Privacy Policy

1. Introduction

This Privacy Policy (hereinafter "Policy") describes how 666ep (hereinafter "666ep", "we", "us" or "our"), the operator of the online gaming platform at https://666ep.cam (the "Platform"), collects, processes, stores, shares and protects personal data relating to users who access or register on the Platform (hereinafter "you", "User" or "Player").

By accessing, browsing or registering on the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy should be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and 666ep. This Policy forms part of the binding agreement between you and 666ep.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including but not limited to name, CNIC number, email address, phone number, IP address and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction or deletion.
• "Data Controller" means 666ep as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of 666ep under a binding data processing agreement.
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" means identity and verification documents submitted as part of the Know Your Customer process, including CNIC, passport, proof of address and liveness verification images.
• "Cookies" means small text files placed on your device by the Platform for the purposes described in Section 9 of this Policy.
• "Sensitive Personal Data" means Personal Data that warrants a higher level of protection due to its nature — including identity documents, financial data and any data relating to vulnerable individuals.

3. Data We Collect

666ep collects Personal Data through several channels: information you provide directly during registration and account use, data generated automatically through your interaction with the Platform, and data received from third-party service providers where applicable. The categories of Personal Data we collect are set out in the table below.

4. How We Use Your Personal Data

666ep uses the Personal Data it collects for the following purposes. Each purpose is paired with its applicable legal basis, as described further in Section 5.

4.1 Account Registration and Management

We use your Registration Data and Contact Data to create and manage your player account, verify your identity, communicate with you about your account status and provide access to the Platform's gaming services. This is the foundational use of your data and is necessary to perform our contract with you.

4.2 Identity Verification and Compliance

KYC Data is processed to verify your identity and age, ensure compliance with anti-money laundering (AML) obligations, prevent fraud and meet the requirements imposed by 666ep's licensing authority. This processing is required by law and by the terms of the operator's gaming licence. Pakistani CNIC details, passport data and liveness images are processed with the same degree of care as Sensitive Personal Data.

4.3 Transaction Processing

Financial Data is processed to facilitate deposits, withdrawals and the recording of all gaming transactions. This includes processing in Pakistani Rupees (PKR) and working with payment infrastructure providers. Payment brand names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced only as contextual local payment options. 666ep does not share your financial data with those providers beyond what is strictly necessary to execute a transaction you have initiated.

4.4 Platform Security and Fraud Prevention

Technical Data and Usage Data are analysed to detect and prevent fraudulent activity, identify prohibited conduct (including multi-accounting and bonus abuse), monitor for unusual transaction patterns and protect the integrity of the Platform. This processing is in our legitimate interest and is necessary to maintain a safe environment for all users.

4.5 Customer Support

Communications Data is used to handle support requests, resolve disputes and improve service quality. Support interactions are conducted in English and Urdu. Records of support communications are retained for the period described in Section 8.

4.6 Responsible Gambling Monitoring

Usage Data and Financial Data are used to monitor gaming behaviour for indicators of problem gambling, to enforce self-exclusion requests, deposit limits, loss limits and session time limits set by the player, and to comply with responsible gambling obligations under the operator's licensing terms. This processing is in both your interest and our legitimate regulatory interest.

4.7 Marketing Communications

Where you have provided explicit consent, we may use your Contact Data and Marketing Preferences to send you promotional emails, bonuses and offers relevant to your interests on the Platform. You may withdraw this consent at any time through your account settings or by contacting support. Withdrawal of marketing consent does not affect the lawfulness of processing carried out prior to withdrawal.

4.8 Analytics and Platform Improvement

Aggregated and anonymised Usage Data and Technical Data are used to analyse platform performance, understand how players interact with the site, identify areas for improvement and optimise the user experience for players across Pakistan, including those accessing from Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar.

5. Legal Basis for Processing

666ep processes Personal Data under one or more of the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing is necessary to perform the contract between you and 666ep — specifically, to provide you with access to the Platform, manage your account and process your transactions.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including AML regulations, KYC requirements under the operator's licensing framework and tax reporting obligations.
• Legitimate Interests: Processing is necessary for the legitimate interests of 666ep — including fraud prevention, platform security, responsible gambling monitoring and service improvement — provided those interests are not overridden by your data protection rights.
• Consent: Where processing is not covered by the above bases, we rely on your explicit consent — primarily for marketing communications and non-essential analytics cookies. You may withdraw consent at any time without detriment to your account status.

6. Data Sharing and Disclosure

666ep does not sell, rent or trade your Personal Data to third parties for marketing purposes. We may share your Personal Data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who process Personal Data on our behalf under binding data processing agreements. These include: KYC and identity verification providers, payment processing infrastructure partners, cloud hosting and data storage providers, analytics platform providers and customer support tooling providers. All Data Processors are contractually required to process data only on our instructions and to maintain appropriate security standards.

