66rr Privacy Policy

This Privacy Policy describes how 66rr (hereinafter "66rr", "we", "us", or "our") collects, processes, stores, uses, and discloses personal data about individuals (hereinafter "you", "user", or "player") who access or use the 66rr online betting and gaming platform, including the website at 66rr.io, all associated subdomains, and any mobile browser interfaces (collectively, the "Platform").

At 66rr, we recognise that privacy is a fundamental aspect of trust between a platform and its users. Our commitment is to handle your personal data with care, transparency, and respect — collecting only what is necessary, using it only for defined purposes, and protecting it with industry-standard security measures appropriate for an online betting environment serving players across Bangladesh.

By accessing the Platform, creating an account, placing a wager, or using any feature of the 66rr service, you acknowledge that you have read this Privacy Policy and that you consent to the data practices described herein to the extent that consent is the applicable lawful basis. Where processing is based on a different lawful basis — such as contractual necessity or legal obligation — consent is not required and this policy serves as our transparency notice to you.

This policy is written in English. If you have any difficulty understanding any part of it, please contact our support team via live chat and we will assist you.

For the purposes of this Privacy Policy, 66rr acts as the data controller in respect of all personal data collected from users of the Platform. As data controller, 66rr determines the purposes for which and the means by which personal data is processed.

Where 66rr engages third-party service providers to process personal data on its behalf — for example, payment gateway operators, identity verification providers, or IT infrastructure suppliers — those parties act as data processors and are contractually required to process personal data only on 66rr's documented instructions, to maintain appropriate security standards, and not to engage sub-processors without 66rr's prior written authorisation.

Contact details for data-related enquiries are provided in Section 13 of this policy.

66rr collects personal data through the following channels and in the following categories:

Data you provide directly:

• Registration data: full name, date of birth, gender, email address, mobile number, and residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar).
• Identity verification documents: national ID card, passport, driver's licence, or other government-issued photo identification as requested during the KYC process.
• Address verification documents: utility bills, bank statements, or other official correspondence showing your name and address, dated within three months.
• Payment details: bKash wallet number, Nagad wallet number, Rocket wallet number, Upay account details, bank account number and sort code (for BRAC Bank, Dutch-Bangla Bank, City Bank, Islami Bank, Sonali Bank, and other supported institutions), or cryptocurrency wallet address (USDT TRC-20/ERC-20, Bitcoin).
• Support communications: any information you share with the 66rr support team via live chat, email, or WhatsApp correspondence.
• Responsible gaming self-assessments: information you provide when setting deposit limits, time-out periods, or requesting self-exclusion.

Data collected automatically:

• Technical data: IP address, device type, operating system, browser type and version, screen resolution, and device fingerprint.
• Session data: login timestamps, session duration, pages visited, features used, and actions taken within the Platform.
• Betting and gaming data: all wagers placed, markets selected, game sessions initiated, outcomes, bet amounts, and bonus redemptions.
• Location data: approximate geographic location inferred from your IP address. 66rr does not collect precise GPS-level location data.
• Cookie and tracking data: as described in Section 6 of this policy.

Data received from third parties:

• Identity verification results from KYC/AML screening providers confirming whether your identity documents pass verification checks.
• Fraud risk scores from payment fraud detection services used to assess the risk profile of individual transactions.
• Age verification confirmations from third-party age verification services where used to supplement 66rr's internal verification process.

66rr uses the personal data it collects for the following defined purposes:

• Account creation and management: To register your account, authenticate your identity at login, manage your account settings, and communicate important account-related information to you.
• Age and identity verification: To confirm that you meet the 66rr minimum age requirement of 21 years and that you are who you say you are, in compliance with our player protection obligations.
• Payment processing: To process deposits via bKash, Nagad, Rocket, Upay, Visa, Mastercard, USDT, and Bitcoin, and to process withdrawals back to your registered payment method.
• Anti-money-laundering and fraud prevention: To screen transactions and account activity against risk indicators, to investigate unusual activity, and to comply with applicable financial crime prevention obligations.
• Responsible gaming monitoring: To monitor your betting and gaming activity for indicators of problem gambling, to apply self-imposed limits or exclusions you have requested, and to contact you where our monitoring identifies potential harm.
• Platform security: To detect and prevent unauthorised access, account takeover attempts, and other security threats to your account and to the Platform.
• Dispute resolution: To investigate and resolve disputes regarding bets, transactions, bonuses, and account status.
• Service improvement: To analyse aggregate usage patterns across the Platform to improve the quality, performance, and features of the service.
• Marketing communications (where consented): To send you promotional communications about 66rr offers, bonuses, BPL cricket betting promotions, Eid special offers, Pohela Boishakh promotions, and other seasonal campaigns, where you have opted in to receive such communications.
• Legal and regulatory compliance: To meet our obligations under applicable laws, including responding to lawful requests from regulatory authorities, law enforcement, and courts.

