xx66 Privacy Policy — How We Handle Your Personal Data

1 Introduction

xx66 ("we", "us", "our", "the Platform") is committed to safeguarding the privacy of every player who registers and participates on xx66.bar. This Privacy Policy sets out, in clear and accessible language, what personal data we collect from players located in Bangladesh and elsewhere, why we collect it, how we use and protect it, and what rights you have in relation to your own data.

This policy applies in full to all individuals who: browse xx66.bar; register a player account; make deposits or withdrawals; place bets or play casino games; contact xx66 customer support; or receive xx66 marketing communications. It covers data collected through the xx66 website, any xx66 mobile-optimised interface, and any communications channel operated by xx66.

xx66 takes a privacy-first approach to product development. New features and data processing activities are assessed for privacy risk before implementation. We apply data minimisation at every stage — collecting only what is needed, retaining it only as long as necessary, and protecting it with appropriate technical and organisational controls throughout its lifecycle.

2 Data We Collect

The categories of personal data collected by xx66 depend on how you interact with the platform. The following table summarises the main data types we collect and the context in which each category arises:

xx66 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data, except where a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request. Such disclosures are handled with additional care and are used solely for the purpose for which they were shared.

3 How We Collect Data

xx66 collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting support, or responding to a survey or promotion.
• Automated technical collection: Data gathered automatically when you access xx66.bar, including IP address, browser fingerprint, cookie data, and session activity logs. This data is collected regardless of whether you are logged in to an account.
• Payment provider data: When you initiate a transaction via bKash, Nagad, Rocket, Upay, or a linked bank, the payment provider shares limited transaction confirmation data with xx66 to verify that your deposit or withdrawal has been processed.
• Identity verification partners: Where xx66 uses a third-party KYC (Know Your Customer) service to verify your identity documents, that service returns a verification result and a confidence score to xx66. The underlying document images are held by the verification partner per their own privacy policy.
• Fraud prevention services: xx66 may receive risk signals from fraud detection partners relating to your IP address, device, or payment method. These signals are used solely to protect the platform and its players from fraudulent activity.

4 Legal Basis for Processing

xx66 processes personal data only where a valid legal basis exists. The primary bases relied upon are:

• Contract performance: Processing your identity, contact, financial, and account data is necessary to create and maintain your xx66 account, process deposits and withdrawals, settle bets, and provide customer support. Without this processing, xx66 cannot deliver its service to you.
• Legal obligation: xx66 is required by applicable law to retain transaction records, conduct identity verification, perform anti-money laundering checks, and report certain activities to relevant authorities. This processing is mandatory and cannot be opted out of.
• Legitimate interests: xx66 processes technical and usage data to detect fraud, prevent abuse, improve platform security, and optimise the user experience. These interests are balanced against your privacy rights and do not override them.
• Consent: xx66 sends marketing communications — including promotional emails, SMS bonus alerts, and seasonal offer notifications — only to players who have provided explicit opt-in consent. Consent may be withdrawn at any time without affecting your ability to use the platform.

5 How We Use Your Data

xx66 uses collected personal data for the following specific purposes:

• Creating, verifying, and maintaining your xx66 player account, including enforcing the one-account-per-person rule and the 21+ age requirement.
• Processing deposits, withdrawals, and bonus credits in Bangladeshi Taka (BDT) via your chosen payment method.
• Settling bets and casino game rounds, maintaining a complete and accurate record of your transaction and game history.
• Providing customer support via live chat, email, and support ticket systems, and maintaining records of those communications to ensure service quality.
• Detecting, investigating, and preventing fraud, money laundering, collusion, bonus abuse, and other prohibited conduct as defined in the xx66 Terms & Conditions.
• Conducting identity verification and Know Your Customer (KYC) checks as required to comply with anti-money laundering regulations.
• Sending transactional notifications — such as deposit confirmations, withdrawal status updates, and account security alerts — to your registered mobile number or email address.
• Sending marketing communications about xx66 promotions, bonuses, and seasonal offers to players who have consented to receive them.
• Analysing aggregated, anonymised usage data to improve the platform's design, game selection, and feature set. Aggregated data does not identify individual players.
• Administering the xx66 Responsible Gaming programme, including monitoring for signs of problem gambling behaviour and applying account-level protection measures where appropriate.

6 Data Sharing & Disclosure

xx66 does not sell, rent, or otherwise commercially transfer your personal data to any third party. Data is shared only in the following limited circumstances, and always subject to strict contractual confidentiality obligations:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and Islami Bank receive only the minimum data required to process your transaction — typically your wallet number or bank account reference, transaction amount, and a xx66-generated reference code.
• Identity verification partners: Your name, date of birth, and document images are shared with xx66's KYC partner solely to complete the verification process. The partner is contractually prohibited from using this data for any other purpose.
• Fraud and risk platforms: Technical identifiers such as IP address, device fingerprint, and session metadata may be shared with fraud prevention services to assess risk. No directly identifying information (name, phone number, national ID) is included in these signals.
• Game content providers: When you play a game provided by a studio such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, or Spribe, a session token and a pseudonymous player ID are passed to the studio's game server to initialise the game. The studio does not receive your name, contact details, or financial information.
• Legal and regulatory authorities: xx66 will disclose personal data to law enforcement, financial intelligence units, or other competent authorities when required to do so by law, court order, or regulatory direction. Where legally permitted, xx66 will notify the affected player of such a disclosure.

