666do Privacy Policy — How We Protect Your Data

666do is an internationally licensed online casino and sports betting platform serving registered players globally, with a particular focus on Pakistani players. The 666do platform is accessible at https://666do.net and provides services including but not limited to online casino games, live dealer games, sports betting (including cricket and PSL), virtual casino games, and slot games.

For the purposes of this Privacy Policy, 666do acts as the data controller in respect of personal data collected through account registration, KYC verification, transaction processing, and platform use. Where 666do engages third-party service providers to process data on its behalf, those providers act as data processors under contractual obligations consistent with this Policy.

For all privacy-related queries, data subject requests, or complaints, the designated point of contact is the 666do Data Privacy team, reachable at [email protected] with the subject line "Privacy Request."

666do collects the following categories of personal data:

666do collects personal data through the following channels:

• Account Registration: Information you provide when creating your 666do account, including name, CNIC, date of birth, email, and mobile number.
• KYC Submission: Identity documents and photographs you upload to complete identity verification.
• Payment Processing: Financial account details provided during deposit and withdrawal transactions.
• Support Interactions: Information shared in live chat conversations, support tickets, or email correspondence.
• Preference Settings: Communication preferences and responsible gaming settings you configure in your account dashboard.

• Cookies and Tracking Technologies: Session cookies, persistent cookies, and similar tracking mechanisms (see Section 8 for full cookie details).
• Server Logs: Automatic logging of IP address, access times, pages viewed, and device information on every platform visit.
• Payment Gateway Data: Transaction confirmation data returned by JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank payment gateway APIs upon deposit or withdrawal processing.
• Game Providers: Gaming activity data returned by licensed game studios integrated into the 666do platform, including bet placements, game outcomes, and session duration.

• KYC Verification Services: Identity verification results from third-party KYC service providers used to validate CNIC authenticity and age eligibility.
• Fraud Detection Services: Risk scoring data from fraud prevention partners used to identify irregular account activity or suspicious deposit patterns.
• Publicly Available Sources: Sanctions lists, PEP (Politically Exposed Persons) databases, and adverse media screening services checked as part of AML compliance obligations.

666do processes your personal data for the following purposes, each underpinned by a defined legal basis:

Where 666do relies on legitimate interest as the legal basis for processing, we have conducted a balancing test confirming that our interests do not override your fundamental rights and freedoms. Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

666do does not sell, rent, or commercially trade your personal data. We share personal data with third parties only in the following defined circumstances:

We engage third-party service providers who process data on our behalf under contractual data processing agreements that prohibit any use of your data beyond the specific service being provided. These include:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum financial data necessary to execute your deposit and withdrawal instructions. These providers are subject to their own regulatory obligations and privacy frameworks.
• Game Studios and Content Providers: Licensed game providers (including Pragmatic Play, Evolution, and others) receive session and bet data necessary to operate their games within the 666do platform. These providers are independently licensed and audited.
• KYC and Identity Verification Services: Third-party KYC providers receive the identity documents you submit for verification. These providers operate under strict data security standards.
• Fraud Detection and Security Services: Technical data and transaction patterns may be processed by fraud prevention partners for risk scoring and anomaly detection.
• Cloud Infrastructure and Hosting: Platform data is stored on secure cloud infrastructure operated by third-party hosting providers under strict data processing agreements.

666do may disclose your personal data to regulatory bodies, licensing authorities, law enforcement agencies, or courts where we are legally obligated to do so, or where disclosure is necessary to protect the rights, property, or safety of 666do, its players, or the public. Such disclosures will always be limited to the minimum data required.

In the event of a merger, acquisition, or sale of substantially all assets of 666do, personal data held by 666do may be transferred to the acquiring entity. You will be notified of any such transfer and any changes to this Privacy Policy that result from it.

Given that 666do operates under international gaming licensing and uses globally distributed cloud infrastructure and third-party service providers, your personal data may be transferred to and processed in countries outside Pakistan. These may include countries in Europe, Southeast Asia, and other regions where our service providers and game studios are headquartered.

Where data is transferred internationally, 666do ensures that appropriate safeguards are in place to protect your personal information to a standard at least equivalent to the protections provided under applicable international data protection standards. These safeguards may include:

• Contractual clauses in agreements with data processors that require equivalent data protection standards.
• Transfers to jurisdictions recognised by applicable regulatory bodies as providing adequate levels of data protection.
• Technical and organisational security measures commensurate with the sensitivity of the data transferred.

You may request information about the specific safeguards in place for any particular international data transfer by contacting our data privacy team at [email protected].

666do retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods required by our gaming licence obligations and applicable financial regulations. The following standard retention periods apply:

• Identity and KYC Documents (CNIC, verification photographs): Retained for a minimum of 5 years following account closure, in compliance with AML regulatory requirements.
• Financial and Transaction Records: Retained for 7 years following the date of the transaction, in compliance with financial recordkeeping obligations.
• Gaming and Betting History: Retained for 7 years to support dispute resolution, regulatory audit, and responsible gaming monitoring obligations.
• Support and Communication Records: Retained for 3 years following the closure of the relevant support interaction.
• Technical and Log Data: Retained for up to 12 months for fraud detection, security monitoring, and platform analytics purposes.
• Marketing Preference Records: Retained for the duration of the account and for 3 years following account closure to evidence consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identified or identifiable individual. Anonymised or aggregated data derived from your personal data may be retained indefinitely for statistical and analytics purposes, as it no longer constitutes personal data.

