k666 Privacy Policy — How We Handle Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how k666 ("the Platform", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "the User", "the Player") who access or use the k666 online casino and sports betting services available at k666.bar and any associated subdomains or applications operated by k666.

k666 is committed to handling all personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. While Bangladesh does not yet have a comprehensive standalone data protection statute equivalent to the European Union's General Data Protection Regulation (GDPR), k666 voluntarily aligns its data practices with GDPR standards as a baseline, recognising these as the most robust framework currently available for protecting the privacy rights of individuals.

This Policy should be read in conjunction with the k666 Terms & Conditions, which are incorporated herein by reference. In the event of a conflict between this Policy and the Terms & Conditions on a data-related matter, this Policy shall take precedence.

k666 is the data controller for all personal data collected through the k666 platform. This means we determine the purposes and means of processing your personal data and bear primary responsibility for ensuring that processing is carried out lawfully and fairly.

2. Data Controller Details

The data controller responsible for your personal data collected through the k666 platform is k666, operating under an international gaming licence. All data-related correspondence, including data subject access requests, correction requests, deletion requests, and complaints, should be addressed to the k666 Data Protection contact using the details provided in Section 14 of this Policy.

k666 has designated a responsible individual within its compliance function to oversee data protection matters, ensure that data processing activities comply with this Policy, and act as the primary point of contact for data protection enquiries from players and regulatory bodies.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register an account, use our services, or contact our support team, k666 collects personal data that you provide directly, including:

• Identity data: Full legal name, date of birth, gender, and nationality.
• Contact data: Email address, mobile telephone number, and residential address (including city, district, and postcode).
• Identity verification documents: Copies of government-issued national identity card (NID), passport, driving licence, or other KYC documents submitted during the verification process.
• Financial data: Mobile wallet identifiers (bKash, Nagad, Rocket, Upay account references), bank account details, and transaction records associated with your k666 account.
• Account credentials: Your chosen username and hashed password (k666 never stores passwords in plain text).
• Communications data: Content of messages sent to k666 via live chat, email, or support tickets.

3.2 Data Collected Automatically

When you access the k666 platform, certain technical data is collected automatically by our systems and third-party analytics tools, including:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, time spent on each session, bet history, wagering patterns, deposit and withdrawal activity, and feature interactions.
• Location data: General geographic location derived from your IP address (country and city level only — k666 does not collect precise GPS location data).
• Cookie and tracking data: Information collected via cookies, web beacons, pixels, and similar technologies as described in Section 9 of this Policy.

3.3 Data from Third Parties

k666 may receive personal data about you from third parties in limited circumstances, including:

• Identity verification service providers used to complete KYC checks.
• Payment processors and mobile wallet operators confirming transaction completion and account ownership.
• Fraud prevention and anti-money laundering screening services.
• Responsible gaming support organisations where you have consented to information sharing in connection with a self-exclusion or support programme.

4. Lawful Basis for Processing

k666 processes your personal data only where a recognised lawful basis exists. The following table summarises the primary lawful bases applied to each category of processing activity:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for marketing communications, for example, does not affect the continued processing of your data for contractual or legal purposes.

5. How We Use Your Personal Data

5.1 Account and Service Delivery

The primary use of your personal data is to provide you with the k666 services you have registered for. This includes creating and maintaining your account, processing your deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank transfer methods, delivering game outcomes, settling sports betting markets, and managing your bonus and promotional entitlements.

5.2 Identity Verification and Compliance

k666 is legally required under its international gaming licence to verify the identity of all players before allowing withdrawals and to conduct ongoing monitoring to detect and prevent money laundering, terrorist financing, and fraud. Your identity documents and financial data are used exclusively for these compliance purposes and are not accessible to the k666 commercial or marketing teams.

5.3 Responsible Gaming

k666 uses your usage data — including session duration, deposit frequency, wagering patterns, and self-reported preferences — to monitor for indicators of problem gambling behaviour and to provide you with appropriate responsible gaming tools and interventions. This processing is in your direct interest and is a condition of k666's gaming licence obligations.

5.4 Customer Support

When you contact k666 support, your account information and the content of your communications are used to resolve your query, investigate complaints, and maintain a record of interactions for quality assurance and dispute resolution purposes. Support interaction records are retained for the period described in Section 7.

