d666 Privacy Policy

1 Introduction & Scope

This Privacy Policy applies to all personal data collected and processed by d666 in connection with your use of the d666 platform, accessible at https://d666.bet and all associated subdomains, mobile-optimised pages and API services ("the Platform"). It governs all personal data collected through: account registration; deposits and withdrawals; betting and gaming activity; customer support interactions; marketing communications; and your general browsing activity on the Platform.

d666 is committed to handling all personal data in accordance with applicable data protection principles, including transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. These principles form the foundation of every data processing decision made by d666. This Privacy Policy should be read alongside the d666 Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference.

This Policy applies to all players who access d666 from Bangladesh. Players located outside Bangladesh access the Platform at their own risk and responsibility. d666 makes no representation that its services or data practices are appropriate or compliant with the laws of any jurisdiction outside Bangladesh.

2 Data Controller

For the purposes of this Privacy Policy, d666 acts as the data controller in respect of all personal data collected through the Platform. As data controller, d666 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted lawfully, fairly and transparently.

All data protection queries, subject access requests, correction requests and deletion requests should be directed in writing to the d666 Data Protection contact:

• Email: [email protected] (subject line: "Data Protection Request")
• Response timeframe: Acknowledgement within 48 hours; substantive response within 30 calendar days.

Where d666 engages third-party service providers who process personal data on d666's behalf (for example, payment processors and KYC verification providers), those providers act as data processors under binding contractual obligations that prohibit them from processing your data for any purpose beyond the specific service they provide to d666.

3 Data We Collect

d666 collects personal data through several distinct channels. The categories of data collected are described below, together with the specific channel through which each category is typically gathered.

3.1 Registration Data

When you create a d666 account, you provide the following information:

• Full legal name
• Date of birth (for age verification — 21+ requirement)
• Mobile telephone number (Bangladesh format)
• Nominated mobile banking account details (e.g., bKash number, Nagad number, Rocket number)
• Preferred username and account password (stored in hashed form)

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and to verify player identity and age, d666 may request:

• National Identity Card (NID) number and scan/photograph
• Passport copy (where NID is not available)
• Birth certificate (as supplementary age verification)
• Proof of ownership of nominated payment method (e.g., screenshot of bKash account)
• Selfie or facial photograph for identity matching

3.3 Transaction & Financial Data

d666 records all financial transactions associated with your account, including:

• Deposit amounts, timestamps and payment method references
• Withdrawal requests, amounts and processing status
• Bonus credits, wagering progress and bonus expiry events
• Transaction IDs issued by payment processors (bKash, Nagad, Rocket, Upay, bank transfer)

3.4 Betting & Gaming Activity Data

d666 logs all activity on the Platform including:

• All bets placed, including stake amount, odds, market selection, sport/game type and settlement outcome
• Casino game sessions — game title, provider (e.g., Evolution Gaming, Pragmatic Play), session duration, wager amounts and results
• Loyalty Program points earned and redeemed
• Responsible gaming tool settings (deposit limits, self-exclusion status, session time limits)

3.5 Technical & Device Data

When you access d666, our servers automatically collect certain technical information:

• IP address and approximate geolocation (city/region level)
• Device type, operating system and browser version
• Session start and end times
• Pages visited, links clicked and time spent on each page
• Cookie identifiers and session tokens (see Section 8)

3.6 Customer Support Data

When you contact d666 via live chat, email or WhatsApp, we collect and retain:

• The content of all messages exchanged
• Your account ID and verification status at the time of contact
• Timestamps and support agent identifiers
• Any documents or screenshots you share in support of a query

4 How We Use Your Data

d666 uses your personal data for the following documented purposes:

d666 does not use automated decision-making or profiling that produces legal or similarly significant effects on players without human review. Where automated risk-scoring tools are used in fraud or AML detection, any account action resulting from that scoring is reviewed by a d666 compliance team member before being executed.

5 Legal Basis for Processing

d666 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between d666 and the Player — including account creation, payment processing, bet settlement and bonus administration.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements — including KYC identity verification, anti-money laundering record-keeping, and fraud reporting obligations.
• Legitimate interests: Processing conducted to pursue d666's legitimate business interests where those interests are not overridden by the Player's privacy rights — including platform security, fraud prevention, responsible gaming enforcement and aggregate analytics for product improvement.
• Consent: Processing conducted on the basis of freely given, specific and informed consent — including sending promotional emails, WhatsApp marketing messages and personalised bonus offers. Consent may be withdrawn at any time without detriment to your account standing.