66rr does not sell, rent, or trade your personal data to third parties for their own independent commercial purposes. We share your personal data only in the following circumstances and only to the extent necessary for the relevant purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and cryptocurrency network infrastructure providers, for the purpose of processing your deposit and withdrawal transactions.
• Identity and age verification providers: Third-party KYC/AML services contracted to verify your identity documents and screen your details against sanctions and politically exposed persons (PEP) lists.
• IT and infrastructure providers: Cloud hosting, content delivery, and database management providers who process data on our behalf under strict data processing agreements.
• Fraud prevention services: Specialist fraud detection platforms that analyse transaction patterns to identify and prevent financial crime on the Platform.
• Game content providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session and bet data necessary to operate their games within the Platform. These providers are bound by their own applicable data protection obligations.
• Legal and regulatory authorities: Where 66rr is required to disclose personal data by applicable law, court order, or lawful regulatory request, we will comply with such obligations. Where legally permitted, we will notify affected users of such disclosures.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of 66rr's assets, personal data held by 66rr may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party processors engaged by 66rr are required to maintain appropriate technical and organisational security measures consistent with industry standards for handling personal data in the online gaming and financial services sectors.

66rr uses cookies and similar tracking technologies (including local storage, session tokens, and device fingerprinting) on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming limit configurations so you do not need to re-enter them on each visit.
• Analytics cookies: Collect anonymised aggregate data about how users navigate the Platform — which pages are visited most, where users drop off in registration flows, and which game categories are most popular. This data is used solely to improve the Platform and is not linked to individual user identities where avoidable.
• Security cookies: Used to detect and flag unusual access patterns that may indicate account compromise, bot activity, or fraudulent behaviour.

66rr does not use third-party advertising cookies or tracking pixels from external ad networks. The Platform does not serve targeted advertising based on your browsing behaviour on other websites.

You may control cookie preferences via your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your account and using core Platform features.

66rr implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls in place include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your browser and the 66rr Platform.
• One-way cryptographic hashing of all account passwords using industry-standard algorithms. Passwords are never stored or transmitted in plain text.
• OTP (one-time password) device verification applied whenever a login is detected from a new or unrecognised device.
• Role-based access controls ensuring that 66rr staff can access only the data necessary for their specific job function.
• Regular security assessments of Platform infrastructure to identify and remediate vulnerabilities.
• Automated anomaly detection systems that monitor session activity for indicators of account takeover, credential stuffing, and other common attack vectors.

While 66rr takes all reasonable steps to protect your data, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, 66rr will notify affected users without undue delay and will take all appropriate remediation steps.

You play an important role in the security of your own data. You are responsible for maintaining the confidentiality of your 66rr login credentials and for using a strong, unique password that you do not reuse on other platforms. If you believe your account has been compromised, contact 66rr support immediately via live chat.

66rr retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any applicable legal, regulatory, or contractual obligations that require longer retention periods. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following permanent account closure, in line with standard financial services record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of each transaction, in compliance with anti-money-laundering record-keeping obligations.
• Betting and gaming history: Retained for five (5) years post-account closure for dispute resolution and responsible gaming review purposes.
• Technical and session data: Retained on a rolling twelve (12) month basis, after which it is deleted or anonymised.
• Support communications: Retained for three (3) years from the date of the last interaction for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of the consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Where anonymisation is applied, the resulting anonymised data sets may be retained indefinitely for aggregate statistical analysis.