5.5 Security and Fraud Prevention

Technical data including IP addresses, device identifiers, and login patterns is used by k666's security systems to detect and prevent unauthorised account access, fraudulent activity, multi-accounting, bonus abuse, and other platform integrity threats. This processing is a legitimate interest of k666 and directly protects all players on the platform.

5.6 Marketing Communications (Consent-Based)

With your explicit consent, k666 may send you promotional communications about new games, bonus offers, tournaments, and platform updates via email or SMS. You may withdraw consent for marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting k666 support. Withdrawal of marketing consent does not affect your ability to use the k666 platform.

5.7 Platform Improvement and Analytics

Aggregated and anonymised usage data is used by k666 to understand how players interact with the platform, identify technical issues, improve game performance, and develop new features. This data cannot be used to identify individual players and is retained only for the period necessary for the relevant analytical purpose.

6. Sharing Your Personal Data

k666 does not sell, rent, or trade your personal data to any third party. We share personal data only in the following limited circumstances:

6.1 Service Providers

k666 engages carefully selected third-party service providers to assist in delivering the k666 platform and related services. These providers are permitted to process your personal data only on k666's documented instructions and for the specific purposes for which they were engaged. Current categories of service providers include: payment processors and mobile wallet operators (including bKash, Nagad, Rocket, and Upay integration partners); identity verification and KYC service providers; cloud hosting and infrastructure providers; anti-fraud and AML screening services; customer support platform providers; and game content providers (including Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, and Microgaming). All service providers are required to maintain appropriate technical and organisational security measures.

6.2 Legal and Regulatory Obligations

k666 may disclose personal data to competent legal, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or lawful regulatory demand. k666 will, where legally permissible, notify you of any such disclosure request before complying. Disclosures to authorities are documented and reviewed by k666's legal and compliance team.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of k666's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via the email address registered to your account before your data becomes subject to a different privacy policy.

6.4 With Your Consent

k666 may share your data with third parties not described above where you have provided explicit, informed consent to such sharing. You may withdraw this consent at any time by contacting k666 support.

7. Data Retention

k666 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following retention periods apply as general guidelines:

• Account and identity data: Retained for the duration of your active account relationship with k666, plus a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping obligations.
• KYC and verification documents: Retained for a minimum of 5 years following account closure or the completion of the relevant verification process.
• Customer support records: Retained for 3 years from the date of the last interaction, unless related to an ongoing dispute or regulatory matter.
• Marketing consent records: Retained for the duration of your consent plus 3 years to demonstrate compliance with consent obligations.
• Technical and usage data: Retained for up to 24 months from collection, after which it is anonymised or deleted.

When data is no longer required, k666 will securely delete or anonymise it using industry-standard data destruction procedures. Anonymised data derived from your usage may be retained indefinitely for aggregated statistical analysis.

8. Security Measures

k666 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security controls in place include:

• Encryption in transit: All data exchanged between your device and the k666 platform is encrypted using TLS 1.2 or higher, implementing 256-bit SSL certificates across all platform endpoints.
• Encryption at rest: Sensitive data fields — including identity documents, payment references, and account credentials — are encrypted at rest in the k666 database infrastructure.
• Access controls: Access to personal data within k666's internal systems is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all staff with data access.
• Password storage: Account passwords are never stored in plain text. k666 uses industry-standard one-way cryptographic hashing (bcrypt) with per-user salts for all password storage.
• Intrusion detection: k666's infrastructure is monitored continuously for unusual access patterns, potential intrusion attempts, and data exfiltration indicators using automated security monitoring tools.
• Penetration testing: k666 conducts periodic third-party penetration testing of its platform to identify and remediate security vulnerabilities before they can be exploited.
• Staff training: All k666 personnel who handle personal data receive regular data protection and security awareness training.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device by the k666 platform when you visit or log in. They allow the platform to recognise your device across sessions, remember your preferences, maintain your logged-in status, and collect usage data for analytics and security purposes.

9.2 Types of Cookies Used by k666

• Essential cookies: Required for the platform to function correctly. These include session management cookies, authentication tokens, and security cookies. They cannot be disabled without impairing platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, display preferences, and last-used game categories. These improve your experience but are not strictly necessary.
• Analytics cookies: Used to collect anonymised information about how players use the platform — including which pages are visited most frequently and how users navigate between sections. This data helps k666 improve the platform.
• Security cookies: Used to detect and prevent fraudulent activity, including multi-accounting and automated bot access. These cookies analyse login patterns and device consistency.

