m666 Privacy Policy

01 Introduction

m666 ("the Company," "we," "our," or "us") operates the online gaming and sports betting platform accessible at https://m666.lol ("the Platform"). We understand that when you use m666 — whether you are placing a cricket bet during a PSL final in Lahore, depositing via JazzCash from Karachi, or reviewing your Black Diamond VIP dashboard — you are entrusting us with personal information. We take that responsibility seriously.

This Privacy Policy explains, in clear and straightforward terms, what personal data m666 collects from users in Pakistan and elsewhere, why we collect it, how we use and store it, who we may share it with, and what rights you have over your own data. It applies to all registered users, visitors to the Website, and anyone who contacts m666 via any channel including our support email.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which form part of your agreement with m666.

02 Data Controller

For the purposes of applicable data protection law, m666 is the data controller in respect of personal data collected and processed through the Platform. As data controller, m666 determines the purposes for which and the manner in which your personal data is processed.

If you have any questions about how m666 handles your personal data, or if you wish to exercise any of your data rights as described in Section 11 of this Policy, please contact our Data Protection team at support@m666.lol. We aim to respond to all data-related enquiries within 30 days of receipt.

03 Data We Collect

m666 collects personal data across several categories depending on how you interact with the Platform. The table below sets out the main categories of data we collect and the specific information within each category:

We do not intentionally collect sensitive personal data (such as health, religious, or political information) unless specifically required for compliance purposes, such as processing a responsible gaming self-exclusion request. Where sensitive data is required, we will seek your explicit consent and handle it with enhanced security controls.

04 How We Collect Your Data

m666 collects your personal data through the following methods:

• Direct provision by you: Information you submit when registering an account, completing KYC verification, making deposits or withdrawal requests, using our responsible gaming tools, or contacting our support team;
• Automated technical collection: Data collected automatically as you browse or use the Platform, including through cookies, session tokens, server logs, and device fingerprinting technology;
• Third-party payment providers: Transaction confirmation data and payment status updates received from JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank when you initiate a payment;
• Identity verification services: Data received from KYC verification partners to confirm the authenticity of identity documents submitted during account verification;
• Fraud detection and analytics tools: Behavioural and technical data processed by our fraud prevention systems to identify unusual account activity patterns.

05 How We Use Your Personal Data

m666 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and managing your m666 account, including authentication, session management, and communication of account-related notifications;
• Service provision: Processing bets, casino game sessions, deposits, withdrawals, and bonus entitlements in accordance with our Terms & Conditions;
• KYC and compliance: Verifying your identity and age (21+), meeting our anti-money laundering (AML) and know your customer (KYC) obligations under our international licensing requirements;
• Payment processing: Facilitating deposits via JazzCash and EasyPaisa and processing PKR withdrawals to your verified bank account or mobile wallet;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, account takeovers, money laundering, and any prohibited conduct as defined in our Terms;
• Responsible gaming: Administering your deposit limits, session time settings, cooling-off periods, and self-exclusion requests; identifying player behaviour patterns that may indicate problem gambling;
• Customer support: Responding to your enquiries, resolving disputes, and maintaining records of correspondence;
• VIP programme management: Tracking your VIP tier progression from Standard through Gold, Platinum, and Black Diamond, and administering associated benefits including personal manager assignments;
• Platform improvement: Analysing aggregated usage data to improve the m666 user experience, product offering, and technical performance;
• Marketing (with consent): Sending promotional communications about m666 offers, new games, cricket betting markets, and PSL promotions where you have provided consent and not subsequently opted out.

06 Legal Basis for Processing

m666 relies on one or more of the following legal bases when processing your personal data, depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing required to fulfil our contractual obligations to you under the Terms & Conditions — including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with applicable laws and our international licensing obligations — including AML/KYC verification, age verification (21+), and self-exclusion enforcement;
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where our legitimate interests are not overridden by your rights and freedoms;
• Consent: Processing of data for direct marketing purposes or optional features, where you have given explicit, informed consent. You may withdraw consent at any time by contacting support or using account settings.

07 Data Sharing & Third Parties

m666 may share your personal data with the following categories of third parties in the circumstances described:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive the minimum data necessary to process your deposit or withdrawal transaction — typically your account reference, transaction amount in PKR, and the payment identifier;
• KYC and identity verification providers: Specialist third-party identity verification services that process your identity documents and confirm their authenticity. These providers operate under strict data processing agreements with m666;
• Game software providers: Certified casino and sportsbook software providers may receive anonymised session and technical data necessary to deliver game content and resolve technical disputes. These providers do not receive your identity or financial data;
• Fraud prevention and security services: Third-party fraud detection platforms that analyse technical and behavioural data to identify account security threats. All such providers are contractually bound to use data only for the specified purpose;
• Regulatory and law enforcement authorities: Where m666 is required by law, court order, or regulatory direction to disclose your data to governmental or law enforcement authorities. m666 will only do so to the extent legally required and will, where lawfully permitted, notify you of such disclosure;
• Professional advisers: Legal, accounting, and compliance advisers engaged by m666 who are subject to professional confidentiality obligations.

