x66y Privacy Policy

1 Who We Are

x66y ("we", "us", "our", "the Platform") is the operator of the online gaming and sports betting platform accessible at x66y.net. x66y is licensed and regulated by an international gaming authority and provides cricket betting, live casino, slots, video poker, and instant-win gaming services to registered players, with a primary focus on the Pakistani market.

For the purposes of this Privacy Policy, x66y acts as the data controller in respect of all personal data collected through the x66y platform, website, mobile interface, customer support channels, and related communications. As data controller, x66y is responsible for determining the purposes and means by which your personal data is processed.

This Privacy Policy applies to all x66y registered players, applicants who have begun but not completed registration, visitors to x66y.net, and any individual who contacts x66y support. It covers all personal data processing activities carried out by x66y in connection with the operation of the platform.

2 Data We Collect

x66y collects different categories of personal data depending on your relationship with the platform. The table below summarises the main categories of data collected and why each category is needed:

x66y does not collect special category data (such as health information, political opinions, or biometric data beyond standard identity verification) unless specifically required to do so by a regulatory obligation, in which case you will be separately informed.

3 How We Collect Data

x66y collects personal data through the following channels and mechanisms:

• Direct Registration: Information you voluntarily provide when creating your x66y account, including your name, date of birth, contact details, and address.
• KYC Verification: Identity documents and supporting verification materials you submit in response to x66y's KYC requirements, including CNIC, passport scans, and proof of address documents.
• Financial Transactions: Payment details captured when you initiate deposits or withdrawal requests via JazzCash, EasyPaisa, HBL, UBL, or Meezan Bank.
• Platform Usage: Data automatically generated through your use of the x66y platform, including betting activity, game sessions, navigation behaviour, and feature usage.
• Cookies and Tracking Technologies: Technical data collected through cookies and similar technologies as described in Section 7 of this Policy.
• Support Interactions: Information shared by you when contacting x66y's customer support team via live chat or email.
• Third-Party Verification Providers: Identity and age verification data returned by authorised KYC and fraud prevention service providers engaged by x66y under data processing agreements.

4 Why We Use Your Data

x66y uses your personal data for the following specific purposes. Each purpose is linked to a lawful basis for processing described in Section 5:

• Account creation and management: Registering your x66y account, maintaining accurate account records, and enabling you to access all platform features.
• Age and identity verification: Confirming that you are at least 21 years of age and that your identity matches the details provided at registration, as required by our licensing obligations.
• Processing financial transactions: Crediting deposits to your x66y wallet, processing withdrawal requests, and maintaining accurate transaction records as required by financial regulations.
• Anti-money laundering (AML) compliance: Monitoring transaction patterns, conducting source-of-funds checks, and filing regulatory reports as required by our international gaming licence.
• Fraud prevention and platform security: Detecting and preventing fraudulent account activity, multi-accounting, bonus abuse, and any other activity that threatens the integrity of the x66y platform or harm to other players.
• Responsible gaming monitoring: Using gaming activity data to identify patterns consistent with problem gambling, enforcing player-set limits and self-exclusion decisions, and delivering responsible gaming notifications.
• Customer support: Responding to your queries, resolving complaints, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Platform improvement: Analysing aggregated and anonymised usage data to improve x66y's games, features, and user experience.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw consent at any time as described in Section 13.
• Legal and regulatory compliance: Maintaining records and responding to requests from licensing authorities, law enforcement agencies, and financial regulators as required by law.

5 Legal Basis for Processing

x66y processes your personal data only where a valid legal basis exists. The primary legal bases relied upon by x66y are as follows:

• Contractual Necessity: Processing necessary to perform the contract between you and x66y — primarily account registration, transaction processing, gaming service delivery, and customer support. Without this processing, x66y cannot provide its services to you.
• Legal Obligation: Processing required to comply with x66y's obligations under its international gaming licence, including KYC verification, AML monitoring, age verification (21+), responsible gaming record-keeping, and regulatory reporting.
• Legitimate Interests: Processing carried out on the basis of x66y's legitimate business interests, including fraud detection, platform security, abuse prevention, and aggregated analytics for platform improvement. x66y has assessed that its legitimate interests are not overridden by your data protection rights in respect of these activities.
• Consent: Processing carried out only where you have given clear, freely given, specific, and informed consent — primarily in respect of direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6 Who We Share Data With

