a666 Privacy Policy — How We Handle Your Data

a666 is the operator of the online casino and sports betting platform accessible at https://a666.vu (the "Platform"). In this Privacy Policy, references to "a666," "we," "us," or "our" refer to the a666 platform operator. References to "you," "your," or "Player" refer to any individual who accesses, registers on, or uses the a666 Platform in any capacity.

a666 operates under an international gaming authority license and is committed to protecting the personal data of its users in accordance with the data protection standards required by that license. This Privacy Policy governs all personal data processing activities carried out by a666 in connection with the Platform — including data collected through the website, mobile interface, customer support channels, and payment systems.

This Privacy Policy should be read alongside the a666 Terms & Conditions and the a666 Responsible Gambling Policy, both of which form part of the overall agreement governing your relationship with a666.

a666 collects personal data across several categories. The specific data collected depends on how you interact with the Platform:

When you create an a666 account, we collect the personal information you provide during the registration process, including:

• Full legal name (as it appears on your CNIC);
• Date of birth;
• Pakistani CNIC number;
• Residential address (city, province, Pakistan);
• Mobile phone number (used for account verification and JazzCash/EasyPaisa linkage);
• Email address;
• Username and encrypted password.

To comply with our international gaming license obligations and to verify that you meet the a666 age requirement (21+), we collect:

• Scanned or photographed copies of your Pakistani CNIC (front and back);
• Selfie or live photo for facial verification where required;
• Proof of payment method ownership (e.g., JazzCash or EasyPaisa account screenshot) where requested;
• Any additional documentation requested by our compliance team for enhanced due diligence purposes.

a666 collects transaction-related information necessary to process deposits and withdrawals in PKR, including:

• JazzCash or EasyPaisa registered mobile numbers used for transactions;
• HBL, UBL, Meezan Bank, Allied Bank, or SadaPay account details where provided for bank transfer withdrawals;
• USDT TRC20 wallet addresses where cryptocurrency is used;
• Transaction history — deposit amounts, withdrawal amounts, dates, and payment method used;
• Balance history within your a666 Account.

a666 does not store full bank card numbers or full banking credentials. Financial data is processed through secure, licensed payment intermediaries.

We maintain records of your gaming and betting activity on the a666 Platform, including:

• Games played, wagers placed, bet amounts, and outcomes;
• Bonus usage and wagering requirement progress;
• Sports betting selections, odds accepted, and settlement results;
• Session duration and frequency data for responsible gambling monitoring purposes.

When you access the a666 Platform, we automatically collect certain technical information:

• IP address and approximate geolocation derived from IP;
• Device type, model, and operating system;
• Browser type and version;
• Mobile network operator (where applicable);
• Platform access times, session duration, and navigation paths;
• Referring URLs (where you came to a666 from).

If you contact a666 support via live chat, email, or any other communication channel, we retain records of those communications including the content of messages, timestamps, and the resolution of any support tickets or disputes raised.

a666 collects personal data through three primary methods:

• Directly from you: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions;
• Automatically: Technical and usage data collected via cookies, server logs, and analytics tools when you access and interact with the a666 Platform;
• From third parties: Identity verification information from KYC service providers, fraud detection signals from payment processors, and compliance data from our gaming license authority where legally required.

a666 does not purchase personal data from data brokers, public databases, or marketing list providers. All data collected originates from your direct interaction with the a666 Platform or from service providers operating on our behalf to deliver the a666 service.

a666 uses personal data only for the purposes described in this policy. The primary purposes for which we process your data are:

a666 processes personal data only where a valid legal basis exists. The legal bases we rely on are:

• Contractual necessity: Processing required to fulfil our obligations to you under the a666 Terms & Conditions — including account management, payment processing, and game delivery;
• Legal obligation: Processing required to comply with our obligations under our international gaming license — including KYC verification, AML monitoring, age restriction enforcement, and responsible gambling obligations;
• Legitimate interests: Processing for fraud prevention, platform security, duplicate account detection, and service improvement — where these interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications — where you have explicitly opted in to receive such communications from a666. Consent can be withdrawn at any time from your Account Settings.

a666 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent strictly necessary:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Allied Bank, Meezan Bank, SadaPay, and cryptocurrency processing partners receive the minimum data necessary to process your transactions — typically your registered mobile number or account reference and transaction amount;
• KYC verification providers: Licensed identity verification service providers receive your CNIC and related documents solely for the purpose of verifying your identity and age in accordance with our gaming license obligations;
• Game software providers: Third-party game studios and live dealer providers whose games are available on the a666 Platform receive anonymised session tokens and game-specific wager data necessary to deliver their game services. They do not receive your full personal profile;
• Fraud detection services: Specialist fraud and AML screening services receive transaction and device data to help identify suspicious patterns that may indicate fraud, money laundering, or underage gambling;
• Gaming license authority: Our international gaming license authority may require access to certain player data and transaction records as part of their oversight and audit obligations. Such access is legally mandated under the terms of our license;
• Law enforcement and regulatory bodies: Where legally required or compelled by valid court order, a666 will disclose personal data to law enforcement agencies or regulatory authorities. a666 will notify you of such disclosures where legally permitted to do so;
• IT infrastructure providers: Cloud hosting, database, and technical infrastructure providers who process data on a666's behalf under formal data processing agreements that require them to maintain confidentiality and security standards equivalent to those applied by a666.

All third-party service providers who process personal data on a666's behalf are required to enter into data processing agreements that contractually bind them to maintain appropriate data security and to use your data only for the specific purpose for which it was shared.

a666 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by the a666 website that allows the Platform to recognise your browser and remember certain information about your session and preferences.