7 Cookies & Tracking Technologies

xx66.bar uses cookies and similar tracking technologies to operate core platform functionality and to improve the user experience. The categories of cookies used are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that keep you logged in during your visit, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred deposit method, and notification preferences across sessions. Disabling these cookies will cause the platform to revert to default settings on each visit.
• Analytics cookies: Used by xx66's internal analytics system to understand how players navigate the platform, which games are most popular, and where usability improvements can be made. Data collected is aggregated and pseudonymised — individual players are not identified in analytics reports.
• Security cookies: Help detect and prevent fraudulent activity by tracking unusual patterns of platform interaction. These are part of xx66's fraud prevention infrastructure and are active on all account-authenticated pages.

xx66 does not use third-party advertising cookies or behavioural tracking pixels from social media platforms or advertising networks. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies will significantly impair your ability to use the xx66 platform.

8 Data Retention

xx66 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of your active account plus five years following account closure. This retention is required for anti-money laundering compliance and dispute resolution purposes.
• Financial transaction records: Retained for a minimum of five years from the date of the transaction in accordance with applicable financial record-keeping requirements.
• Bet and game history: Retained for 90 days in active account records; archived in encrypted storage for five years thereafter for audit and dispute purposes.
• Customer support communications: Retained for three years from the date of the last communication in a support thread.
• Marketing consent records: Retained for the duration of your account and for two years following withdrawal of consent, as evidence that communications were sent on a lawful basis.
• Technical and usage logs: Retained for 12 months in active systems; aggregated anonymised summaries may be retained indefinitely for platform analytics.

Upon expiry of the applicable retention period, personal data is securely deleted from xx66 systems using industry-standard data destruction methods. Backups containing personal data are purged on a rolling schedule consistent with the above retention periods.

9 Your Privacy Rights

As a player on xx66, you hold the following rights in relation to your personal data. To exercise any of these rights, contact xx66 at [email protected] with the subject line identifying the right you wish to exercise, your registered username, and a brief description of your request.

• Right of access: Request a copy of all personal data xx66 holds about you. xx66 will respond within 14 calendar days.
• Right to rectification: Request correction of inaccurate or incomplete personal data held on your account. Minor corrections (e.g., phone number updates) can be made directly in account settings.
• Right to erasure: Request deletion of your personal data, subject to xx66's legal retention obligations. Erasure requests for data subject to a mandatory retention period will be fulfilled at the end of that period.
• Right to restrict processing: Request that xx66 limits how it uses your data while a dispute or rectification request is being resolved.
• Right to data portability: Request a structured, machine-readable copy of the personal data you have provided directly to xx66 (e.g., account registration data), in a format suitable for transfer to another service.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: Object to processing carried out on the basis of xx66's legitimate interests where you believe your interests or fundamental rights override those interests.

xx66 will acknowledge all privacy rights requests within 48 hours (BST) and provide a substantive response within 14 calendar days. In complex cases, the response period may be extended by a further 14 days, in which case xx66 will notify you of the extension and its reason.

10 Children & Minors

xx66 is strictly an adult platform. No person under the age of 21 is permitted to register an account, make a deposit, place a bet, or otherwise use the xx66 service. xx66 does not knowingly collect personal data from individuals under the age of 21.

If xx66 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all associated data will be deleted (subject to any mandatory retention obligations), and any remaining balance will be returned to the payment method from which it originated after verification of the account holder's identity.

11 Data Security

xx66 implements a layered security architecture to protect player data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and xx66 servers.
• AES-256 encryption at rest for all stored personal and financial data in xx66 databases.
• Bcrypt password hashing — xx66 never stores passwords in plaintext. All passwords are hashed using a computationally expensive algorithm before storage.
• Role-based access controls limiting access to personal data to only those xx66 staff members whose job function requires it.
• Regular security audits and penetration testing carried out by independent security professionals to identify and remediate vulnerabilities.
• 24/7 intrusion detection monitoring with automated alerting for suspicious access patterns, failed login attempts, and anomalous data queries.
• Secure data destruction procedures for all hardware decommissioned from the xx66 infrastructure.

In the event of a data breach that poses a material risk to players, xx66 will notify affected individuals without undue delay and will take immediate remedial action to contain the breach and prevent further exposure.

12 Third-Party Services

The xx66 platform integrates with a number of third-party services to deliver its full functionality. Each integration involves limited, purpose-specific data sharing as described in Section 6. xx66 conducts due diligence on all third-party partners before integration and requires all partners to maintain data protection standards consistent with this Privacy Policy.

xx66 is not responsible for the privacy practices of third-party services accessed via links from xx66.bar that fall outside the xx66 operating infrastructure. The xx66 website does not contain links to external third-party websites for general browsing — all navigation remains within the xx66.bar domain.

Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe operate their own privacy policies governing data processed within their game servers. These studios receive only pseudonymous session tokens from xx66 and do not process your personally identifying information directly.

13 Changes to This Privacy Policy

xx66 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. Material changes — those that significantly affect how your personal data is used or what rights you hold — will be communicated to registered players via email to the address on file, with a minimum of seven days' notice before the updated policy takes effect.

Minor updates such as typographical corrections, clarifications of existing language, or updates to partner names will be reflected on this page without prior individual notification. The "Effective Date" at the top of this document will be updated each time a new version is published. We encourage you to review this Privacy Policy periodically. Your continued use of the xx66 platform following a policy update constitutes your acknowledgement of the revised terms.

14 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to report a privacy concern, please contact the xx66 privacy team using the details below. All privacy correspondence is handled by a dedicated team member and is treated with strict confidentiality.

• Email: [email protected] — plain text address, not a clickable link. Use the subject line "Privacy Request" and include your registered username.
• Response time: xx66 acknowledges all privacy queries within 48 hours (Bangladesh Standard Time, UTC+6) and provides a full response within 14 calendar days.
• Postal correspondence: Players who are unable to contact xx66 by email may submit written privacy requests to the xx66 player support address published in the xx66 Help Centre. Please include your full registered name, account username, and a clear description of your request.