666p2 Privacy Policy
— Your Data, Protected

For the purposes of this Privacy Policy, the data controller responsible for the collection and processing of your personal information is the entity operating the 666p2 Platform at 666p2.net. 666p2 operates under international gaming compliance standards and maintains its player data infrastructure in accordance with applicable data protection legislation.

All references to "666p2," "we," "us," or "our" in this Privacy Policy refer to the 666p2 data controller entity and its authorised data processors acting on its behalf. If you require specific details regarding the registered identity of the data controller for legal or regulatory purposes, please submit a written request to our privacy team at the contact details provided in Section 14.

666p2 collects personal data across the following categories. The specific data points collected from any individual player will depend on the services used and the stage of the account lifecycle reached.

666p2 does not collect special category data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data for identification purposes beyond the standard CNIC photograph check required for age and identity verification under KYC procedures.

666p2 collects personal data through the following channels and mechanisms:

• Direct Input: Information you actively provide during the registration process, KYC verification, deposit and withdrawal forms, support chat, and account settings updates.
• Automated Technologies: Data collected automatically as you interact with the 666p2 Platform, including cookies, web beacons, session tracking scripts, and server-side logging of technical connection data such as your IP address and device identifiers.
• Payment Processors: Transaction confirmation data, masked payment account references, and fraud-screening signals received from JazzCash, EasyPaisa, and participating Pakistani bank payment gateways when you initiate a deposit or withdrawal.
• Identity Verification Partners: Confirmation responses from KYC verification service providers used to authenticate CNIC documents and cross-reference identity data against sanctions and PEP screening databases.
• Game Providers: Game session metadata, RNG audit logs, and bet-settlement records supplied by 666p2's certified third-party game content providers, used for dispute resolution and regulatory compliance.
• Fraud Detection Systems: Device fingerprinting data, behavioural analytics signals, and velocity checks performed by 666p2's automated fraud prevention infrastructure to detect duplicate accounts, bonus abuse, and money laundering patterns.

666p2 processes your personal data only where a valid legal basis exists. The primary legal bases relied upon for different categories of processing activity are as follows:

• Contractual Necessity: Processing required to deliver the services you have contracted with 666p2 to receive — including account creation, fund management, game access, bet settlement, and withdrawal processing. Without this processing, 666p2 cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, know-your-customer (KYC) identification duties, sanctions screening, and mandatory reporting to competent authorities.
• Legitimate Interests: Processing carried out on the basis of 666p2's legitimate business interests where those interests are not overridden by your privacy rights. This includes fraud prevention, network security, responsible gaming monitoring, business analytics, and improving Platform performance.
• Consent: Where 666p2 relies on your consent as a legal basis — for example, for optional marketing communications or the use of non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Withdrawal of consent for marketing can be actioned at any time via your account notification settings or by emailing the privacy team.

The personal data collected by 666p2 is used for the following specific purposes. We do not use your data for any purpose not listed here without first providing you with appropriate notice and, where required, obtaining your consent.

• Account Administration: Creating, maintaining, verifying, and securing your 666p2 account, including processing your 666p2 Login sessions, resetting credentials, and managing account restrictions.
• Identity & Age Verification: Verifying that you are who you say you are and that you meet the minimum age requirement of 21 years. 666p2 does not permit access to real-money gaming services until identity verification is satisfactorily completed.
• Payment Processing: Facilitating PKR deposits and withdrawals through JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and bank transfer channels, reconciling transaction records, and investigating disputed transactions.
• Fraud & AML Compliance: Screening transactions and account activity against known fraud patterns, sanctions lists, and politically exposed person (PEP) databases. Reporting suspicious activity to relevant financial intelligence authorities as required by applicable law.
• Responsible Gaming: Monitoring gameplay patterns to identify indicators of problem gambling behaviour, enforcing deposit limits and self-exclusion orders, and communicating responsible gaming support resources to players who may need them.
• Customer Support: Responding to your queries, investigating complaints, processing refunds, and resolving disputes in relation to your 666p2 account or betting activity.
• Service Improvement: Analysing anonymised and aggregated usage data to improve the performance, features, and content of the 666p2 Platform, including optimising the cricket betting interface and slot game library for Pakistani users.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to your registered email or mobile number — but only where you have not opted out and only in respect of 666p2's own services. 666p2 does not use your data for third-party marketing.
• Legal & Regulatory Compliance: Retaining records as required by applicable gaming, financial, and data protection regulations, and responding to lawful requests from regulatory, law enforcement, or judicial authorities.