x66y does not sell, rent, or trade your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the extent necessary for the specified purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the financial data necessary to process your deposits and withdrawals. These entities are independent data controllers subject to their own privacy policies and regulatory obligations under Pakistan's financial regulations.
• KYC and Identity Verification Providers: Authorised third-party identity verification and age-checking services receive the identity data necessary to complete KYC checks. These providers operate under data processing agreements with x66y and are prohibited from using your data for any purpose beyond the KYC service.
• Game Suppliers: Third-party game studios and live casino providers who supply games on the x66y platform may receive anonymised session data necessary to deliver and technically support their games. These providers do not receive your identity or financial data.
• Fraud Prevention Services: Specialist fraud detection and risk management providers receive technical data (IP addresses, device fingerprints, session patterns) to assist x66y in identifying and preventing fraudulent activity. Data shared is limited to what is necessary for the fraud prevention purpose.
• Regulatory Authorities: x66y's international gaming licence and applicable laws require us to share certain data with licensing authorities, financial intelligence units, and law enforcement agencies upon receipt of a valid legal request or where reporting obligations arise under AML regulations.
• Professional Advisors: Legal counsel, auditors, and compliance advisors may receive limited personal data where necessary for the provision of professional services to x66y, subject to confidentiality obligations.

All third parties with whom x66y shares personal data are required to maintain appropriate technical and organisational security measures and to process data only for the purposes specified. x66y does not authorise any third party to use your personal data for their own independent marketing or commercial purposes.

7 Cookies & Tracking Technologies

x66y uses cookies and similar tracking technologies on the x66y.net website and platform to deliver a functional, secure, and personalised experience. The categories of cookies used by x66y are as follows:

• Strictly Necessary Cookies: Essential for the operation of the x66y platform. These cookies enable core functions such as maintaining your login session, remembering your responsible gaming settings, and processing secure transactions. These cookies cannot be disabled without significantly impairing your ability to use x66y.
• Performance and Analytics Cookies: Used by x66y to collect anonymised and aggregated data about how players navigate and use the platform. This data helps x66y identify performance issues and improve the overall user experience. No personally identifiable information is collected through analytics cookies.
• Functionality Cookies: Enable x66y to remember your stated preferences — such as preferred language, notification settings, and game display options — to provide a more personalised platform experience.
• Security Cookies: Support x66y's fraud detection and account security systems by identifying unusual patterns of access or suspicious device behaviour.

x66y does not use third-party advertising cookies or allow external ad networks to place tracking technologies on x66y.net. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to access and use the x66y platform.

8 Data Retention

x66y retains your personal data for the minimum period necessary to fulfil the purpose for which it was collected, having regard to our legal and regulatory obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active x66y account and for a minimum of 5 years following permanent account closure, in accordance with AML and gaming licence record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction, as required by international AML standards applicable to licensed gaming operators.
• KYC Documentation: Identity verification documents are retained for the duration of your account and for 5 years following closure. Copies are stored securely with access restricted to authorised compliance personnel only.
• Gaming Activity Logs: Bet history and game session records are retained for 3 years from the date of the session for dispute resolution and responsible gaming monitoring purposes.
• Customer Support Records: Support communications are retained for 2 years from the date of the interaction for quality assurance and dispute reference purposes.
• Marketing Consent Records: Records of your marketing opt-in or opt-out decisions are retained for the duration of your account and for 2 years following account closure to demonstrate compliance with consent obligations.
• Technical/Log Data: Server logs and security event logs are retained for 12 months on a rolling basis unless a specific security investigation requires longer retention.

At the end of the applicable retention period, personal data is either securely deleted from x66y's systems or, where deletion is not technically feasible for a specific record type, permanently anonymised so that it can no longer be associated with your identity.

9 Data Security

x66y takes the security of your personal data seriously and has implemented a comprehensive range of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, destruction, or alteration. Our security measures include:

• TLS Encryption in Transit: All data transmitted between your device and x66y's servers is protected by Transport Layer Security (TLS 1.2 or higher), ensuring that your data cannot be intercepted during transmission.
• Encryption at Rest: Sensitive personal data — including identity documents, financial account details, and KYC records — is stored using strong encryption at rest with access restricted to authorised personnel only.
• Access Controls: Access to systems containing personal data is restricted on a strict need-to-know basis. All x66y staff and contractors with access to personal data are subject to confidentiality obligations and receive data protection training.
• Multi-Factor Authentication: Administrative access to x66y's data systems requires multi-factor authentication. x66y also offers and recommends two-factor authentication for all player accounts.
• Regular Security Audits: x66y's platform undergoes regular penetration testing and security audits conducted by independent third-party security specialists.
• Incident Response: x66y maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights and freedoms, x66y will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.