The 666do platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. A cookie is a small text file placed on your device by the platform when you visit. Cookies do not contain executable code and cannot access other data stored on your device.

Strictly necessary cookies are required for the 666do platform to function and cannot be disabled without preventing core features — including login and game access — from operating correctly. All other cookie categories can be managed through the cookie preference centre accessible from the footer of every page, or through your browser's cookie settings. Please note that disabling analytics or functional cookies may result in a degraded platform experience, including loss of your saved game lobby preferences and responsible gaming setting configurations.

Most modern browsers — including Chrome, Safari, Firefox, and Samsung Internet (commonly used on Pakistani Android devices) — allow you to view, manage, and delete cookies through the browser settings menu. Instructions specific to your browser are available in the browser's own help documentation.

666do implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and the 666do platform is encrypted in transit using TLS 1.3, the current gold standard for secure web communications.
• AES-256 Encryption at Rest: Personal data stored on 666do servers — including KYC documents, financial records, and account information — is encrypted at rest using AES-256 standard encryption.
• Access Controls: Access to personal data within 666do's internal systems is strictly limited to authorised personnel with a genuine operational need. All staff access is logged and subject to regular access review.
• Two-Factor Authentication: 666do offers optional two-factor authentication (2FA) via OTP for player account login. Internal staff access to systems containing personal data requires mandatory 2FA.
• Regular Security Audits: The 666do platform undergoes regular independent security penetration testing and vulnerability assessments to proactively identify and remediate potential security weaknesses.
• Incident Response Plan: 666do maintains a documented data breach incident response plan, including defined escalation procedures, player notification protocols, and regulatory reporting obligations.
• Staff Training: All 666do employees with access to personal data receive regular data protection and security training appropriate to their role.

As a 666do player, you hold the following rights in relation to your personal data. These rights may be subject to certain limitations and exceptions under applicable law, particularly where processing is required for legal compliance or fraud prevention purposes.

To exercise any of the rights listed above, contact the 666do Data Privacy team at [email protected] with the subject line "Data Rights Request" and include: (a) your full name as registered on your 666do account, (b) your registered email address, (c) the specific right you wish to exercise, and (d) any supporting details that will assist us in locating your data.

We will respond to all verified data rights requests within 30 calendar days of receipt. In cases of particular complexity or where a large volume of data is involved, we may extend this period by a further 60 days, in which case we will notify you of the extension within the initial 30-day window with an explanation of the reason for delay.

We may request proof of identity before processing a data rights request to ensure we do not disclose or modify personal data in response to a fraudulent request.

The 666do platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is conducted at the point of registration through CNIC-based identity verification, which includes date-of-birth confirmation.

If 666do becomes aware at any time that a registered account belongs to an individual under the age of 21, the account will be immediately suspended, all associated personal data will be flagged for deletion in accordance with our underage account handling procedure, any deposits will be returned to the payment source, and any winnings will be forfeited. We will retain only the minimum data necessary to document the account closure and prevent future re-registration attempts by the same individual.

Parents and guardians in Pakistan are strongly encouraged to use parental control software to prevent underage family members from accessing online gambling platforms. If you believe a minor may have registered a 666do account, please contact our Support team immediately at [email protected].

666do reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, regulatory guidance, or the introduction of new platform features. The date of the most recent update is indicated at the top of this Policy.

Where changes to this Policy are material — meaning they substantially affect how we process your personal data or the rights available to you — we will notify registered players by email to their registered address no fewer than 14 days before the revised Policy takes effect. For non-material changes (such as clarifications, corrections, or additions that do not substantially alter data processing practices), we may update the Policy without advance notice.

We encourage you to review this Privacy Policy periodically, particularly when you notice the "Last Updated" date has changed. The current version of this Policy is always accessible at https://666do.net/privacy-policy. Your continued use of the 666do platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 666do handles your personal data, please contact our dedicated Data Privacy team using the details below. We are committed to handling all privacy enquiries promptly, professionally, and in confidence.

• Email: [email protected] — Subject line: "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 from within your logged-in 666do account — select "Privacy & Data" from the support topic menu
• Response Time: All formal privacy complaints acknowledged within 24 hours; substantive response provided within 30 calendar days
• Time Zone: Our support team operates in Pakistan Standard Time (UTC+5) but live chat coverage is available 24/7

If you are not satisfied with our response to your privacy complaint following the internal escalation process, you may refer the matter to the relevant data protection supervisory authority in the jurisdiction applicable to your complaint, or to the dispute resolution body appointed by 666do's international gaming licensing authority. Details of the applicable supervisory authority will be provided in our response to your complaint if escalation becomes relevant.