666p2 shares your personal data only with the categories of third parties described below, and only to the extent necessary for the stated purpose. All third-party recipients are subject to data processing agreements that require them to maintain appropriate security standards and to use your data solely for the purposes for which it was shared.

• Payment Service Providers: JazzCash, EasyPaisa, and participating Pakistani banks and payment gateways receive the minimum transaction data necessary to process your deposits and withdrawals securely.
• KYC & Identity Verification Providers: Specialist third-party verification services receive CNIC document scans and identity data to perform age verification, sanctions screening, and document authenticity checks on behalf of 666p2.
• Game Content Providers: Licensed game studios and live dealer platform providers receive your player account reference and session data necessary to deliver certified game content and to settle bets accurately.
• Fraud Prevention & Cybersecurity Partners: Technology providers operating fraud detection, device fingerprinting, and account security systems on behalf of 666p2 receive technical and behavioural data to perform their contracted functions.
• Regulatory & Law Enforcement Authorities: 666p2 will disclose personal data to competent authorities — including financial intelligence units, gaming regulators, and law enforcement agencies — where required to do so by a lawful order, subpoena, or mandatory reporting obligation.
• Professional Advisors: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations may access personal data on a need-to-know basis in connection with their advisory engagements.

666p2 does not share personal data with social media platforms, advertising networks, data brokers, or any third party for commercial marketing purposes. If 666p2 undergoes a business merger, acquisition, or restructuring event, player data may be transferred to the successor entity, and affected players will be notified in advance.

666p2 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to keep your session secure, and to understand how players interact with the site. The types of cookies deployed by 666p2 are described below.

You can manage your cookie preferences at any time via the cookie settings panel accessible from the footer of the 666p2 Platform. Note that disabling certain cookie categories may affect the functionality of some Platform features.

666p2 applies the following standard retention periods to each category of personal data. These periods reflect the balance between operational necessity, legal obligation, and the principle of storage limitation.

• Account and Identity Data: Retained for the full duration of your active account plus five years following account closure or the last account activity, to satisfy AML record-keeping obligations.
• Financial Transaction Records: Retained for seven years from the date of each transaction in compliance with applicable anti-money laundering and financial record-keeping requirements.
• KYC Documents: Retained for five years from the date of verification or from the date of account closure, whichever is later. Document scans are stored in encrypted form with access restricted to authorised compliance personnel.
• Gameplay and Betting History: Retained for five years to support dispute resolution, responsible gaming monitoring, and regulatory audit requirements.
• Support and Communications Records: Retained for three years from the date of the last communication to support dispute escalation and quality assurance.
• Technical and Log Data: Retained for 12 months from the date of collection, after which it is automatically deleted or anonymised for aggregate analytics purposes.
• Responsible Gaming Records: Self-exclusion and deposit limit records are retained for a minimum of six years to allow 666p2 to honour reinstatement restrictions and to demonstrate regulatory compliance.
• Marketing Consent Records: Retained for the duration of your account plus three years to evidence the lawful basis for any marketing communications sent to you.

Upon expiry of the applicable retention period, personal data is securely deleted using methods that prevent reconstruction, or is irreversibly anonymised for use in aggregate statistical reporting. 666p2 does not archive personal data beyond its stated retention period.

