y666 Privacy Policy

1 Who We Are

This Privacy Policy is issued by the operator of the y666 platform, accessible at y666.io and all associated subdomains and services (collectively referred to in this document as "y666", "we", "us", or "our"). y666 is Bangladesh's premier online casino and sports betting platform, providing casino games, live dealer tables, sports betting markets, and associated promotional services to players aged 21 and above.

For the purposes of this Privacy Policy, y666 acts as the data controller — that is, the entity responsible for determining the purposes and means of processing your personal data. Any questions about this Privacy Policy or the way y666 handles personal data should be directed to our support team using the contact details in Section 14 of this document.

2 Personal Data We Collect

y666 collects personal data in several categories depending on the nature of your interaction with the platform. The table below summarises the categories of data collected and the context in which each category arises.

y666 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (other than facial photographs for KYC purposes), health data (other than that voluntarily disclosed in a responsible gaming context), or data concerning sexual orientation. If you voluntarily disclose such information in a communication with our support team, it will be used only to assist with your specific query and will not be retained beyond the duration of that interaction.

3 How We Collect Your Data

y666 collects personal data through the following channels and mechanisms:

3.1 Direct Interactions

You provide data directly to y666 when you create an account, complete KYC verification, make a deposit or withdrawal request, claim a promotional offer, contact our support team, or submit a formal complaint. The accuracy and completeness of data you provide directly is your responsibility as a registered account holder.

3.2 Automated Technologies

When you access the y666 platform, we automatically collect Technical Data and Usage Data through server logs, cookies, web beacons, pixel tags, and similar tracking technologies. This data is collected whether or not you hold a registered account and is used primarily to ensure the platform functions correctly, to detect and prevent fraud, and to analyse aggregate usage patterns for platform improvement purposes.

3.3 Third-Party Sources

y666 may receive personal data about you from the following third-party sources:

• Identity verification providers: Services that cross-reference the identity documents you submit during KYC against official data sources to confirm authenticity.
• Payment processors: bKash, Nagad, Rocket, Upay, and card network partners may confirm transaction status, flag unusual payment activity, or return payment method metadata in connection with deposits and withdrawals.
• Fraud prevention services: Third-party databases that flag IP addresses, device fingerprints, or account patterns associated with known fraudulent activity or problem gambling self-exclusion registers.
• Analytics providers: Aggregated, anonymised behavioural analytics data from trusted analytics platforms that help y666 understand how users navigate and interact with the platform at a population level.

4 How and Why We Use Your Data

y666 uses personal data only for specific, documented purposes. We do not use personal data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent or establishing a new legitimate lawful basis. The primary purposes for which y666 processes personal data are as follows:

• Account management: To create, maintain, and secure your y666 account, verify your identity, and enable you to access all platform features to which you are entitled.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, verify payment method ownership, and maintain accurate financial records.
• Legal compliance: To fulfil our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer (KYC) requirements, including maintaining records for the legally required retention periods.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, bonus abuse, money laundering, and other prohibited conduct on the platform.
• Responsible gaming: To administer voluntary deposit limits, self-exclusion requests, cooling-off periods, and other responsible gaming tools, and to identify patterns of behaviour that may indicate a player is experiencing gambling-related harm.
• Customer support: To respond to your support queries, complaints, and formal disputes in a timely and informed manner.
• Platform improvement: To analyse aggregated usage data in order to improve the performance, features, and content of the y666 platform over time.
• Marketing communications: To send you promotional offers, bonus notifications, and platform news by email or SMS, where you have provided consent to receive such communications. You may opt out of marketing communications at any time by contacting support.

5 Legal Basis for Processing

y666 processes personal data on the basis of one or more of the following legal grounds, depending on the processing activity in question:

• Contractual necessity: Processing that is required in order to perform the contract between y666 and you as an account holder — including account creation, transaction processing, and KYC verification.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML/CTF recordkeeping obligations and responses to lawful requests from competent authorities.
• Legitimate interests: Processing that is in the legitimate interests of y666 or a third party, provided those interests are not overridden by your data protection rights — including fraud prevention, platform security, and aggregated analytics for service improvement.
• Consent: Processing that is based on your freely given, informed, and specific consent — in particular the sending of direct marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Sharing Your Personal Data

y666 does not sell, rent, or trade your personal data with any third party. We share personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

6.1 Service Providers

y666 engages trusted third-party service providers to perform specific functions in support of the platform's operation. These include identity verification bureaus, payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard), customer support software providers, cloud infrastructure and hosting providers, and cybersecurity services. All service providers are bound by contractual data processing agreements that restrict their use of your personal data to the specific service they are engaged to deliver.

6.2 Game Studio Partners

Games on the y666 platform are delivered by internationally audited studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These studios may receive a limited set of technical data (such as a pseudonymous player identifier and session token) necessary to deliver and log game outcomes. They do not receive your full identity data or financial account details.

6.3 Legal and Regulatory Disclosure

y666 may disclose personal data to competent governmental, regulatory, law enforcement, or judicial authorities where required to do so by law, court order, or lawful regulatory request. In such cases, y666 will disclose only the specific data required by the lawful request and will notify the affected player to the extent permitted by applicable law.

6.4 Business Transfers

In the event that y666 undergoes a merger, acquisition, restructuring, or sale of all or a substantial part of its assets, personal data held by y666 may be transferred to the acquiring entity as part of that transaction. In such circumstances, y666 will take reasonable steps to ensure that the acquiring entity is bound by privacy obligations equivalent to those in this Privacy Policy, and will notify affected players of the transfer prior to its completion wherever practicable.

7 Cookies and Tracking Technologies

y666 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies do not contain executable code and cannot access files on your device beyond the information they themselves store.

