 Regulatory and Legal Disclosure

666m may disclose personal data to regulatory authorities, law enforcement agencies, licensing bodies, or courts where we are legally required to do so. This includes mandatory reporting obligations under anti-money laundering regulations and responses to valid legal process such as court orders or regulatory investigations. 666m will not disclose more data than is strictly required to satisfy the legal obligation in question.

6.3 Business Transfers

In the event that 666m or its parent entity undergoes a merger, acquisition, restructuring, or sale of assets, personal data held about users may be transferred to the acquiring entity as part of that transaction. Users will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

6.4 No Sale of Data

666m does not sell, rent, lease, or otherwise transfer personal data to third parties for their own marketing or commercial purposes. This is an absolute restriction that applies regardless of commercial considerations.

07 Payment Data & Financial Information

When you make a deposit or request a withdrawal through 666m using JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank, the transaction is processed through the relevant payment provider's secure infrastructure. 666m receives confirmation of the transaction and records the transaction reference, amount in PKR, and timestamp in your account wallet. Full payment credentials — such as mobile wallet PINs or full bank account numbers — are never stored on 666m servers.

All financial data associated with your 666m account is retained for a minimum of five (5) years following account closure in compliance with applicable AML record-keeping requirements. This retention period may be extended if an account is subject to an active regulatory investigation or legal hold.

08 Cookies & Tracking Technologies

8.1 What Are Cookies

Cookies are small text files that are placed on your device when you visit the 666m platform. They allow the platform to recognise your device across multiple sessions, remember your preferences, maintain your login session, and collect analytical information about how you use the site. 666m uses both first-party cookies set directly by 666m.bio and third-party cookies set by our analytics and security partners.

8.2 Categories of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your 666m account and security tokens that protect against cross-site request forgery attacks. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, last-visited game category, and notification settings. Disabling these may reduce platform convenience.
• Analytics Cookies: Collect anonymised data about which pages and features are most used, how long sessions last, and where users encounter errors. This data helps 666m improve the platform experience for Pakistani users.
• Security and Fraud Prevention Cookies: Used by our fraud detection systems to flag suspicious account activity, detect bot traffic, and identify multiple account registrations from the same device.

8.3 Managing Cookies

You can manage non-essential cookie preferences through the cookie consent panel accessible from the footer of the 666m platform. You may also configure your browser to block or delete cookies; however, doing so may impair certain platform functionality, including the ability to stay logged in to your account.

09 Data Retention

666m retains personal data for different periods depending on the category of data and the purpose for which it was collected. The general retention schedule applied by 666m is as follows:

• Active account data: Retained for the full duration of your account being open and active on the 666m platform.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, in compliance with gaming licence and AML record-keeping obligations.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of each transaction, which may extend beyond account closure.
• Customer support communications: Retained for three (3) years following the resolution of each support case, or longer if related to an ongoing dispute or legal matter.
• Marketing consent records: Retained for the duration of account activity plus two (2) years to demonstrate compliance with consent obligations.
• Technical and usage logs: Retained for up to twelve (12) months for operational and security purposes, after which they are anonymised or deleted.

When the applicable retention period expires, 666m securely destroys or anonymises the relevant data. Anonymised data — which can no longer be linked to any identifiable individual — may be retained indefinitely for statistical and analytical purposes.

10 Security Measures

666m implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• End-to-end SSL/TLS encryption for all data transmitted between your device and the 666m platform.
• AES-256 encryption for sensitive data stored at rest in 666m databases, including identity documents and financial records.
• Role-based access controls that restrict employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for all internal 666m system access points that handle user data.
• Regular third-party penetration testing and security audits of the 666m platform infrastructure.
• Real-time intrusion detection and automated alerting systems that monitor for unusual access patterns or data exfiltration attempts.
• Formal incident response procedures that govern how 666m responds to and reports any personal data breaches.

While 666m takes every reasonable technical precaution to protect your data, no system connected to the internet can be guaranteed to be completely impenetrable. You also have a role in keeping your account secure — please use a strong, unique password for your 666m account and enable two-factor authentication.

11 Your Data Rights

As a 666m user, you have a number of rights in relation to the personal data we hold about you. These rights are summarised below. To exercise any of these rights, please contact the 666m data team using the contact details in Section 15. We will respond to all valid requests within thirty (30) days.

• Right of Access: You may request a copy of all personal data that 666m holds about you, together with information about how it is processed. This is commonly referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For account details such as your email address or mobile number, you can update these directly in your account settings.
• Right to Erasure: In certain circumstances, you may request that 666m delete the personal data we hold about you. This right is subject to limitations where data must be retained to comply with legal obligations — for example, KYC and AML retention requirements cannot be overridden by an erasure request.
• Right to Restrict Processing: You may request that 666m limit the processing of your personal data in specific circumstances, such as while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request that 666m provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing that is based on 666m's legitimate interests, including direct marketing. Where you object to marketing, we will stop sending you promotional communications immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time through your account settings or by contacting support. Withdrawal does not affect the lawfulness of prior processing.

12 Minors & Age Restriction

The 666m platform is strictly restricted to individuals aged 21 and above. We do not knowingly collect personal data from anyone under the age of 21. If you are under 21, you must not register an account or attempt to use the 666m platform in any capacity.

If 666m discovers that an account has been registered by a person under the age of 21, or that personal data belonging to a minor has been submitted during registration, we will immediately suspend the account, void all balances and transaction history associated with it, and securely delete all personal data associated with that account from our systems, except where retention is required for legal reporting purposes.

13 International Data Transfers

As 666m operates under an international gaming licence, your personal data may be transferred to and processed in countries outside of Pakistan. Where such transfers take place, 666m ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to the protections applicable in the jurisdiction from which the data originates. These safeguards may include standard contractual clauses, binding corporate rules, or transfers to jurisdictions that maintain adequate data protection frameworks.

All third-party service providers who process personal data on 666m's behalf are subject to binding data processing agreements that impose obligations consistent with applicable international data protection standards, regardless of where those providers are located.

14 Changes to This Privacy Policy

666m reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data practices, new service features, evolving legal requirements, or updates to our gaming licence obligations. When we make material changes to this Policy, we will notify registered users via email to their registered address and/or via a prominent notification displayed on the platform before the revised Policy takes effect.

We encourage you to review this Privacy Policy periodically to stay informed about how 666m is protecting your personal information. The effective date at the top of this document will always reflect when the most recent version was published. Continued use of the 666m platform after a revised Policy has taken effect constitutes your acknowledgement of the updated terms.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 666m handles your personal data, please get in touch with our data team. We are committed to resolving all privacy-related enquiries promptly and transparently.

You can reach the 666m data and privacy team at:

If you are unsatisfied with our response to any privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction governing your use of the 666m platform.