i666 Privacy Policy — How We Handle Your Personal Data

Section 1

Introduction

This Privacy Policy applies to all personal information collected by i666 through the i666.io website, mobile-optimised web experience, and any associated support channels including live chat, email, and WhatsApp. The term "we", "us", or "i666" refers to the operator of the i666 Platform. The term "you" or "Player" refers to any individual who visits, registers on, or uses the i666 Platform in any capacity.

i666 is committed to handling your personal data with care, transparency, and security. This policy is written in plain English and structured to give you a clear understanding of your data rights. Where technical or legal terminology is unavoidable, we have provided plain-language explanations alongside each term.

By accessing the i666 Platform and creating an account, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal information as described herein. If you do not agree to this policy, you should not create an account or use i666's services.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together form the full framework governing your use of the i666 Platform.

Section 2

Personal Data We Collect

i666 collects personal data across several categories. The following table summarises the types of data we collect and the primary reason for collecting each type:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond the photograph on identity documents), or health data except where a Player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request, in which case such data is processed solely to fulfil that request.

Section 3

How We Collect Your Data

i666 collects personal data through the following channels and mechanisms:

• Direct submission at registration: When you create an i666 account, you provide your name, mobile number, date of birth, and preferred payment method details directly through the registration form.
• KYC document upload: When you submit identity documents as part of our Know Your Customer verification process, the images and information contained within those documents are collected and stored securely.
• Payment transactions: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, transaction reference numbers, amounts, and associated payment account identifiers are recorded automatically by our payment processing systems.
• Platform usage: As you browse the i666 website, place bets, play casino games, or interact with any feature of the Platform, our servers automatically record technical and behavioural data including your IP address, device identifiers, session timestamps, and in-platform activity.
• Support interactions: When you contact i666 via live chat, email, or WhatsApp, the content of those communications is recorded for quality assurance, dispute resolution, and training purposes.
• Cookies and tracking technologies: i666 uses first-party cookies and similar technologies to maintain session state, remember preferences, and analyse platform usage patterns. See Section 9 for full details on our cookie practices.

i666 does not purchase personal data from third-party data brokers and does not collect data from social media platforms without your explicit consent.

Section 4

Purpose of Processing Your Data

i666 processes your personal data for the following specific and legitimate purposes. We do not use your data for any purpose that is incompatible with the purposes listed below without first obtaining your explicit consent:

• Account creation and management: To register your account, maintain your BDT Wallet balance, record your betting and gaming history, and manage account settings including responsible gaming tools.
• Identity verification and KYC compliance: To confirm your identity, verify that you meet the minimum age requirement of 21 years, and satisfy our anti-money laundering obligations before processing any deposit or withdrawal.
• Payment processing: To facilitate deposits and withdrawals via your chosen Payment Method, reconcile transaction records, and investigate any disputed or failed transactions.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, collusion, and other forms of prohibited conduct as defined in our Terms and Conditions.
• Responsible gaming: To monitor betting and gaming behaviour for indicators of problem gambling, enforce deposit limits and self-exclusion restrictions, and deliver session time reminders and reality check notifications where configured by the Player.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance through our live chat, email, and WhatsApp support channels.
• Platform improvement: To analyse aggregated and anonymised usage data in order to improve the design, performance, and feature set of the i666 Platform.
• Marketing communications: Where you have opted in to receive promotional communications, to send you information about bonus offers, new games, and seasonal promotions. You may opt out of marketing communications at any time by contacting our support team.
• Legal and regulatory compliance: To meet any obligations imposed by applicable law, to respond to lawful requests from competent authorities, and to exercise or defend legal claims.

Section 5

Legal Basis for Processing

i666 processes your personal data on the basis of one or more of the following legal grounds, depending on the nature of the processing activity:

• Contractual necessity: Processing your identity data, contact data, financial data, and account data is necessary for us to perform the contract between you and i666 — specifically to operate your account, process your transactions, and deliver the betting and gaming services you have requested.
• Legal obligation: Processing KYC documents, transaction records, and AML-related data is required for i666 to comply with applicable anti-money laundering, counter-terrorism financing, and age verification obligations.
• Legitimate interests: Processing technical data and behavioural data for fraud prevention, security monitoring, and platform improvement serves i666's legitimate interest in operating a safe and commercially viable platform, provided that this interest does not override your fundamental rights and freedoms.
• Consent: Processing your data for direct marketing communications is based on your explicit opt-in consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