6.2 Regulatory and Legal Disclosure

We may disclose Personal Data to regulatory authorities, law enforcement agencies, courts or other competent bodies where required by applicable law, where we receive a valid legal order or where we reasonably believe disclosure is necessary to prevent fraud, money laundering or other criminal activity. Such disclosures will be documented and limited to the minimum data necessary to satisfy the legal request.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of all or part of 666ep's business, Personal Data held by 666ep may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer and the privacy implications via a prominent notice on the Platform and/or by email to the registered address.

7. International Data Transfers

666ep operates a global platform infrastructure. Your Personal Data may be transferred to and stored on servers located outside Pakistan. Where such transfers occur, 666ep ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require the receiving party to maintain data protection standards consistent with those applied by 666ep.

As noted in Section 1, Pakistan does not currently have a fully enacted data protection law specifying international transfer mechanisms. 666ep applies internationally recognised transfer safeguards as a matter of policy, regardless of the absence of a domestic legal mandate. If you have questions about the safeguards applied to international transfers of your data, you may contact our Data Privacy team using the details in Section 15.

8. Data Retention

666ep retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever period is longer. The following retention principles apply:

• Active Account Data: Retained for the full duration of your account's active life plus a minimum of five (5) years following account closure, to satisfy AML and regulatory record-keeping obligations.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by the operator's licensing jurisdiction.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in line with standard AML record-keeping requirements.
• Support Communications: Retained for a minimum of two (2) years from the date of the last interaction, or longer where the communication relates to an unresolved dispute.
• Marketing Data: Retained until you withdraw consent or for a maximum of three (3) years from the date of last engagement with marketing communications, whichever is earlier.
• Analytics and Technical Data: Aggregated and anonymised data may be retained indefinitely for statistical purposes. Non-anonymised technical logs are retained for a maximum of twelve (12) months.

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our internal data disposal procedures.

9. Cookies & Tracking Technologies

666ep uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device when you visit the Site. They help us deliver a functional, personalised and secure experience. The categories of cookies we use are described below.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling Strictly Necessary cookies will impair or prevent access to core Platform functionality. For non-essential cookies, your preferences will be respected from the point at which you update your settings.

10. Your Data Rights

Subject to applicable law and the specific circumstances of each request, you have the following rights in relation to your Personal Data held by 666ep. To exercise any of these rights, please contact our Data Privacy team as described in Section 15.

11. Data Security

666ep implements a range of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include but are not limited to:

• End-to-end SSL/TLS encryption for all data transmitted between your device and the Platform.
• Hashed and salted storage of passwords — plaintext passwords are never stored.
• Role-based access controls ensuring that Personal Data is accessible only to authorised personnel with a legitimate operational need.
• Regular security audits, vulnerability assessments and penetration testing of Platform infrastructure.
• Segregated storage environments for KYC documents and financial records, with additional access controls beyond those applied to general account data.
• Logging and monitoring of all administrative access to systems that store Personal Data.
• Staff training on data protection obligations and information security best practices.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. If you suspect that your account has been compromised, please contact our support team immediately via the live chat in your account dashboard.

12. Minors and Age Restrictions

The 666ep Platform is strictly restricted to adults aged 18 years or above — or the higher minimum age required by the operator's licensing jurisdiction. We do not knowingly collect Personal Data from individuals below the applicable minimum age. Registration requires active confirmation of age eligibility, and all accounts are subject to age verification as part of the KYC process.

If we become aware or have reasonable grounds to believe that we have collected Personal Data from a minor, we will take immediate steps to suspend the relevant account, delete the associated Personal Data and, where required, report the matter to the appropriate authority. We encourage parents and guardians to monitor minors' internet activity and to make use of parental controls available through internet service providers and device manufacturers.

13. Third-Party Services and Links

The Platform may reference or interact with third-party services — including payment processing infrastructure, KYC verification tools and game content providers. These third parties operate under their own privacy policies and terms of service. 666ep is not responsible for the data practices of third-party providers, though we do require all Data Processors we engage with to maintain data protection standards consistent with this Policy under their data processing agreements with us.

The Platform does not contain links to external third-party websites for general browsing purposes. Where a third-party service is embedded in the Platform for operational purposes (such as a game provider's content), that provider's data practices will be disclosed to you at the point of interaction where practicable.

14. Changes to This Privacy Policy

666ep reserves the right to amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data processing, a new category of third-party sharing, or where your rights are materially affected — we will provide advance notice via the email address registered on your account and/or a prominent notice on the Platform. The updated Policy will display a revised "Last Updated" date at the top of this page.

Your continued use of the Platform following the effective date of any amendment to this Policy constitutes your acknowledgement of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and may close your account in accordance with the process described in our Terms & Conditions.

15. Contact Us — Data Privacy

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how your Personal Data is being handled, please contact our Data Privacy team using the following details:

When contacting us about a data rights request, please include your registered username and a clear description of your request. We may need to verify your identity before processing the request to ensure we disclose or act upon data belonging to the correct individual. This is a security measure in your interest, not a barrier to exercising your rights.