Privacy Policy — 666ad

1 Introduction

666ad ("we", "us", "our") operates the online gaming information platform accessible at https://666ad.cam (the "Platform"). This Privacy Policy ("Policy") sets out in detail how we collect, process, store, share and protect personal data relating to users of the Platform ("you", "User").

We take data privacy seriously. This Policy is written in plain English so that every user — including players across Pakistan, from Karachi and Lahore to Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — can understand exactly what data we hold about them and why. If any part of this Policy is unclear, please contact us using the details in Section 16.

This Policy applies to all personal data processed in connection with your use of the Platform, including data submitted during account registration, KYC verification, deposit and withdrawal transactions, customer support interactions and general browsing. It should be read alongside our Terms & Conditions and Responsible Gambling policy.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform.

2 Definitions

The following definitions apply throughout this Privacy Policy:

3 Data We Collect

666ad collects the following categories of personal data in connection with your use of the Platform:

3.1 Identity & Account Data

• Full legal name as it appears on your government-issued ID.
• Date of birth (collected to verify that you meet the applicable minimum age requirement of 18+, or such higher age as required by the operator's jurisdiction).
• Pakistani CNIC number or passport number, where submitted for KYC verification.
• Username and encrypted password credentials.
• Photograph or selfie image submitted during liveness/identity checks.
• Residential address, including city (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar) and postal code where applicable.

3.2 Contact Data

• Email address registered to your Account.
• Mobile or telephone number where provided for account security or support purposes.
• Preferred communication language (English or Urdu, where specified).

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts (in PKR or other applicable currency), dates, timestamps and method references.
• Payment method identifiers (e.g., partial mobile wallet number associated with Easypaisa or JazzCash, IBAN fragment for bank transfer via HBL, UBL, Meezan Bank or Bank Alfalah) — stored only to the minimum extent required for transaction verification and AML compliance.
• Source-of-funds documentation where requested under AML obligations.
• Cryptocurrency wallet addresses where crypto deposits or withdrawals are processed (BTC, ETH, USDT, if supported).

3.4 Usage & Technical Data

• IP address, device type, operating system and browser version.
• Pages visited, content accessed, session duration, click paths and search queries within the Platform.
• Referring URL (the website or search engine from which you arrived at the Platform).
• Device identifiers and mobile advertising IDs where applicable.
• Login timestamps and geographic location at session level (derived from IP, not GPS).

3.5 Support & Communication Data

• Content of any messages submitted to customer support via live chat, email or the help centre ticketing system.
• Call recordings where telephone support is used, subject to advance notice.
• Feedback, survey responses and any voluntary information you provide.

3.6 Responsible Gambling Data

• Responsible gambling tool settings you configure, including deposit limits, session timers, loss limits and self-exclusion status and duration.
• Self-assessment questionnaire responses where completed voluntarily.
• Records of any responsible gambling interventions or support referrals.

4 How We Collect Data

We collect personal data through the following methods:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or voluntarily provide information through forms on the Platform.
• Automatically — through cookies, server logs, analytics tools and similar tracking technologies when you browse the Platform. See Section 10 for full cookie details.
• From third-party KYC providers — where identity verification is conducted through an authorised third-party verification service, we may receive verification status, risk flags and document authenticity results.
• From payment processors — limited transaction confirmation data may be received from payment processors to reconcile deposits and withdrawals.
• From fraud prevention and AML partners — data matching and risk screening results may be received from authorised compliance service providers under applicable AML regulations.
• From publicly available sources — in limited circumstances, we may collect information from publicly available registries or databases for identity verification or sanctions screening purposes.

5 Purposes of Processing

We process your personal data only for clearly defined, legitimate purposes. The table below maps each data category to its processing purpose:

6 Legal Basis for Processing

666ad processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms & Conditions, including account management, transaction processing and KYC verification.
• Legal obligation: Processing required to comply with applicable AML regulations, responsible gambling legal obligations, tax reporting requirements and data retention mandates under applicable law.
• Legitimate interests: Processing undertaken to pursue legitimate business interests, including fraud prevention, platform security, analytics and service improvement, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing undertaken only where you have provided a clear, freely given, specific and informed consent — particularly for optional marketing communications. You may withdraw consent at any time by contacting us using the details in Section 16.
• Vital interests: In exceptional circumstances, processing may be required to protect your vital interests or those of another person, such as in cases of problem gambling crisis intervention.

7 Data Sharing & Disclosure

666ad does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• KYC and identity verification providers: Third-party services used to verify your identity, age and document authenticity as part of our compliance obligations. These providers process data only under our documented instructions.
• Payment processors and financial service providers: Where Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah or other payment infrastructure is referenced in transaction processing, limited data may be passed to facilitate transaction settlement. Such providers are not affiliated with gambling services and receive only the minimum data required for transaction processing.
• AML and fraud prevention services: Authorised compliance partners who screen transactions and identities against relevant watchlists and risk databases under applicable AML legal requirements.
• Cloud hosting and infrastructure providers: Secure cloud service providers who host Platform data under strict data processing agreements and industry-standard encryption standards.
• Analytics service providers: Tools used to analyse Platform usage patterns (using anonymised or aggregated data where possible). Raw personal data is not shared for third-party analytics purposes.
• Customer support platform providers: Where live chat, ticketing or help centre tools are provided by third-party software vendors, support communication data may be processed on those platforms under our instructions.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies or courts where required by applicable law, legal process or binding official request.
• Business successors: In the event of a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor entity, subject to equivalent data protection obligations continuing to apply.