7.1 Types of Cookies Used

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without preventing core platform functionality from working correctly.
• Functional cookies: Used to remember your preferences such as language selection, preferred payment method, and display settings, so that you do not need to re-enter these preferences on each visit.
• Analytics cookies: Used to collect anonymised, aggregated data about how visitors interact with the y666 platform — such as which pages are most frequently visited, how long sessions typically last, and where users encounter errors. This information is used to improve platform performance and content.
• Security cookies: Used to identify unusual access patterns, detect automated bot activity, and prevent fraudulent account access.

7.2 Managing Cookies

You may configure your web browser to refuse all cookies, to alert you when a cookie is being set, or to delete cookies that have already been set. Instructions for managing cookies are available in your browser's help documentation. Please note that disabling strictly necessary cookies will impair or prevent your ability to log in to and use the y666 platform. y666 does not use third-party advertising cookies or behavioural targeting cookies.

8 Data Security

y666 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between your device and y666's servers.
• Encryption at rest for all databases containing personal and financial data, using AES-256 encryption.
• Cryptographic hashing of account passwords using a modern key-derivation function. No y666 employee has access to plain-text passwords.
• Role-based access controls ensuring that y666 staff can access only the personal data necessary for their specific job function.
• Regular independent security audits and penetration testing of platform infrastructure.
• Multi-factor authentication requirements for all y666 internal system access.
• Documented incident response procedures for detecting, containing, and reporting data security incidents within required timeframes.

While y666 takes every reasonable precaution to protect your personal data, no security system is entirely impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, y666 will notify affected players promptly and take all appropriate steps to mitigate harm.

9 Data Retention

y666 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for a minimum of five years following the date of account closure, in order to satisfy anti-money laundering recordkeeping obligations.
• Financial transaction records: Retained for a minimum of five years from the date of each transaction.
• Communications data (support tickets, chat logs): Retained for up to three years from the date of the interaction, or longer where the interaction relates to a formal complaint or legal dispute.
• Technical and usage data: Aggregated analytics data is retained indefinitely in anonymised form. Raw server logs containing IP address data are retained for up to 12 months.
• Responsible gaming data: Self-exclusion records are retained for a minimum of five years from the date of the self-exclusion request to prevent re-registration during an active exclusion period.
• Marketing consent records: Retained for the duration of your account and for two years following account closure or withdrawal of consent, whichever is later, as evidence of the legal basis for any marketing communications sent.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with y666's internal data destruction procedures.

10 Your Data Rights

As a data subject whose personal data is processed by y666, you hold the following rights with respect to that data. To exercise any of these rights, please contact our support team using the details provided in Section 14:

• Right of access: You have the right to request confirmation of whether y666 holds personal data about you and, if so, to receive a copy of that data along with information about how it is being processed.
• Right to rectification: You have the right to request that y666 correct any inaccurate personal data held about you, and to have incomplete data completed where appropriate.
• Right to erasure: You have the right to request that y666 delete personal data about you where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the processing has no other legitimate legal basis. This right is subject to y666's legal data retention obligations — erasure requests cannot override mandatory recordkeeping requirements under AML/CTF law.
• Right to restriction of processing: You have the right to request that y666 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is being assessed.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to y666 in a structured, commonly used, machine-readable format, and to request that this data be transmitted to another controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where y666 relies on legitimate interests as the legal basis, and to object unconditionally to the use of your data for direct marketing purposes.
• Right to withdraw consent: Where y666 processes your data on the basis of consent (including for direct marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

y666 will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further 30 days, with written notice provided to the requestor explaining the reason for the extension.

11 Children and Minors

The y666 platform is strictly intended for adults aged 21 years and above. y666 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Account registration includes age declaration steps and identity verification procedures specifically designed to prevent underage access.

If y666 becomes aware that personal data has been collected from an individual who is under 21 years of age, the associated account will be immediately suspended, all wagering activity will be voided, and personal data will be deleted from y666's active systems as promptly as practicable, subject to any mandatory retention obligations applicable to transactions that may have occurred prior to detection.

If you are a parent or guardian and have reason to believe that a minor has provided personal data to y666 or has accessed the platform, please contact our support team immediately using the contact details in Section 14. y666 takes underage access with the utmost seriousness and will act on all such reports without delay.

12 Third-Party Links and Embedded Content

The y666 platform may contain references to third-party game studios or payment partners whose services are integrated into the platform. While y666 endeavours to partner only with reputable organisations, y666 is not responsible for the privacy practices of third-party services that operate independently of the y666 platform.

Where a third-party service provider processes personal data on behalf of y666, that processing is governed by a data processing agreement requiring the provider to maintain data protection standards consistent with this Privacy Policy. Where a third-party link or service operates independently of y666's control — such as your bKash or Nagad application — you should refer to that party's own privacy policy for information about their data handling practices.

13 Updates to This Privacy Policy

y666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform and services. When material changes are made to this Privacy Policy, y666 will notify registered players via email or in-platform notification prior to the changes taking effect.

The revised Privacy Policy will be published on this page with an updated "Last updated" date displayed at the top of the document. We encourage all players to review this Privacy Policy periodically to remain informed about how y666 protects their personal data. Continued use of the y666 platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way y666 handles your personal data, please contact our support team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: "Data Rights Request — [Your Account Username]"
• Subject line for privacy complaints: "Privacy Complaint — [Your Account Username]"
• Support hours: 24/7, Bangladesh Standard Time (UTC+6)
• Response time: General queries within 2 hours; data rights requests within 30 calendar days

Please include your registered account username and the email address associated with your y666 account in all data-related correspondence so that we can locate your records accurately and respond in a timely manner.