Section 6

Data Sharing and Disclosure

i666 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data may be shared with the following categories of recipients strictly to the extent necessary for the purposes described in this policy:

• Payment service providers: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, Visa, and Mastercard processing partners receive the minimum data required to process your deposit and withdrawal transactions. These providers are bound by their own data protection obligations and are not permitted to use your data for any purpose other than payment processing.
• Game content providers: Third-party game studios including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe may receive anonymised session identifiers to facilitate game delivery and resolve technical disputes. These providers do not receive your full personal profile.
• KYC and identity verification services: Where i666 uses a third-party KYC service provider to assist with document verification, that provider receives only the document images and identity data required to complete the verification check. All KYC service providers are contractually required to process your data solely on i666's instructions and to maintain equivalent security standards.
• IT and infrastructure providers: Cloud hosting, content delivery network, and cybersecurity service providers who support the operation of the i666 Platform may have access to data stored on our systems in the ordinary course of providing their services. All such providers are subject to data processing agreements.
• Legal and regulatory authorities: i666 will disclose personal data to competent courts, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or in connection with any legal proceedings. We will notify affected Players of such disclosure where legally permitted to do so.
• Professional advisers: i666's legal, audit, and compliance advisers may access personal data on a confidential, need-to-know basis where necessary to provide professional services to i666.

All third parties with whom i666 shares personal data are required by contract to handle that data securely, to use it only for the purposes for which it was shared, and to maintain privacy and data protection standards consistent with this policy.

Section 7

Data Retention

i666 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply to the main categories of data we hold:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of 5 years following account closure, in order to satisfy anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in line with standard financial record-keeping requirements applicable in the region.
• KYC documents: Retained for a minimum of 5 years from the date of submission, or longer if required by a specific regulatory directive applicable to i666's operations.
• Betting and gaming history: Retained for a minimum of 3 years from the date of each individual bet or game round, and longer where required for dispute resolution or ongoing investigations.
• Technical and log data: Retained for a rolling period of 12 months from the date of generation, after which it is automatically purged unless retained in connection with a specific fraud investigation or legal matter.
• Support communications: Retained for 2 years from the date of each interaction, unless the communication relates to an unresolved dispute or is subject to a legal hold.
• Marketing consent records: Retained for as long as you remain opted in to marketing communications and for 1 year following any opt-out, to demonstrate that communications were sent lawfully.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction methods. Anonymised data (from which no individual can be identified) may be retained indefinitely for aggregate analytics and platform improvement purposes.

Section 8

Security Measures

i666 implements a comprehensive set of technical and organisational security measures designed to protect your personal data from unauthorised access, accidental loss, alteration, or disclosure. These measures include but are not limited to:

• TLS/SSL encryption: All data transmitted between your device and the i666 Platform is encrypted in transit using Transport Layer Security (TLS 1.2 or higher). The presence of HTTPS in the browser address bar confirms this encryption is active.
• Encrypted data storage: Sensitive data fields including passwords (stored as salted cryptographic hashes), NID numbers, and financial account identifiers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within i666's systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data protection training.
• Two-factor authentication: i666 offers two-factor authentication (2FA) for Player accounts and requires it for all internal staff accounts with access to production data systems.
• Fraud monitoring: Automated systems continuously monitor account activity for patterns consistent with fraud, account takeover, or money laundering. Suspicious activity triggers an immediate security review.
• Penetration testing: i666 commissions regular third-party security assessments of its web infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: In the event of a data breach that is likely to result in a risk to your rights and freedoms, i666 will notify affected Players as quickly as reasonably practicable and will take all necessary steps to contain and remediate the breach.

Section 9

Cookies and Tracking Technologies

i666 uses cookies and similar client-side technologies to deliver and improve the Platform experience. Cookies are small text files stored on your device by your web browser when you visit a website. The following types of cookies are used on i666.io:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They maintain your login session state, store your language and currency preferences, and enable core security features such as CSRF protection. These cookies cannot be disabled without rendering core Platform functionality inoperable.
• Analytics cookies: These cookies collect anonymised information about how Players use the Platform — such as which pages are visited most frequently, how long sessions last, and which features are used — to help i666 improve the Platform experience. The data collected is aggregated and does not identify individual Players.
• Responsible gaming cookies: These cookies store local session timing data used to trigger in-platform session reminders and reality check notifications configured by the Player. This data is not transmitted off-device.
• Preference cookies: These cookies remember account-level preferences such as your preferred display language, notification settings, and favourite game categories, so that these settings persist across sessions without requiring re-entry.

i666 does not use third-party advertising cookies, behavioural profiling cookies, or any cookie that tracks your activity across websites other than i666.io. We do not use social media tracking pixels.

