my666 Privacy Policy — Your Data, Your Rights, Our Commitment

1. Data Controller

my666 is the data controller responsible for the personal data of all registered account holders on the my666 platform. As data controller, my666 determines the purposes and means by which personal data is processed. If you have any questions about how your data is handled, you may contact my666's data protection team via the live chat support available 24/7 through the my666 platform, or in writing to the email address listed in Section 15 of this policy.

2. Personal Data We Collect

my666 collects personal data across several categories. The specific data collected depends on how you interact with the platform:

2.1 Identity Data

• Full legal name as it appears on your Pakistani CNIC (Computerised National Identity Card)
• Date of birth (for age verification — 18+ enforcement)
• CNIC number (collected during identity verification at first withdrawal)
• A photograph of your CNIC where identity verification is required
• Selfie photograph in conjunction with CNIC for enhanced verification

2.2 Contact Data

• Email address (used for account communications and support)
• Pakistan mobile number (used for two-factor authentication and account security alerts)
• Residential address where proof of address is required for verification

2.3 Financial Data

• Easypaisa or JazzCash mobile number associated with deposits and withdrawals
• Pakistan bank account details (IBAN) where bank transfer is the chosen payment method
• Deposit history, withdrawal history, and current PKR balance
• Source of funds documentation where required under anti-money laundering obligations

2.4 Gaming Activity Data

• Bet history across all products: Lightning Roulette, La Liga, Cockfighting, Jackpot Slots, and all casino games
• Session duration and frequency data
• Bonus uptake and wagering progress
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)

2.5 Technical Data

• IP address at registration and at each login
• Device type, operating system, and browser version
• Mobile network operator (where applicable for Pakistan players on Jazz, Telenor, Zong, etc.)
• Cookie identifiers and session tokens (see Section 8)

3. How We Collect Your Data

my666 collects personal data through the following channels:

• Direct collection at registration: When you create a my666 account, you provide identity and contact data directly through the registration form.
• Verification processes: When you submit identity documents for KYC verification, my666 collects and processes those documents and the data contained within them.
• Payment transactions: When you deposit or withdraw PKR via Easypaisa, JazzCash, HBL, UBL, MCB Bank, or Meezan Bank, my666 receives transaction confirmation data from the payment provider.
• Platform use: As you use the my666 platform — placing bets, playing casino games, using responsible gaming tools — data about your activity is automatically recorded in your account history.
• Technical collection: my666's servers and analytics tools automatically collect technical data (IP address, device type, session data) whenever you access the platform.
• Customer support interactions: When you contact my666 support via live chat, the content of the conversation is recorded and associated with your account for quality assurance and dispute resolution purposes.

4. How my666 Uses Your Personal Data

my666 uses personal data for the following specific purposes:

• Account creation and management: To register your my666 account, manage your PKR balance, process deposits and withdrawals, and maintain your gaming and transaction history.
• Identity and age verification: To confirm that you are 18 years of age or older and to verify that your identity matches the payment methods used on your account.
• Payment processing: To facilitate PKR deposits via Easypaisa, JazzCash, HBL, UBL, MCB Bank, and Meezan Bank, and to process withdrawal requests to your registered payment method.
• Fraud prevention and security: To detect suspicious login activity, identify potential account sharing, flag unusual betting patterns, and prevent money laundering through the my666 platform.
• Responsible gaming monitoring: To monitor gaming behaviour against responsible gaming indicators, enforce deposit limits and loss limits you have set, and intervene proactively where behaviour suggests problem gambling patterns.
• Legal and regulatory compliance: To comply with anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and any other applicable legal obligations.
• Customer support: To assist you when you contact my666 support, resolve disputes, and process responsible gaming requests such as self-exclusion.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the my666 platform experience for Pakistan players generally.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given explicit consent to receive marketing communications from my666 and have not subsequently withdrawn that consent.

