xc666 Privacy Policy

This Privacy Policy ("Policy") explains how xc666 ("xc666", "we", "us", "our") — the operator of the online betting and casino platform accessible at xc666.io — collects, uses, stores, and discloses personal information relating to individuals who visit, register on, or otherwise interact with the xc666 Platform ("you", "Player", "User").

xc666 is committed to protecting the privacy and security of every player who entrusts us with their personal data. We treat data protection not merely as a legal obligation but as a fundamental element of the trust that underpins our relationship with the Bangladeshi player community.

This Policy should be read in conjunction with the xc666 Terms and Conditions and our Responsible Gaming Policy. By registering an account on xc666 or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood its contents. If you do not agree with how xc666 handles personal data as described herein, you should not create an account or continue using the Platform.

xc666 collects personal data through several channels: directly from you when you register or interact with the Platform, automatically as you browse and use Platform features, and from trusted third-party service providers involved in delivering our services. The categories of data we collect include:

We do not collect special categories of sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — except where identity document scans are required for mandatory Know Your Customer (KYC) verification under applicable anti-money-laundering obligations.

xc666 uses the personal data we collect for the following clearly defined purposes:

• Account creation and management: To register your xc666 account, verify your identity, maintain your account settings, and provide access to all Platform features including sports betting, casino games, and live dealer tables.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; to reconcile transaction records; and to investigate and resolve payment disputes.
• Regulatory compliance: To fulfil our obligations under applicable anti-money-laundering (AML) and Know Your Customer (KYC) requirements, including identity verification and the monitoring of unusual transaction patterns.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, and other prohibited conduct outlined in the xc666 Terms and Conditions.
• Customer support: To respond to your queries, investigate complaints, and provide assistance through our support channels.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling; to apply responsible gaming tools such as deposit limits, session reminders, and self-exclusion at your request or where required; and to communicate responsible gaming information to players who may be at risk.
• Marketing and promotions: Where you have provided explicit consent, to send you information about xc666 bonuses, promotions, seasonal offers (such as Eid, Pohela Boishakh, or BPL-season promotions), and relevant product updates. You may withdraw consent at any time via your account settings or by contacting support.
• Platform improvement: To analyse aggregate usage patterns, improve the xc666 user interface, optimise game performance, and develop new features that better serve the Bangladeshi player community.
• Legal proceedings: To establish, exercise, or defend legal claims where necessary.

xc666 will not use your personal data for any purpose that is incompatible with the purposes listed above without first seeking your explicit consent or establishing a separate lawful basis for the new processing activity.

xc666 processes your personal data only where a lawful basis exists for doing so. The applicable legal bases for our principal processing activities are as follows:

• Contractual necessity: Processing required to perform the contract between xc666 and you as a registered player — including account creation, deposit/withdrawal processing, and game access — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations — including AML/KYC verification, age verification, and record-keeping requirements — is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics is carried out on the basis of xc666's legitimate interests, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xc666 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following circumstances and only to the minimum extent necessary for the relevant purpose:

• Payment service providers: Your financial data is shared with the relevant payment processor — bKash, Nagad, Rocket, Upay, Visa, or Mastercard — solely to execute a transaction you have authorised. Each provider operates under its own privacy and security policies.
• Identity verification providers: We share identity document data with accredited KYC verification partners to fulfil our age-verification and anti-money-laundering obligations. These partners are contractually prohibited from using your data for any purpose other than the verification service they provide to xc666.
• Game content suppliers: Limited technical identifiers (such as anonymised player session tokens) may be shared with our game suppliers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — solely for the purpose of delivering game content and maintaining game integrity. These suppliers do not receive your full name, contact details, or payment information.
• Fraud prevention and security services: We may share device fingerprints, IP addresses, and behavioural signals with third-party fraud detection platforms to identify and prevent prohibited conduct on the xc666 Platform.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory directive, xc666 may disclose personal data to relevant government authorities or law enforcement agencies. We will, where permitted, notify you of any such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of xc666's business assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer in advance.

The security of your financial data is a top priority at xc666. When you make a deposit or request a withdrawal on the Platform, your transaction is encrypted using 256-bit SSL (Secure Socket Layer) technology. This means that your payment credentials — including your bKash PIN, Nagad PIN, card number, and card CVV — are transmitted directly to the relevant payment processor over a secure, encrypted channel and are never stored on xc666's servers.

xc666 retains only the minimum financial data required for transaction reconciliation and regulatory record-keeping purposes, which includes the payment method type, the last four digits of a card number or the mobile money account number, the transaction amount in BDT, the transaction timestamp, and the transaction reference number. Full card numbers and mobile money PINs are never stored by xc666 at any point.

