Privacy Policy — 666pd

This Privacy Policy ("Policy") is issued by 666pd ("we", "us", "our", "the Operator") and governs the collection, use, storage, disclosure and protection of personal data relating to users ("you", "your", "the User") of the 666pd website at https://666pd.cam ("the Platform"). This Policy forms part of, and should be read together with, our Terms & Conditions.

We understand that your personal information is sensitive. This Policy is written in plain English to help you clearly understand what data we collect, why we collect it, how long we keep it, who we may share it with, and what rights you have over it. We are committed to processing your personal data lawfully, fairly and transparently.

666pd is an English-language online gambling information platform targeting Pakistani users. Our Platform is used by individuals across Pakistan, including in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar. By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — Any information that identifies or could be used to identify a living individual, directly or indirectly. This includes names, email addresses, device identifiers and IP addresses.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. 666pd is the data controller for data processed through this Platform.
• "Data Processor" — A third party that processes personal data on behalf of the data controller under a contractual arrangement.
• "Consent" — A freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Cookies" — Small text files placed on your device by the Platform to store information about your preferences, session activity and browsing behaviour.
• "KYC Data" — Identity and age verification documents collected to fulfil Know Your Customer obligations, including CNIC, passport and supporting documents.
• "Special Category Data" — Sensitive personal data as defined under applicable data protection law, including data related to health, biometrics or criminal records, which requires a higher standard of protection.

We may collect the following categories of personal data through your use of the 666pd Platform:

3.1 Registration & Account Data

• Full legal name and date of birth
• Email address and account password (stored in hashed, encrypted form)
• Country and city of residence (e.g., Karachi, Lahore, Islamabad)
• Preferred language and currency (e.g., PKR)
• Marketing communication preferences

3.2 Identity Verification (KYC) Data

• Government-issued identity document — CNIC or passport
• Proof of address documentation, where required
• Selfie or liveness verification image
• Source of funds documentation, where required under AML obligations

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts and transaction history
• Payment method identifiers (e.g., wallet reference, bank account last four digits) — full payment credentials are handled by the relevant payment processor, not stored by 666pd
• Currency and PKR-equivalent transaction values

3.4 Technical & Usage Data

• IP address, device type, browser type and operating system
• Session timestamps, pages visited and navigation patterns
• Referring URL and search terms used to reach the Platform
• Cookie and tracking technology data (see Section 8)

3.5 Communications Data

• Content of support enquiries, live chat transcripts and email correspondence
• Feedback, complaints and dispute correspondence
• Responses to surveys or user research activities, where voluntarily provided

We process personal data only for clearly defined, legitimate purposes. The table below summarises how we use the data we collect:

We rely on the following legal bases for processing your personal data, as recognised under applicable data protection law:

• Contract Performance: Processing that is necessary to perform our contractual obligations to you, including account management, payment processing and service delivery.
• Legal Obligation: Processing required to comply with applicable legal or regulatory requirements, including AML obligations, KYC identity verification and responsible gambling duties.
• Legitimate Interests: Processing necessary for our legitimate business interests — such as fraud prevention, platform security, service improvement and analytics — provided those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, informed consent, such as sending marketing communications. You may withdraw consent at any time by contacting us or updating your account preferences.

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own unsolicited marketing purposes. We may, however, share your personal data in the following limited circumstances:

• Service Providers & Data Processors: We engage trusted third-party service providers who process data on our behalf under binding data processing agreements. These include payment processing partners, identity verification services, customer support infrastructure providers and IT security vendors. All data processors are contractually required to handle your data securely and only for the purposes we have specified.
• Payment References — Pakistan Context: Familiar Pakistani payment rail names such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah are referenced on this Platform as examples of familiar payment contexts. We do not automatically share your financial data with these institutions unless you specifically initiate a deposit or withdrawal transaction through an available payment method.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory authorities, courts or government bodies where required by applicable law, including compliance with anti-money laundering obligations, or in response to a lawful court order.
• Business Transfers: In the event of a merger, acquisition, business restructuring or sale of assets, personal data held by 666pd may be transferred to the successor entity, subject to equivalent privacy protections. Affected users will be notified of any such transfer in advance where reasonably practicable.
• With Your Consent: We may share your data with third parties in other circumstances where you have provided explicit prior consent for that specific sharing.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements. The specific retention period applicable to your data depends on the category of data and the purpose for which it was processed.