666p2 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. The key technical and organisational measures in place include:

• Transport Layer Security: All data in transit between your browser or app and the 666p2 servers is encrypted using TLS 1.3 with modern cipher suites. The 666p2 domain enforces HTTPS-only access with HSTS headers enabled.
• Data Encryption at Rest: Sensitive personal data fields — including CNIC numbers, bank account references, and identity document content — are encrypted at rest using AES-256 encryption. Database credentials and encryption keys are stored in a hardware security module (HSM) with strict access controls.
• Access Controls: Access to production databases and player personal data is restricted to authorised personnel only, on a need-to-know basis, enforced through role-based access control and multi-factor authentication. All access events are logged and subject to periodic audit.
• Penetration Testing: The 666p2 Platform undergoes regular independent penetration testing and vulnerability assessments. Critical findings are remediated within defined SLA timeframes.
• Incident Response: 666p2 maintains a documented data breach incident response plan. In the event of a personal data breach that creates a risk to your rights and freedoms, 666p2 will notify affected players without undue delay and will report the breach to the relevant supervisory authority within required timeframes.
• Employee Training: All 666p2 staff with access to personal data receive mandatory data protection training covering applicable privacy obligations, secure data handling practices, and phishing awareness.

As a 666p2 player, you hold the following rights in respect of your personal data. 666p2 will respond to all verified privacy rights requests within 30 calendar days of receipt. In cases of complexity or volume, this period may be extended by a further 60 days, in which case we will notify you of the extension and its reason.

• Right of Access: You have the right to request a copy of all personal data held by 666p2 about you, along with information about how it is being used and with whom it has been shared. This is sometimes called a Subject Access Request (SAR).
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by 666p2. You can update most account information directly through your account settings page.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. Note that 666p2 may be required to retain certain data for legal compliance reasons even following an erasure request.
• Right to Restriction: You have the right to request that 666p2 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is disputed or while an objection is being assessed.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object at any time to processing based on legitimate interests, including profiling. 666p2 will cease the relevant processing unless compelling legitimate grounds are demonstrated that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact 666p2's privacy team using the details in Section 14. 666p2 will not charge a fee for the first SAR in any 12-month period. Requests that are manifestly unfounded, excessive, or repetitive may be subject to a reasonable fee or may be declined, with written reasons provided.

The 666p2 Platform is strictly for adults aged 21 years and above. 666p2 does not knowingly collect personal data from any individual under the age of 21. The CNIC-based KYC verification process is specifically designed to prevent minors from accessing real-money gaming and betting services on the Platform.

If 666p2 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, the associated account will be suspended immediately, all data relating to that individual will be deleted as soon as legally permissible, and any funds deposited will be returned to the originating payment method following a verification process.

Some of the third-party service providers used by 666p2 — including game content platforms, fraud detection systems, and KYC verification services — may process your personal data in jurisdictions outside Pakistan. Where such international transfers occur, 666p2 ensures that adequate safeguards are in place to protect your personal data to a standard equivalent to the protections described in this Privacy Policy.

The safeguards 666p2 relies upon for international transfers include:

• Data processing agreements incorporating standard contractual clauses approved by recognised data protection authorities.
• Transfers exclusively to service providers located in jurisdictions that maintain an adequate level of data protection as assessed by reference to international standards.
• Technical measures including end-to-end encryption for all data transmitted across international network boundaries.

You may request further information about the specific safeguards applicable to any international transfer of your personal data by contacting 666p2's privacy team using the details in Section 14.

666p2 may update this Privacy Policy from time to time to reflect changes in our data processing practices, to comply with new legal or regulatory requirements, or to improve transparency. The version number and effective date displayed in the banner at the top of this page reflect the most recent revision.

Where changes to this Privacy Policy are material — meaning they significantly affect how your personal data is used, your rights, or the categories of data collected — 666p2 will notify you by email to your registered address and by prominent in-platform notification at least 14 days before the changes take effect. Non-material clarifications may be published without advance notice.

Your continued use of the 666p2 Platform after the effective date of an updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree to the revised terms, you should cease using the Platform and contact support to initiate account closure. 666p2 will retain a version archive of prior Privacy Policy texts which is available upon request.

For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by 666p2, please contact our dedicated privacy team using the details below:

When submitting a data rights request, please include your registered email address, a description of your request, and a copy of your CNIC (front side only, with the back and photograph obscured) so that we can verify your identity before processing the request. 666p2 will never action a data rights request without first confirming the identity of the requesting individual to prevent unauthorised access to account information.

If you are not satisfied with 666p2's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. 666p2 takes all privacy complaints seriously and will cooperate fully with any regulatory investigation.