As a 66rr user, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact the 66rr support team via live chat or at [email protected] (plain text — not a clickable link). We will aim to respond to all valid requests within 30 days.

• Right of access: You have the right to request a copy of the personal data 66rr holds about you, together with information about how it is processed. We will provide this in a structured, commonly used format.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update basic account details directly via your account settings page.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. Note that this right is subject to overriding legal and regulatory obligations that require 66rr to retain certain data for defined periods.
• Right to restriction: You have the right to request that 66rr restricts the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another service provider.
• Right to object: You have the right to object to processing of your personal data where that processing is based on 66rr's legitimate interests. You also have an absolute right to object to processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

66rr will not charge a fee for responding to data rights requests in normal circumstances. If a request is manifestly unfounded, excessive, or repetitive, 66rr reserves the right to charge a reasonable administrative fee or to decline to respond, and will explain its reasons for doing so.

66rr operates a strict minimum age policy of 21 years for all registered players. As part of the account registration and KYC verification process, 66rr requires all users to confirm that they are aged 21 or above and to provide government-issued identity documents that evidence their date of birth. Users who cannot satisfy the age verification requirement will not be permitted to access the Platform.

If 66rr becomes aware — through its own monitoring, through a report from a third party, or through information provided during a support interaction — that personal data has been collected from an individual who is under the age of 21, 66rr will take immediate steps to:

• Suspend the relevant account pending investigation.
• Delete or permanently anonymise all personal data associated with that account as soon as legally permissible.
• Refund any deposits made to that account in accordance with applicable obligations.
• Notify relevant parties as required by applicable law.

Parents and guardians who believe that a minor in their household has created a 66rr account are encouraged to contact the 66rr support team immediately via live chat or by emailing [email protected] (plain text — not a clickable link). We treat all such reports as a high priority and will respond within 24 hours.

66rr's primary user base is located in Bangladesh. However, due to the global nature of cloud computing and the use of internationally-based service providers, personal data collected by 66rr may be transferred to, stored in, or processed in countries outside of Bangladesh. These countries may have data protection laws that differ from those applicable in Bangladesh.

Where such international transfers occur, 66rr takes steps to ensure that appropriate safeguards are in place to protect your personal data. These safeguards may include:

• Contractual clauses in data processing agreements with third-party processors that impose equivalent data protection obligations to those described in this Privacy Policy.
• Use of service providers that maintain internationally recognised security certifications such as ISO 27001.
• Restricting data transfers to jurisdictions that offer an adequate level of data protection as determined by reference to recognised international frameworks.

By using the 66rr Platform, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this section. If you have questions about international data transfers or wish to obtain more information about the specific safeguards in place, please contact the 66rr support team.

66rr reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory requirements, or improvements to the Platform and our services. We will always post the most current version of this Privacy Policy on the Platform at 66rr.io/privacy-policy.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way we process your personal data — 66rr will provide advance notice through one or more of the following channels:

• A prominent notice displayed on the Platform's homepage or login page for a period of at least 14 days prior to the changes taking effect.
• A notification sent to the email address associated with your 66rr account.
• An in-Platform notification visible when you next log in to your account.

Your continued use of the 66rr Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with the changes, you should cease using the Platform and may request closure of your account by contacting the support team. Non-material changes — such as typographical corrections, clarifications that do not alter the substance of the policy, or updates to contact details — may be made without prior notice, though the effective date at the top of the policy will always reflect the most recent revision.

We recommend that you review this Privacy Policy periodically to stay informed about how 66rr is protecting and using your personal data. The date at the top of this document indicates when the policy was last substantively revised.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 66rr processes your personal data, please contact our support team using the details below. All privacy-related communications are handled with strict confidentiality.

66rr aims to acknowledge all privacy-related written enquiries within 24 hours and to provide a substantive response within 30 days. For complex requests — such as subject access requests involving large volumes of data — we may extend this period by a further 60 days where necessary, and we will inform you of any such extension and the reasons for it within the initial 30-day period.

If you are not satisfied with our response to a privacy-related complaint, you have the right to escalate your concern to the appropriate data protection authority in your jurisdiction. 66rr will cooperate fully with any such authority in the investigation of complaints relating to our data processing practices.