5. Legal Basis for Processing

my666 processes personal data on one of the following legal bases depending on the specific processing activity:

• Contract performance: Processing necessary to deliver the my666 platform services to you in accordance with the Terms & Conditions you accepted at registration — including account management, payment processing, and gaming services.
• Legal obligation: Processing required to comply with applicable laws, including AML obligations, KYC requirements, and age verification mandates.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and responsible gaming monitoring — where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw consent for marketing at any time from your Account Settings after my666 Login.

6. Data Sharing with Third Parties

my666 does not sell, rent, or trade personal data. Data is shared with third parties only in the following limited circumstances, and always under data sharing agreements that require the recipient to protect the data to the same standard as my666:

• Payment providers: Easypaisa, JazzCash, HBL, UBL, MCB Bank, and Meezan Bank receive the minimum data necessary to process your PKR deposits and withdrawals.
• Identity verification providers: Where third-party KYC services are used to verify CNIC documents or conduct enhanced due diligence, the relevant identity data is shared with those providers for that specific purpose only.
• Game software suppliers: For live dealer games such as Lightning Roulette, your anonymised player session data is passed to the game software provider (e.g., Evolution Gaming) solely to facilitate your participation in the game.
• Legal authorities: Where required by applicable law, court order, or regulatory direction, my666 may disclose personal data to law enforcement or regulatory authorities.
• Fraud prevention networks: Anonymised fraud signals (such as flagged IP addresses or device fingerprints) may be shared with industry fraud prevention consortiums where my666 participates.

7. Payment Data and PKR Transactions

Payment data — including Easypaisa and JazzCash mobile numbers, bank IBAN numbers, and transaction amounts in PKR — is processed by my666 solely for the purposes of completing your requested transactions and maintaining your account's PKR balance history.

my666 does not store full bank account credentials, card numbers, or mobile banking PINs on its servers. Payment credentials used for transactions are processed in real time by the relevant payment provider and are not retained in a form that allows my666 to initiate transactions without your explicit instruction.

Transaction records (amounts, dates, payment method type, PKR values) are retained in your my666 account history for a period of seven years to comply with anti-money laundering record-keeping obligations. These records are accessible to you in your Account Transaction History after my666 Login.

8. Cookies and Tracking Technologies

my666 uses cookies and similar tracking technologies on its platform. Cookies are small data files stored on your device when you access the my666 website. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that keep you logged in during your my666 session, security tokens, and cookies that remember your responsible gaming settings. These cannot be disabled without preventing the platform from functioning correctly.
• Performance Cookies: Collect anonymised data about how Pakistan players use the my666 platform — which games are most visited, which pages generate support requests — to help my666 improve the user experience. No personally identifiable data is collected by performance cookies.
• Functional Cookies: Remember your platform preferences such as display settings and language. Not strictly necessary but improve your experience on subsequent visits.
• Analytics Cookies: Used by my666's internal analytics tools to understand aggregate traffic patterns on the platform. Data is processed in anonymised, aggregated form only.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from using the my666 platform. All other cookie categories can be disabled without affecting core platform functionality.

9. Data Retention

my666 retains personal data for only as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following standard retention periods apply:

• Active account data (identity, contact, payment, gaming activity): Retained for the duration of your account's active status plus seven years following account closure, to comply with AML record-keeping requirements.
• KYC verification documents (CNIC copies, proof of address): Retained for five years following account closure.
• Customer support records (live chat transcripts): Retained for three years following the interaction date.
• Technical logs (IP addresses, session logs): Retained for twelve months for security and fraud prevention purposes.
• Marketing consent records: Retained until consent is withdrawn plus three years, as evidence of lawful processing.

Following the applicable retention period, personal data is securely deleted or anonymised in accordance with my666's data disposal procedures.