You may configure your browser to refuse all cookies or to alert you when a cookie is being sent. Please note that disabling strictly necessary cookies will prevent you from logging in to your account and using core Platform features. Disabling analytics or preference cookies will not affect your ability to use the Platform but may result in a reduced personalisation experience.

Section 10

Your Data Rights

As a user of the i666 Platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Data Rights Request". We will respond to all verified requests within 10 business days.

• Right of Access: You have the right to request a copy of the personal data i666 holds about you, along with information about how that data is being processed. We will provide this information in a structured, commonly used format.
• Right to Rectification: If any personal data i666 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Corrections to core identity data (such as your full name or date of birth) may require re-submission of supporting KYC documentation.
• Right to Erasure: You have the right to request that i666 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing based on legitimate interests and there are no overriding legitimate grounds. Please note that this right does not apply where retention is required by law (for example, AML record-keeping obligations).
• Right to Restriction: You have the right to request that i666 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being reviewed or while an objection is being assessed.
• Right to Data Portability: For data processed on the basis of your consent or contractual necessity, you have the right to receive your personal data in a machine-readable format and to transmit it to another data controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing based on legitimate interests, subject to i666's right to demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where i666 processes your data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Section 11

Children's Privacy

The i666 Platform is strictly intended for adults aged 21 years and above. i666 does not knowingly collect, store, or process the personal data of individuals under the age of 21. If i666 becomes aware or has reasonable grounds to believe that personal data belonging to an individual under 21 has been collected through the Platform, that data will be deleted immediately and the associated account permanently closed.

i666 implements age verification as a mandatory step in the account registration and KYC processes specifically to prevent minors from accessing real-money betting and casino services. Any Player who provides false information to circumvent age verification will have their account permanently banned and any deposited funds returned to the originating payment method, less any applicable transaction costs incurred by i666.

If you are a parent or guardian and believe that your child has created an account on i666 and provided us with their personal data, please contact us immediately at [email protected]. We will investigate and take all necessary remedial action within 2 business days of receiving your report.

Section 12

Third-Party Links and Embedded Content

The i666 Platform may contain links to third-party websites or services that are not operated by i666, including links to game provider interfaces delivered within the Platform environment. This Privacy Policy applies solely to data collected by i666 on i666.io and through i666-operated support channels. It does not apply to any data collected by third-party game providers or payment service providers through their own systems.

When you play a game delivered by a third-party provider such as Evolution Gaming, Pragmatic Play, or Ezugi within the i666 Platform environment, that provider's own privacy policy governs the data collected during your interaction with their game software. i666 recommends that you review the privacy policies of all third-party providers whose services you access through or in connection with the i666 Platform.

i666 exercises no control over the content, privacy practices, or data handling of third-party websites and accepts no liability for any data collected by such third parties.

Section 13

Updates to This Privacy Policy

i666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. Material changes to this policy — for example, a change in the categories of data we collect, the third parties with whom we share data, or the legal basis on which we process your data — will be communicated to registered Players via a notice displayed upon login to the Platform, and where appropriate, via the mobile number registered on your account.

The "Effective Date" shown at the top of this document will be updated each time a new version of the policy is published. We recommend that you review this Privacy Policy periodically to stay informed about how we handle your personal data.

Continued use of the i666 Platform following notification of any material update to this policy constitutes your acknowledgement of the revised terms. If you do not accept the updated policy, you should cease using the Platform and may request account closure in accordance with our Terms and Conditions.

Section 14

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data i666 holds about you, please contact our support team through any of the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 via the live chat widget on the i666 Platform
• WhatsApp Support: Available 24/7 in English and Bengali
• Response Time: All privacy-related written correspondence will receive a substantive response within 10 business days (Bangladesh Standard Time, BST, UTC+6)

For urgent account security matters such as suspected unauthorised access, please use the live chat channel for the fastest response. Our average live chat response time is 2–5 minutes around the clock.