8 International Data Transfers

The Platform may store and process personal data in jurisdictions outside Pakistan. Where personal data is transferred internationally, 666ad takes commercially reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to applicable data protection principles. Such safeguards may include:

• Data processing agreements incorporating standard contractual clauses with international service providers.
• Use of service providers located in jurisdictions with recognised adequate data protection frameworks.
• Technical security controls including end-to-end encryption for data in transit and at rest.

If you are a user located in Pakistan, please note that data protection law in Pakistan is still developing. 666ad does not claim to be compliant with any specific Pakistani regulatory data protection regime but operates under internationally recognised data protection principles as described in this Policy. For queries about international transfers, contact us using the details in Section 16.

9 Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following general retention principles apply:

• Account data: Retained for the duration of your Account and for a minimum period of five (5) years following Account closure, in order to satisfy AML and anti-fraud compliance requirements.
• KYC documents (CNIC, passport, selfie): Retained for the minimum period required under applicable AML regulations from the date of verification or account closure, whichever is later — typically five (5) years.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with standard AML record-keeping obligations.
• Support communications: Retained for up to three (3) years following resolution of the relevant query, unless the matter relates to an ongoing legal dispute.
• Usage and technical data (logs): Typically retained for up to twelve (12) months for security and analytics purposes, then aggregated or anonymised.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter to evidence compliance.

When personal data is no longer required for any legitimate purpose, it will be securely deleted or anonymised in accordance with our data deletion procedures.

10 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to deliver a functional, personalised and secure user experience. By continuing to use the Platform, you consent to the use of cookies as described in this section. You may withdraw consent or manage cookie preferences at any time through your browser settings, though some Platform features may not function correctly if essential cookies are disabled.

10.1 Types of Cookies We Use

10.2 Managing Cookies

You can control cookie storage through your browser settings. Most browsers allow you to view, delete and block cookies on a per-site basis. Instructions for major browsers are available in the respective browser's help documentation. Please note that blocking essential cookies will prevent you from logging into your Account and accessing core Platform features.

11 Your Data Rights

Subject to applicable law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights in relation to your personal data held by 666ad. To exercise any of these rights, please submit a request using the contact details in Section 16.

12 Children's Privacy

The Platform is strictly intended for adults aged 18 years or above — or such higher minimum age as required by the applicable operator license jurisdiction. We do not knowingly collect personal data from minors. If you are under the applicable minimum age, you must not access or use the Platform, and you must not submit any personal data to us.

If we become aware that we have inadvertently collected personal data from a user who is under the applicable minimum age, we will take immediate steps to delete that data and close the associated Account. Any funds deposited by or on behalf of a minor will be handled in accordance with applicable law and the operator's published terms.

Parents and guardians who believe their child may have accessed the Platform or created an Account should contact us immediately using the details in Section 16. We treat all such reports as a priority.

13 Data Security

666ad implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your browser and the Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Encryption at rest: Sensitive personal data stored in our systems, including identity documents and financial data, is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data within 666ad is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Secure KYC upload: Identity documents submitted for KYC verification must be uploaded exclusively through the Platform's verified secure HTTPS upload portal. Never send CNIC copies, passport images or selfies through unsecured email, chat or third-party apps.
• Penetration testing and security audits: The Platform undergoes periodic security assessments to identify and remediate vulnerabilities.
• Incident response: In the event of a data security incident that poses a risk to your rights and freedoms, 666ad will take prompt remedial action and notify affected users and relevant authorities in accordance with applicable legal requirements.

No system is entirely immune to security risks. We strongly encourage you to use a strong, unique password for your Account, enable two-factor authentication where available, and notify us immediately if you suspect any unauthorised access to your Account.

14 Pakistan-Specific Privacy Notice

This section provides additional context specifically relevant to users located in Pakistan.

Pakistan's data protection regulatory framework continues to evolve. The Personal Data Protection Bill has been under development, and users should be aware that formal data protection rights under Pakistani law may differ from those described in this Policy, which draws on internationally recognised data protection principles.

Payment provider data: References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on this Platform are contextual mentions of familiar Pakistani payment infrastructure. These providers are not affiliated with 666ad and do not endorse gambling activity. Any data exchanged with these providers in connection with a transaction is limited to what is strictly required to process that transaction and is governed by those providers' own privacy policies, which are independent of this Policy.

Gambling legal context: Pakistan has gambling restrictions under the Prevention of Gambling Act, 1977. This Privacy Policy does not constitute legal advice regarding the lawfulness of gambling or data processing under Pakistani law. Users in Pakistan are responsible for understanding applicable national and provincial law before using this Platform. 666ad does not claim to be authorised, licensed, regulated or endorsed by the Government of Pakistan, the PTA, the State Bank of Pakistan or any Pakistani financial institution or authority.

Government access: Like all operators, 666ad may be required to disclose personal data to Pakistani law enforcement or government authorities in response to a lawful, binding official request. We will seek legal advice before complying with any such request and will notify affected users where permitted by law to do so.

15 Amendments to This Policy

666ad reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, Platform functionality or business operations. When material changes are made, the "Last Updated" date at the top of this page will be revised accordingly.

For significant changes that materially affect how we process your personal data or your rights under this Policy, we will endeavour to provide reasonable advance notice to registered Users via email or a prominent in-Platform notification. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of those changes.

We recommend reviewing this Privacy Policy periodically. If you have concerns about any proposed change, please contact us before the effective date using the details in Section 16.

16 Contact Us

For any queries, concerns or requests relating to this Privacy Policy or the exercise of your data rights, please contact the 666ad data privacy team through the following channels:

We aim to acknowledge all formal data rights requests within five (5) business days and to resolve them within thirty (30) calendar days, or such extended period as permitted by applicable law for complex requests. We will notify you if a longer period is required.