10. Data Security

my666 applies the following technical and organisational security measures to protect the personal data of Pakistan players:

• Encryption in transit: All data transmitted between your device and the my666 platform is encrypted using 256-bit SSL/TLS encryption. Look for the padlock icon in your browser when accessing my666.
• Encryption at rest: Personal data stored on my666 servers is encrypted at rest using AES-256 encryption.
• Password security: Account passwords are hashed using bcrypt before storage. my666 never stores passwords in plain text and cannot retrieve your password — only reset it.
• Two-factor authentication: my666 offers two-factor authentication via Pakistan mobile number. Enabling 2FA significantly reduces the risk of unauthorised account access. Pakistan players are strongly encouraged to enable 2FA from Account Settings after every my666 Login.
• Access controls: Access to personal data within my666 is restricted to authorised personnel whose job function requires access. Access is logged and audited.
• Breach response: In the event of a personal data breach that poses a risk to affected players, my666 will notify affected account holders via the email address registered on their account within 72 hours of becoming aware of the breach, where practicable.

11. Your Data Rights

Pakistan players registered on my666 hold the following rights in relation to their personal data. To exercise any of these rights, contact my666 support via live chat or write to the address in Section 15. my666 will respond to all data rights requests within 30 days of receipt:

• Right of Access: You have the right to request a copy of all personal data held by my666 about you, including your account data, transaction history, gaming activity records, and any verification documents held.
• Right to Rectification: If any personal data held by my666 is inaccurate or incomplete, you have the right to request that it be corrected. For identity data, correction may require submission of updated documentation.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances you have the right to request deletion of your personal data. Note that this right is subject to my666's legal obligations to retain certain data (e.g., AML record-keeping), which may mean that not all data can be deleted upon request.
• Right to Restriction of Processing: In certain circumstances you may request that my666 restricts processing of your data — for example, while a dispute about accuracy is being resolved.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format and to request that it be transferred to another service provider where technically feasible.
• Right to Object: You have the right to object to processing based on my666's legitimate interests. You also have an absolute right to object to the processing of your data for direct marketing purposes, with effect from the moment of your objection.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time from Account Settings after my666 Login without affecting the lawfulness of processing prior to withdrawal.

12. Minors — Under 18 Data Policy

The my666 platform is strictly for users aged 18 and above. my666 does not knowingly collect personal data from individuals under 18 years of age. Age is verified at registration and at first withdrawal. If my666 determines at any point that a registered account belongs to a person under 18, all personal data associated with that account will be deleted promptly (subject to any retention obligations under AML law) and the account will be permanently closed.

13. International Data Transfers

Some of my666's technology providers and game software suppliers may process data in jurisdictions outside Pakistan. Where personal data is transferred internationally, my666 ensures that appropriate safeguards are in place — including standard contractual clauses and data processing agreements that require the recipient to protect personal data to a standard equivalent to that applied by my666 — before any such transfer takes place.

Payment data relating to Easypaisa and JazzCash transactions is processed within Pakistan by the respective Pakistani payment providers. my666 does not transfer PKR payment data to processors located outside Pakistan for those transaction types.

14. Changes to This Privacy Policy

my666 reviews this Privacy Policy at minimum annually and updates it whenever data handling practices change materially. When changes are made, the "Last Updated" date at the top of this page is revised accordingly. Pakistan players registered on my666 are notified of material changes via the email address on their account in advance of the changes taking effect. The version of this policy posted on this page at any given time is the current version applicable to all active my666 accounts.

If you do not agree with any changes to this Privacy Policy, you may close your my666 account by contacting support via live chat. Continued use of the platform after the effective date of any update constitutes acceptance of the revised Privacy Policy.

15. Contact my666 About Your Privacy

If you have questions about this Privacy Policy, wish to exercise a data right, or want to report a privacy concern, you can reach my666's data protection team through the following channels:

• Live Chat: Available 24/7 directly through the my666 platform after login. This is the fastest way to raise a privacy query or submit a data rights request.
• Email (plain text — not a clickable link): [email protected] — for written privacy requests, include your registered email address, my666 username, and a clear description of your request.

my666 commits to acknowledging all privacy requests within two business days and providing a substantive response within 30 days of receiving all information required to process the request. Where a request is complex or involves a large volume of data, my666 may extend this period by a further 30 days with notice.