The types of cookies used by a666 are:

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the a666 Platform. a666 does not use advertising or third-party retargeting cookies.

a666 retains personal data for the minimum period necessary to fulfil the purposes described in this policy, subject to any longer retention periods required by our gaming license obligations or applicable law.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that renders it irreversibly unidentifiable. Where anonymisation is used rather than deletion, the resulting anonymised data may be retained indefinitely for statistical and platform improvement purposes without constituting personal data processing.

a666 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• Transport Layer Security (TLS): All data transmitted between your device and the a666 Platform is encrypted using TLS 1.2 or higher with 256-bit encryption keys. The a666 website enforces HTTPS at all times — unencrypted HTTP connections are automatically redirected;
• Data-at-rest encryption: Sensitive personal data stored in a666's databases — including CNIC details, KYC documents, and financial records — is encrypted at rest using AES-256 encryption;
• Access controls: Access to personal data within a666's internal systems is restricted on a strict need-to-know basis. Staff are granted only the minimum access permissions necessary to perform their role. All data access is logged and auditable;
• Two-factor authentication (2FA): Available to all players on the a666 Platform and mandatory for all a666 staff who access systems containing personal data;
• Regular security audits: a666's platform infrastructure and data handling processes are subject to regular security reviews and penetration testing by qualified third-party security professionals;
• Incident response: a666 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to player rights, a666 will notify affected players and relevant regulatory authorities within the timeframes required by our gaming license obligations.

a666 operates under an international gaming license and, as a result, some of the personal data we collect may be processed by us or by our third-party service providers in countries outside of Pakistan. This includes cloud infrastructure providers and KYC verification services that may operate data processing facilities in multiple jurisdictions.

Where personal data is transferred internationally, a666 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this policy. Such safeguards include contractual data transfer agreements and adherence to the data protection requirements of our gaming license authority.

a666 does not transfer personal data to countries that lack adequate data protection frameworks without first ensuring that contractual and technical measures are in place to maintain the security and confidentiality of that data.

As an a666 player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact a666 support via the in-dashboard live chat or by emailing [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of all personal data that a666 holds about you. a666 will respond to verified access requests within 30 days. The first copy is provided free of charge; subsequent requests within a 12-month period may attract a reasonable administrative fee;
• Right to Rectification: If any personal data held by a666 is inaccurate or incomplete, you have the right to request that it be corrected. Account registration details can be updated directly within your Account Settings for most fields;
• Right to Erasure: You may request that a666 delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. Note that this right is subject to our legal and regulatory retention obligations, which may require us to retain certain data even after Account closure;
• Right to Restriction: You may request that a666 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while a complaint is under investigation;
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to a666 in a structured, commonly used, machine-readable format, and to request that this data be transferred directly to another service provider where technically feasible;
• Right to Object: You have the right to object to a666's processing of your personal data where that processing is based on legitimate interests. a666 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where a666 processes your personal data on the basis of your consent — such as for direct marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

The a666 Platform is strictly for individuals aged 21 years and older. a666 does not knowingly collect or process personal data of any person under the age of 21. The CNIC-verified KYC process is specifically designed to confirm that all players meet this age requirement before any gaming activity is permitted.

If a666 discovers or is notified that personal data belonging to an individual under the age of 21 has been collected — whether through fraudulent misrepresentation of age during registration or any other means — a666 will immediately:

• Suspend the Account in question;
• Delete all personal data associated with the underage individual to the extent not required to be retained for regulatory reporting purposes;
• Refund any deposits made, less any winnings generated (which are void in the case of underage gambling);
• Report the matter to the relevant regulatory authority as required by our gaming license obligations.

If you are a parent or guardian and believe that a person under 21 has registered an a666 Account or accessed the Platform, please contact a666 support immediately via the details in Section 15 of this policy. a666 takes underage gambling with the utmost seriousness and will act on all such reports without delay.

a666 may send you promotional communications — including information about new games, bonus offers, PSL cricket betting promotions, and platform updates — where you have provided your explicit consent to receive such communications during the registration process or at any point thereafter via your Account Settings.

a666 promotional communications are delivered by email and/or SMS to your registered mobile number. You may opt out of receiving marketing communications from a666 at any time by:

• Clicking the unsubscribe link included in any a666 marketing email;
• Updating your communication preferences in the a666 Account Settings panel;
• Contacting a666 support directly and requesting removal from marketing communications.

Opting out of marketing communications does not affect the delivery of essential transactional communications — including Account verification messages, deposit and withdrawal confirmations, KYC status updates, bonus crediting notifications, and security alerts — which a666 will continue to send as necessary for the operation of your Account.

a666 does not share your contact details with third-party marketers or affiliate marketing networks. All promotional communications sent to you by a666 originate from a666 directly and relate exclusively to the a666 Platform.

a666 reserves the right to update or amend this Privacy Policy at any time. The date of the most recent revision is displayed prominently at the top of this page. Where updates are material — meaning they significantly affect how we process your personal data or the rights available to you — a666 will notify registered Players by email prior to the updated policy taking effect.

Non-material updates — such as typographical corrections, clarifications of existing practices, or wording improvements that do not change the substance of how data is processed — may be made without advance notice and will take effect upon publication.

Your continued use of the a666 Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree to the revised policy, you should cease using the Platform and may request Account closure in accordance with the a666 Terms & Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how a666 is protecting your personal data. Previous versions of this policy are available upon request from the a666 Compliance team.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which a666 handles your personal data, please contact our dedicated data protection team using the following details:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate;
• Live Chat: 24/7 support is available directly from within your a666 Account dashboard. For data protection matters, request to speak with the Compliance team;
• Response Time: a666 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days of receipt of all necessary information.