• Active Account Data: Retained for the duration of your account's active status and for a defined period following account closure, as required by applicable law and our record-keeping obligations.
• KYC & Identity Documents: Retained for the period required under applicable AML legislation, which may be up to five years (or longer where required by law) from the date of the relevant transaction or account closure.
• Financial Transaction Records: Retained for the period required under applicable financial regulations, typically five to seven years from the date of the transaction.
• Communications & Support Records: Retained for a reasonable period following the resolution of the relevant enquiry or dispute, or as required by applicable law.
• Technical & Usage Data: Anonymised or aggregated usage data may be retained indefinitely for analytics purposes. Non-anonymised usage logs are retained for a shorter defined period.
• Marketing Consent Records: Retained for the duration of the marketing relationship and for a reasonable period thereafter to demonstrate consent compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

The 666pd Platform uses cookies and similar tracking technologies to enhance user experience, remember your preferences, maintain session security and collect anonymised analytics data. By continuing to use the Platform, you consent to the use of cookies as described in this section.

Subject to applicable data protection law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights in relation to your personal data held by 666pd. To exercise any of these rights, please contact us using the details in Section 14.

666pd implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Our security measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the Platform
• Password hashing and salting — your password is never stored in plain text
• Two-factor authentication (2FA) options for account access
• Regular security assessments and penetration testing
• Access controls restricting staff access to personal data on a need-to-know basis
• Encrypted storage of sensitive data including KYC documents
• Automated fraud and anomaly detection systems

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed as completely secure. You are responsible for keeping your account credentials confidential and notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

The 666pd Platform is strictly intended for adults aged 18 years and above, or the higher minimum age required by the applicable jurisdiction or the Operator's license jurisdiction. We do not knowingly collect, process or retain personal data relating to individuals under the minimum age threshold.

If we become aware that personal data has been submitted by or relating to a person under the minimum age, we will take immediate steps to delete that data and close the associated account. If you believe that we may have inadvertently collected data relating to a minor, please contact us immediately using the details in Section 14.

Parents and guardians are encouraged to make use of parental control software and internet filtering tools to restrict minors' access to gambling-related websites, including this Platform.

The 666pd Platform may reference or interact with third-party services in the course of providing its features. These may include identity verification providers, payment processing infrastructure and analytics platforms. Each third-party provider operates under its own terms of service and privacy policy.

Payment References — Pakistan Context: References to Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah on this Platform are provided as familiar Pakistani payment examples only. These references do not imply any data-sharing relationship with these institutions unless you explicitly initiate a transaction through an available payment method. Any data processing carried out by a payment provider in connection with a transaction you initiate is governed by that provider's own privacy policy, not this one.

We are not responsible for the privacy practices or data handling of third-party services. We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of this Platform.

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, regulatory requirements or the features of the Platform. The "Effective Date" and "Last Reviewed" fields at the top of this page indicate when the current version was last updated.

Material changes to this Policy will be communicated to registered users through an in-platform notification, a homepage notice or an email to your registered address. Where required by applicable law, we will obtain your renewed consent before implementing material changes that affect how we process your personal data.

Continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. Previous versions of this Policy may be made available upon written request to our support team.

If you wish to exercise any of your data rights, raise a privacy concern, make a complaint about how we handle your personal data, or request further information about our data processing activities, please contact our support team using the details below.

All privacy-related correspondence should clearly state your full name, registered email address and the specific right or concern you are raising. We will acknowledge receipt of your request and aim to provide a substantive response within one calendar month.