Privacy Policy — 666p Pakistan

666p is an online entertainment platform offering sports betting, casino games, card games and related services primarily to players in Pakistan. 666p is the data controller for the personal information processed under this Privacy Policy. If you have questions about how we handle your data, you can reach us at support@666p.run at any time.

666p collects several categories of personal information depending on how you interact with the Platform. We only collect information that is necessary for the purpose it is used for. The main categories are:

We do not collect sensitive categories of personal data (such as health information, religious beliefs or political opinions) unless specifically required by applicable law or regulatory obligation.

666p uses personal information for specific, defined purposes. We do not use your data for any purpose beyond what is described here without obtaining your prior consent. The main uses are:

• To create and manage your 666p account, including identity verification and age confirmation under our strict 18+ policy.
• To process deposits, bets and withdrawals in PKR through your chosen payment method on 666p.
• To provide and maintain platform services — including sports betting, card games, Aviator, virtual sports and the VIP Club.
• To detect, investigate and prevent fraud, money laundering, and Terms of Service violations on the 666p Platform.
• To provide customer support — resolving account issues, payment queries and responsible gaming requests.
• To send transactional communications — deposit confirmations, withdrawal updates, security alerts and important account notifications.
• To send marketing communications about 666p promotions, bonuses and new products — only if you have opted in to receive these, or where we have a legitimate interest basis.
• To analyse platform usage and improve the 666p experience — for example, identifying popular features, fixing technical issues and optimising the mobile experience for Pakistani users.
• To comply with legal obligations — including record-keeping requirements, regulatory reporting and responding to lawful requests from authorities.

666p processes personal data on the following legal bases:

• Contract performance: Processing necessary to operate your 666p account and deliver the services you've signed up for — including processing bets, managing your PKR wallet and operating the VIP Club.
• Legal obligation: Processing required to comply with applicable laws — including KYC/AML regulations, age verification and responding to lawful regulatory requests.
• Legitimate interests: Processing for 666p's legitimate business interests where these do not override your rights — including fraud prevention, platform security and improving the player experience.
• Consent: For optional uses such as marketing communications and optional analytics cookies. You can withdraw consent at any time by contacting support@666p.run.

666p does not sell, rent or trade personal data with any third party. We share data only as necessary to operate the 666p Platform with trusted service providers who are contractually bound to handle data securely:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT partners and card network processors receive the transaction data necessary to process your PKR deposits and withdrawals.
• Identity verification providers: KYC and document verification services receive identity data (name, CNIC, date of birth) only for the purpose of completing your 666p account verification.
• Anti-fraud and security services: Technical data such as IP address and device fingerprint may be shared with fraud prevention providers to protect 666p and all players on the platform.
• Cloud infrastructure providers: 666p uses hosted cloud infrastructure. The providers we work with operate under strict data processing agreements and do not access player data beyond what is technically necessary.
• Legal and regulatory authorities: 666p will disclose personal data to law enforcement or regulatory bodies when required to do so by applicable law or in response to a lawful order.

All 666p transactions are processed in Pakistani Rupees (PKR). 666p takes specific measures regarding financial data because of its sensitivity:

• 666p does not store full payment card numbers. Card payments are tokenised by our PCI-DSS compliant payment gateway — we hold only a masked card reference (e.g., last four digits).
• Mobile wallet credentials (Easypaisa PIN, JazzCash password) are never entered into the 666p Platform — payments are initiated via the wallet provider's own authenticated interface.
• Transaction records (amount, method, date, status) are retained for as long as required by our financial record-keeping obligations — see Section 8 for retention periods.
• If a payment dispute or fraud investigation arises, 666p may need to share transaction records with the relevant payment processor or investigatory authority.

666p uses cookies and similar tracking technologies on the Platform. A cookie is a small data file placed on your device that helps the Platform recognise you and remember your preferences. We use three types:

You can manage your cookie preferences at any time via your browser settings. Please note that disabling essential cookies will prevent 666p from functioning correctly. Disabling analytics or marketing cookies will not affect your ability to use the Platform or place bets.

666p retains personal data only for as long as necessary for the purpose it was collected, or as required by applicable law. Our general retention periods are:

• Account data: Retained for the duration of your active 666p account plus a minimum of 5 years following account closure, to meet regulatory and legal obligations.
• Financial transaction records: Retained for a minimum of 7 years in line with standard financial record-keeping requirements.
• Identity verification documents: Retained for the period required by KYC/AML regulations — typically 5 years from the date of verification or account closure, whichever is later.
• Support communications: Retained for 3 years from the date of the last interaction, to allow for dispute resolution and quality review.
• Analytics data: Aggregated and anonymised after 24 months. Individual-level usage data is not retained beyond this period.

Once the relevant retention period expires, 666p securely deletes or anonymises your personal data. Where data is anonymised rather than deleted, it can no longer be linked back to you as an individual.

As a 666p player, you have the following rights regarding your personal data. To exercise any of these rights, contact us at support@666p.run:

666p implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, loss, destruction or alteration. Our security practices include:

• TLS encryption for all data transmitted between your device and the 666p Platform.
• AES-256 encryption for sensitive data stored at rest on 666p servers.
• Access controls — only authorised 666p staff with a specific operational need have access to personal player data, on a least-privilege basis.
• Regular security audits and vulnerability assessments of the 666p platform infrastructure.
• Two-factor authentication (2FA) for 666p internal systems where staff access player data.
• Incident response procedures — in the event of a data breach, 666p will notify affected players and relevant authorities as required by applicable law.

666p is strictly an adults-only platform. We do not knowingly collect or process personal data from individuals under the age of 18. All 666p registrations require confirmation that the player is 18 or older, and we conduct age verification as part of the KYC process.

If we become aware that a 666p account has been registered by a person under 18, we will immediately close the account, delete the associated data (subject to any legal obligations to retain records of the incident) and refund any deposits that can be returned to the original payment source, less any winnings which will be voided.

If you believe a minor has registered on 666p, please contact us immediately at support@666p.run.

666p's primary player base is in Pakistan and we aim to keep data processing as local as possible. Where personal data is transferred outside Pakistan — for example, to cloud infrastructure or KYC verification providers operating internationally — 666p ensures that appropriate safeguards are in place:

• Contractual data processing agreements with all third-party providers that impose equivalent data protection standards.
• Selection of providers who operate under recognised data protection frameworks.
• Regular review of third-party data handling practices as part of 666p's vendor management process.

We will never transfer your personal data to a third party in a jurisdiction that does not provide an adequate level of data protection without appropriate contractual safeguards in place.

666p reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements or other factors. Material changes — those that significantly affect your rights or how your data is used — will be communicated to registered 666p players via your registered contact details before they take effect.

The most current version of this Privacy Policy will always be published at 666p.run/privacy-policy with an updated "Last Updated" date. We encourage you to review this page periodically. Your continued use of the 666p Platform after a policy update constitutes your acceptance of the revised policy.

If you have any questions, concerns or requests regarding this Privacy Policy or how 666p handles your personal data, please contact us through any of the following channels:

• Email: support@666p.run — use subject line "Privacy / Data Request" for data-related enquiries
• Live Chat: available 24/7 via the 666p Platform
• WhatsApp: via contact details on your 666p account dashboard
• Telegram: via contact details on your 666p account dashboard

We aim to respond to all data-related requests within 14 working days of receiving a verified request. For complex requests involving large amounts of data or requiring legal review, we may extend this period and will notify you accordingly.