Privacy & Management of Personal Data

Scope and purpose

666in collects, processes and stores personal data in connection with its online gaming services. This Privacy & Data Management Notice explains the categories of personal data we process, the purposes for which we process it, our legal bases, the recipients with whom we share data, cross-border transfers, security measures, retention periods, and the rights available to individuals in relation to their personal data. It applies to all players, customers and website visitors within the scope of our services.

Data controller and data protection officer

666in is the data controller for personal data processed in connection with our services. We have appointed a Data Protection Officer responsible for overseeing compliance and answering inquiries about this notice. You may contact the Privacy Office via our Support team for any questions about this notice or to exercise your data rights.

What personal data we collect

• Identity data: first name, last name, date of birth, gender, and any identifiers used for account management.
• Contact data: residential address, email address, telephone number.
• Financial data: bank details, payment instrument identifiers, transaction records.
• Account and activity data: username, login details, game activity, preferences, communications with support.
• Identification and verification data: photocopies or scans of identity documents and address verification documents.
• Technical data: IP address, device type, browser, operating system, time zone, device identifiers.
• Marketing and communications data: preferences for receiving marketing, communications history.
• Other data provided by you or generated during use of our services, including security information used to detect fraud or abuse.

How we collect personal data

We collect data through direct interactions (eg, account registration, customer support communications), automated technologies (cookies and similar tracking technologies), and from third parties or publicly available sources (eg, payment solutions providers, identity verification providers, analytics services). We may also receive data from regulators or law enforcement where required.

Purposes and legal bases for processing

We process personal data for the following purposes and on the corresponding legal bases:

• To perform or prepare for a contract (eg, to create and manage your account, provide services): Identity, Contact, Financial, Transaction, and related data. Basis: performance of a contract.
• To comply with legal and regulatory obligations (eg, AML/KYC checks, reporting as required): data including Identity, Financial, Transaction, and related data. Basis: compliance with a legal obligation.
• To protect our legitimate interests (eg, ensuring website operation, security, fraud prevention, maintaining service integrity): data including Technical, Usage, and Transaction Data. Basis: legitimate interests.
• For marketing purposes with consent: Identity, Contact, Marketing and Communications Data. Basis: consent; where consent is not obtained, we rely on legitimate interests.
• For research and statistical analysis in anonymized form: Aggregated data where de-identified. Basis: legitimate interests and anonymization.

Cookies and tracking technologies

We use cookies to operate and improve the site and its services. Categories include strictly necessary cookies for core functions, performance cookies, and marketing or analytics cookies. You may set preferences and withdraw consent where applicable. We will not use cookies for purposes beyond what is described here without your consent where required by law.

Marketing communications

You may receive marketing communications from us if you have an account and have not opted out, or if you have given consent. You may withdraw consent or adjust marketing preferences at any time. We do not share personal data for marketing with third parties without your consent, except as required to deliver services or as permitted by law.

Sharing of personal data

We may disclose personal data to:

• Affiliates and service providers who process data on our behalf (IT, customer support, payments, identity verification).
• Regulators, government authorities and law enforcement where required.
• Third-party auditors, consultants and legal advisers.
• In cases of alleged fraud or abuse, to protect our rights and the rights of others.
• Researchers in relation to addiction prevention in anonymized form.
• Any successor entity in the event of a corporate transaction.

International transfers and safeguards

Personal data may be transferred to countries outside the jurisdiction where you reside, including in jurisdictions outside the EEA. We apply appropriate safeguards such as binding corporate rules, standard contractual clauses, or other legally recognized mechanisms to ensure an equivalent level of protection. By providing your data, you consent to such transfers where required.

Data security

We maintain appropriate technical and organizational measures to protect personal data from unauthorised access, alteration, disclosure or destruction. This includes encrypted storage, password protection, access controls, and firewall protection. We require our subsidiaries, agents and processors to implement equivalent security measures and to notify us of any data breach in accordance with applicable law.

Data retention

We retain personal data only as long as reasonably necessary to fulfil the purposes for which it was collected, to comply with legal or regulatory obligations, and for the duration of any applicable statute of limitations. We assess retention based on data sensitivity, purpose, risk of harm, legal requirements, and contractual obligations. When no longer required, data is securely deleted or anonymized.

Your rights

Individuals have the following rights in relation to their personal data. To exercise rights, contact our Privacy Office or Support team. We will respond within one month in ordinary cases; extensions may be applied for in complex or unusually large requests, with notification and justification. Some rights are subject to limitations where processing is necessary for legal claims, public interest, or other permitted exemptions.

• Right of access to a copy of your personal data we hold about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (the right to have data erased) subject to applicable exceptions.
• Right to restriction of processing in certain circumstances.
• Right to data portability in a commonly used and machine-readable format where applicable.
• Right to object to processing based on legitimate interests, or to processing for direct marketing.
• Right to withdraw consent where processing is based on consent.

Children and minors

We do not knowingly collect personal data from individuals under the applicable minimum age. If we become aware of data relating to a minor, we will delete such data or obtain proper consent where required by law.

Changes to this privacy notice

We may update this privacy notice. Material changes will be communicated to you as required by law and/or by notice within the services. We encourage you to review this notice periodically to stay informed about how we protect your personal data.

Contact and complaints

To exercise your rights, obtain information about how we process your data, or to raise concerns, contact our Privacy Office via the Support team. You may also lodge a complaint with the applicable data protection authority if you consider that our processing of your personal data infringes applicable law.