9.3 Managing Cookies

You may manage non-essential cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a per-site basis. Please note that disabling essential cookies will impair your ability to log in and use the k666 platform. Disabling analytics or functional cookies will not affect your ability to play games or make transactions, but may result in a less personalised experience.

10. International Data Transfers

k666 operates infrastructure and engages service providers that may be located outside Bangladesh. As a result, your personal data may be transferred to and processed in countries other than Bangladesh, including countries in Asia, Europe, and other regions where k666's hosting and service providers maintain operations.

Where personal data is transferred internationally, k666 implements appropriate safeguards to ensure that the level of protection afforded to your data is equivalent to the standards described in this Policy. Safeguards employed include contractual protections (standard data protection clauses incorporated into contracts with all data processors), technical measures (encryption of data in transit and at rest), and selection of service providers that maintain recognised international security certifications.

By using the k666 platform and accepting this Privacy Policy, you consent to the transfer of your personal data to countries outside Bangladesh in the circumstances described above, subject to the safeguards described.

11. Your Data Rights

k666 recognises and upholds the following data rights for all players. To exercise any of these rights, please contact k666 using the details in Section 14. k666 will respond to all data rights requests within 30 days of receipt. Complex or high-volume requests may require an extension of up to a further 60 days, of which you will be notified.

11.1 Right of Access

You have the right to request a copy of all personal data k666 holds about you, along with information about the purposes for which it is processed, the categories of data involved, and the recipients to whom it has been disclosed. This is commonly known as a Subject Access Request (SAR).

11.2 Right to Rectification

If any personal data k666 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented without undue delay. Please note that changes to identity data may require re-verification of your account through our KYC process.

11.3 Right to Erasure

You may request that k666 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis exists), or where you object to processing and there are no overriding legitimate grounds. Please note that k666 may be required to retain certain data for legal and regulatory compliance purposes even following a deletion request — in such cases, k666 will clearly explain which data must be retained and why.

11.4 Right to Restriction

You may request that k666 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed. During a restriction period, k666 will continue to store your data but will not actively process it for purposes other than storage.

11.5 Right to Data Portability

Where processing is based on your consent or on a contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transferred to another data controller where technically feasible.

11.6 Right to Object

You have the right to object to the processing of your personal data where k666 relies on legitimate interests as the lawful basis. k666 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims. You have an unconditional right to object to processing for direct marketing purposes at any time.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, use the unsubscribe link in any k666 marketing email or contact k666 support directly.

12. Children and Minors

The k666 platform is strictly restricted to individuals who are 21 years of age or older. k666 does not knowingly collect or process personal data relating to individuals under the age of 21. If k666 becomes aware that personal data has been collected from a person under 21, that data will be permanently deleted and the associated account closed immediately.

Parents and guardians who believe their child may have accessed the k666 platform or provided personal data to k666 are encouraged to contact k666 support immediately at the address in Section 14 so that the matter can be investigated and resolved without delay.

13. Changes to This Privacy Policy

k666 reviews this Privacy Policy at least annually and updates it whenever our data processing practices change in a material way. When changes are made, the "Last Updated" date at the top of this Policy will be revised accordingly. For material changes — meaning changes that significantly affect how your personal data is used or your rights in relation to it — k666 will provide advance notice via a prominent notice on the k666 platform and, where appropriate, by email to the address registered on your account.

Your continued use of the k666 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you must stop using the k666 platform and may request account closure. Historical versions of this Privacy Policy are available on request from k666 support.

14. Contact and Data Rights Requests

For any privacy-related enquiries, data subject rights requests, or concerns about how k666 handles your personal data, please contact the k666 data protection team using the following details:

• Email: [email protected] (mark the subject line "Data Protection Request" or "Privacy Enquiry")
• Response Language: English
• Response Time: Within 30 days of receipt for data rights requests; within 5 business days for general privacy enquiries
• Operating Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

k666 takes all privacy enquiries and data rights requests seriously. If you are not satisfied with k666's response to a privacy concern, you have the right to escalate the matter to k666's senior compliance team by emailing the same address and marking your message "Formal Privacy Complaint — Escalation". k666 will acknowledge formal complaints within 48 hours and provide a final response within 15 business days of acknowledgement.