6 Sharing Your Data

d666 does not sell, rent or trade personal data. The following categories of third parties may receive personal data from d666 strictly for the purposes described:

6.1 Payment Processing Partners

To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank and other supported payment channels, d666 shares the minimum necessary transaction data with those payment service providers. These providers are contractually prohibited from using shared data for any purpose beyond processing your specific transaction.

6.2 KYC & Identity Verification Providers

Where d666 uses third-party identity verification services to validate National ID documents or perform facial matching, the relevant document data and photograph are shared with the verification provider under a strict data processing agreement. Verification providers do not retain your documents beyond the duration required to complete the verification check.

6.3 Game Content Providers

Live casino and slot game providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe and Ezugi receive a session token and anonymised player identifier to facilitate game delivery. These providers do not receive your name, NID number, payment method details or full account data. Game session data they record is used solely for game integrity and dispute resolution purposes.

6.4 Legal & Regulatory Authorities

d666 may disclose personal data to law enforcement agencies, courts or regulatory bodies where required to do so by applicable law, court order, or where disclosure is necessary to protect the legal rights of d666 or to prevent fraud or criminal activity. d666 will notify affected players of such disclosure where it is legally permitted to do so.

6.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of d666's business assets, player personal data may be transferred to the acquiring entity. Players will be notified via the platform and registered mobile number prior to any such transfer, and the receiving entity will be bound by obligations no less protective than those in this Privacy Policy.

7 International Data Transfers

Some of d666's service partners — including certain game providers and cloud infrastructure vendors — may process or store data on servers located outside of Bangladesh. Where personal data is transferred internationally, d666 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Bangladesh.

Safeguards used for international transfers include standard contractual clauses, data processing agreements incorporating data minimisation and security obligations, and selection of service partners whose infrastructure meets recognised international security standards (e.g., ISO 27001 certification). d666 does not transfer personal data to jurisdictions that are known to have materially inadequate data protection standards without appropriate contractual safeguards in place.

8 Cookies & Tracking Technologies

d666 uses cookies and similar technologies (including local storage and session storage) to operate the Platform, maintain your session state and gather aggregate analytics data. The cookies used by d666 fall into the following categories:

8.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your login session, remember your security preferences, prevent cross-site request forgery (CSRF) attacks, and ensure that responsible gaming restrictions are applied consistently across your session. These cookies cannot be disabled without preventing you from using core Platform features.

8.2 Analytics Cookies

d666 uses anonymised analytics cookies to understand aggregate patterns of platform usage — such as which pages are most visited, average session duration and common navigation flows. This data is used exclusively to improve the Platform experience. Analytics data is collected in aggregate form and is not linked back to individual player identities.

8.3 Preference Cookies

These cookies remember your platform preferences such as display language, odds format and notification settings, so that you do not have to re-configure them on every visit. Preference cookies are non-essential but enhance your user experience. You may clear these at any time through your browser settings without affecting your ability to use the Platform.

8.4 What d666 Does NOT Use

d666 does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or any cookie technology that tracks your behaviour across websites outside of d666.bet. No data from d666 cookies is shared with advertising networks or data brokers.

You may manage cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform securely.

9 Retention Periods

d666 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data must be retained beyond the standard period due to an ongoing legal dispute, regulatory investigation or fraud inquiry, it will be retained only for as long as that specific matter remains active, and will be isolated from routine processing during that time.

10 Your Rights

As a d666 player, you have the following rights in relation to your personal data. d666 is committed to facilitating the exercise of these rights promptly and without unnecessary friction:

• Right of Access: You have the right to request a copy of all personal data held about you by d666. Requests will be fulfilled within 30 calendar days of receipt.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update certain data directly within your account settings; for data that cannot be self-corrected, contact support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing based on legitimate interests. Note that d666 may be required to retain certain data for legal compliance purposes even where an erasure request is made.
• Right to Restrict Processing: You may request that d666 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to Data Portability: You may request that d666 provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to Object: You may object at any time to the processing of your personal data where that processing is based on d666's legitimate interests. d666 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, contact d666 at [email protected] with the subject line "Data Rights Request", providing your account username and a description of the right you wish to exercise. d666 may request identity verification before fulfilling any rights request to ensure we do not disclose or delete data in response to a fraudulent request.