10 International Data Transfers

x66y operates under an international gaming licence, and some of the third-party service providers with whom x66y shares data — including KYC verification providers, game suppliers, and fraud prevention services — may be located in, or process data in, jurisdictions outside Pakistan.

Where personal data is transferred internationally, x66y ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under x66y's licensing obligations. These safeguards include:

• Transferring data only to third parties located in jurisdictions recognised as providing an adequate level of data protection.
• Using contractual data processing agreements that impose data protection obligations on recipients equivalent to those applicable to x66y.
• Applying additional technical safeguards such as data minimisation and pseudonymisation where data is transferred to third-party processors.

You may request further information about the safeguards applicable to any specific international data transfer by contacting x66y's data protection contact at [email protected] with the subject line "International Transfer Query".

11 Your Data Rights

As an x66y player, you hold the following rights in respect of your personal data. x66y is committed to honouring these rights promptly and without unnecessary barriers:

To exercise any of the above rights, contact x66y at [email protected] with the subject line "Data Rights Request", including your registered username and the specific right you wish to exercise. x66y will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. We may need to verify your identity before processing a data rights request to protect your account security.

12 Children & Minors

x66y is strictly a 21+ platform. x66y does not knowingly collect, process, or store any personal data belonging to individuals under the age of 21. Registration by anyone under 21 is prohibited and constitutes a breach of x66y's Terms & Conditions.

If x66y becomes aware, through its age verification processes or otherwise, that personal data has been collected from an individual under the age of 21, x66y will immediately close the associated account, void any transactions, and securely delete all personal data associated with that account without delay.

If you have reason to believe that a minor has registered an x66y account, please contact x66y support immediately at [email protected] so that appropriate action can be taken without delay. x66y takes underage gambling extremely seriously and works actively to prevent it through automated and manual verification systems.

13 Marketing & Opt-Out

x66y may send you promotional communications including bonus offers, PSL season promotions, new game announcements, and platform updates where you have provided explicit consent to receive such communications during registration or through your x66y account settings.

You may withdraw your consent to marketing communications at any time through any of the following methods:

• Using the unsubscribe link included in every x66y marketing email.
• Updating your communication preferences in your x66y account settings dashboard.
• Contacting x66y support at [email protected] with the subject line "Marketing Opt-Out" and your registered account username.

Withdrawal of marketing consent will be actioned within 5 business days. Please note that opting out of marketing communications does not affect your receipt of transactional and service communications, including deposit confirmations, withdrawal notifications, KYC requests, responsible gaming notifications, and account security alerts. These service communications are necessary for the operation of your x66y account and cannot be opted out of while your account remains active.

14 Third-Party Links

The x66y platform may from time to time contain references to third-party services such as payment processors or game suppliers. Where such references include links to third-party websites or platforms, please be aware that x66y has no control over the privacy practices or content of those third-party sites.

This Privacy Policy applies solely to data collected and processed by x66y through the x66y.net platform and its associated services. x66y is not responsible for the privacy policies or data handling practices of any third-party website or service provider. We recommend reviewing the privacy policy of any third party before sharing personal data with them.

15 Policy Updates

x66y reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the expansion of x66y's services. All updates will be published on this page at x66y.net/privacy-policy with a revised "Last Updated" date at the top of the Policy.

Where a change to this Privacy Policy is material — meaning it significantly affects the way x66y processes your personal data or materially reduces your privacy rights — x66y will provide advance notice of the change via email to your registered address and/or through a prominent notice on the x66y platform prior to the change taking effect. Continued use of the x66y platform following the effective date of any updated Privacy Policy constitutes acceptance of the revised terms.

We encourage all x66y players to review this Privacy Policy periodically. If you have any questions or concerns about a specific update, please contact x66y support before the change takes effect so that we can address your concerns directly.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or x66y's data processing practices, please contact x66y's data protection team using the details below. We are committed to resolving all privacy-related queries promptly and transparently.

• Email: [email protected] (subject line: "Privacy Query" or "Data Rights Request")
• Live Chat: Available 24/7 through the x66y platform
• Response Time: x66y will acknowledge all privacy-related contacts within 5 business days and provide a substantive response within 30 calendar days.

If you are not satisfied with x66y's response to your privacy concern, you have the right to escalate your complaint to the relevant supervisory authority under x66y's international gaming licence. Details of the applicable regulatory authority are available upon request from x66y's support team.