All Platform infrastructure is hosted in secure data centres with access controls, intrusion detection systems, and regular independent security audits. xc666 maintains an internal incident response procedure to manage any potential data security events promptly and transparently.

xc666 uses cookies and similar tracking technologies — including web beacons, pixel tags, and local storage objects — to operate the Platform effectively, remember your preferences, analyse usage patterns, and deliver a personalised experience. The categories of cookies used by xc666 are:

• Strictly necessary cookies: Essential for the Platform to function. These include session management cookies that keep you logged in during your visit and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without affecting Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, preferred deposit method, and responsible gaming tool configurations. Disabling these cookies may reduce your Platform experience.
• Analytical cookies: Used to collect aggregated, anonymised data about how players navigate the Platform — including which pages are most visited, how long sessions last, and which games are most popular. This data helps xc666 improve the Platform and tailor content to the Bangladeshi player community.
• Marketing cookies: Used, with your consent, to serve relevant promotional content and measure the effectiveness of xc666 marketing campaigns. These cookies do not share your personal data with advertisers without your explicit agreement.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from using core Platform features including xc666 Login and game access.

xc666 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Our standard retention periods are as follows:

On expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where deletion is not immediately possible due to technical constraints, the data is isolated and protected from further processing until deletion can be completed.

As a registered xc666 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at support at xc666.io with the subject line "Data Rights Request" and include your registered username and the specific right you wish to exercise. We will respond within 30 days of receiving a valid request.

• Right of access: You may request a copy of the personal data xc666 holds about you, along with information about how it is used and with whom it is shared.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected. For minor updates (such as a change of mobile number), you can make corrections directly within your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations applicable to xc666.
• Right to restriction: You may request that xc666 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: You may request that personal data you have provided to xc666 be delivered to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your personal data where xc666 relies on legitimate interests as its legal basis, including profiling for responsible gaming purposes, where you have grounds relating to your particular situation.
• Right to withdraw consent: Where processing is based on your consent — such as for marketing communications — you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal date.

The xc666 Platform is strictly restricted to individuals aged 21 and above. xc666 does not knowingly collect personal data from any person under the age of 21. Account registration requires explicit confirmation that the applicant meets the minimum age requirement, and identity verification processes are designed to detect and reject applications from underage individuals.

If xc666 becomes aware that personal data has been collected from a person under the age of 21 without appropriate consent or verification, that data will be deleted promptly and the associated account will be permanently closed. If you believe that a minor has registered an account on the xc666 Platform, please report this to us immediately at support at xc666.io so that we may take appropriate action.

The xc666 Platform integrates with third-party services to deliver a full betting and casino experience. These include game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi; payment processors including bKash, Nagad, Rocket, Upay, Visa, and Mastercard; and identity verification and fraud detection partners.

Each of these third parties operates under its own privacy policy and data protection framework. xc666 selects service providers that demonstrate appropriate data security standards and enters into data processing agreements with each provider to govern how your data is handled. xc666 is not responsible for the privacy practices of third-party services accessed through links or integrations on the Platform that are outside our direct control.

xc666 does not permit third-party game suppliers or payment processors to use your personal data for their own independent marketing purposes without your separate, explicit consent to that provider.

xc666 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, new service features, updated legal obligations, or feedback from our player community. Where changes are material — meaning they affect how your personal data is collected, used, or shared in ways that may be unexpected or significant to you — xc666 will provide advance notice via the email address registered to your account and/or a prominent notice on the Platform no less than 14 days before the changes take effect.

Non-material changes — such as corrections of typographical errors, clarifications of existing practices, or updates to contact information — may be made without advance notice and will be reflected by an updated "Last updated" date at the top of this Policy. We encourage you to review this Privacy Policy periodically to stay informed about how xc666 protects your data.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how xc666 has handled your personal information, please contact our support team using the details below:

When submitting a data rights request, please include your registered xc666 username, the email address associated with your account, and a clear description of the right you wish to exercise or the concern you wish to raise. This will allow us to verify your identity and process your request without unnecessary delay.

xc666 is committed to resolving all data privacy concerns promptly and fairly. If you are not satisfied with the response you receive from our support team, you retain the right to escalate your complaint through any applicable data protection authority or legal channel available to you under applicable law.