11 Security Measures

d666 implements a layered security architecture to protect player personal data against unauthorised access, disclosure, alteration and destruction. Key security measures include:

• TLS 1.3 Encryption: All data in transit between your device and d666 servers is encrypted using TLS 1.3 with strong cipher suites.
• Password Hashing: Account passwords are stored using industry-standard one-way cryptographic hashing algorithms. d666 staff cannot view or retrieve your plaintext password.
• Access Controls: Internal access to player personal data is restricted on a strict need-to-know basis. All access events are logged and reviewed regularly.
• Intrusion Detection: d666's infrastructure is monitored 24/7 by automated intrusion detection systems. Anomalous access patterns trigger immediate security review.
• Data Segregation: KYC documents and financial records are stored in segregated, access-controlled storage environments separate from general platform databases.
• Regular Security Reviews: d666 conducts regular internal security reviews and engages external security professionals to conduct periodic penetration testing of the Platform.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to player rights, d666 will notify affected players without undue delay and will take all reasonable steps to contain the breach and mitigate its impact.

While d666 takes all reasonable steps to protect your data, no internet-based platform can guarantee absolute security. You play an important role in protecting your own account by maintaining a strong, unique password and keeping your login credentials confidential. Contact [email protected] immediately if you suspect any unauthorised access to your account.

12 Children & Minors

d666 does not knowingly collect personal data from individuals under the age of 21. If d666 becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended, all associated data will be securely deleted (subject to any applicable legal hold requirements), and any funds in the account will be handled in accordance with d666's underage gambling procedures.

If you are a parent or guardian and believe that a minor in your care has registered with d666, please contact our support team immediately at [email protected]. We will investigate and take all necessary action promptly.

13 Marketing Communications

With your consent, d666 may send you marketing communications relating to promotions, bonuses, new game releases, Loyalty Program updates and seasonal offers via SMS, WhatsApp or email to your registered contact details.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences within your d666 account settings; or
• Replying "STOP" to any WhatsApp or SMS marketing message; or
• Emailing [email protected] with the subject line "Marketing Opt-Out" and your account username.

Opt-out requests are processed within 5 business days. After opting out, you will continue to receive essential transactional communications related to your account (e.g., deposit confirmations, withdrawal notifications, security alerts and KYC requests) — these are not marketing communications and cannot be disabled while your account remains active.

d666 does not share personal data with third-party marketers for the purpose of sending you marketing communications on their behalf. All marketing communications originate directly from d666.

14 Policy Updates

d666 reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, applicable law or Platform features. Where changes are material — meaning they significantly affect your privacy rights or the ways in which d666 uses your personal data — d666 will provide at least 14 days' prior notice via a notice displayed on the Platform and a notification to your registered mobile number.

Minor or administrative updates (such as clarifications, corrections of typographical errors or updates to contact details) may take effect immediately upon publication. The date of the most recent update is always displayed at the top of this page and in the Table of Contents sidebar.

Your continued use of d666 following the effective date of any Privacy Policy update constitutes your acknowledgement of the revised Policy. If you do not agree with any update, you should cease using the Platform and contact [email protected] to request account closure.

15 Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or the way d666 handles your personal data, please do not hesitate to reach out to our dedicated support team. We are available 24 hours a day, 7 days a week, and we aim to respond to all privacy-related enquiries within 48 hours.

• Email: [email protected] (subject line: "Privacy Enquiry")
• Live Chat: Available 24/7 via the d666 Platform
• WhatsApp: +880 1700 000 000

When contacting us regarding a privacy matter, please include your registered account username and a clear description of your query or request. This helps our team locate your records promptly and provide you with an accurate, personalised response.

d666 takes all privacy complaints seriously. If you submit a complaint, we will acknowledge it within 48 hours, investigate thoroughly and provide a substantive written response within 30 calendar days. Where a complaint cannot be resolved within that timeframe due to complexity, we will notify you of the revised resolution date and keep you updated on progress.