Where m666 shares data with third-party processors, we ensure that appropriate contractual safeguards are in place — including data processing agreements that restrict the processor's use of your data to the specified purpose and require adequate security measures to be maintained.

08 Cookies & Tracking Technologies

m666 uses cookies and similar tracking technologies on the Platform to deliver a functional, personalised, and secure gaming experience. Cookies are small data files stored on your device that allow the Platform to recognise your session, remember your preferences, and monitor usage patterns.

The following categories of cookies are used on m666:

• Strictly Necessary Cookies: Essential for Platform operation — including session management, login authentication, and security token handling. These cannot be disabled without rendering the Platform non-functional;
• Functional Cookies: Store your language preferences, game display settings, and responsible gaming configuration so that your settings are remembered between sessions;
• Analytics Cookies: Collect anonymised usage data to help m666 understand how the Platform is used — including which games are most popular, which pages users visit most frequently, and where technical errors occur;
• Security Cookies: Used by our fraud detection systems to identify unusual login patterns, multiple account attempts, or other indicators of security threats.

You may manage non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. By continuing to use m666 after being presented with our cookie notice, you consent to the use of cookies as described in this section.

09 Data Retention

m666 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and compliance requirements. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active Account plus a minimum of five (5) years following Account closure, to meet AML compliance and licensing obligations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in line with standard financial record-keeping requirements;
• Gaming and betting history: Retained for the duration of your Account and for a period of five (5) years post-closure, or longer where required by our licensing authority;
• Customer support communications: Retained for a period of three (3) years from the date of the communication or the resolution of any associated dispute, whichever is later;
• KYC documents: Retained for the period required by our international licensing obligations — typically five (5) years from Account closure or the date of the last transaction;
• Marketing consent records: Retained for the period during which consent is active, plus a reasonable period thereafter to demonstrate that consent was properly obtained.

When personal data is no longer required for any of the above purposes and no legal obligation requires its continued retention, m666 will securely delete or anonymise the data such that it can no longer be attributed to you.

10 Data Security

m666 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and m666's servers is encrypted using bank-grade 256-bit SSL/TLS protocols — including login credentials, financial data, and game session communications;
• Encrypted data storage: Sensitive data at rest — including payment details and identity documents — is stored using industry-standard encryption;
• Access controls: Internal access to personal data is restricted on a need-to-know basis. Employees and contractors who access personal data are subject to confidentiality obligations and regular security training;
• Two-factor authentication: m666 offers 2FA for all player accounts as an additional layer of protection against unauthorised access;
• Security monitoring: Continuous monitoring of Platform systems for unusual access patterns, intrusion attempts, and potential data breach indicators;
• Penetration testing: Regular third-party security assessments to identify and remediate vulnerabilities in our systems before they can be exploited.

You also play a role in keeping your data secure. Use a strong, unique password for your m666 account, enable two-factor authentication, and never share your account credentials with anyone — including m666 support staff, who will never ask for your password.

11 Your Data Rights

Subject to applicable data protection law and our legal obligations as a licensed gaming operator, you have the following rights in relation to your personal data held by m666:

• Right of Access: You have the right to request a copy of the personal data m666 holds about you, along with information about how it is used;
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected — subject to our overriding legal obligations (such as AML record-keeping requirements which require us to retain certain data for a minimum statutory period even after Account closure);
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your data in certain circumstances — for example while the accuracy of data you have contested is being verified;
• Right to Data Portability: You may request that we provide you with a copy of your personal data in a commonly used, machine-readable format, or transmit it directly to another controller where technically feasible;
• Right to Object: You have the right to object to processing of your data based on our legitimate interests, including profiling for responsible gaming monitoring purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent — including marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to support@m666.lol with your registered email address and a clear description of the right you wish to exercise. m666 will respond to all valid requests within 30 days. In complex cases, this period may be extended by a further 60 days, and we will notify you if an extension is required.

12 Children's Privacy — 21+ Only

If m666 discovers or receives credible notification that personal data has been collected from a person under the age of 21, we will immediately suspend the associated Account, delete all personal data attributable to that individual, and take steps to prevent re-registration. If you believe that a person under 21 has created an account on m666, please notify us immediately at support@m666.lol.

Age verification is conducted as part of the KYC process for all accounts. We take our obligations around underage access seriously and invest in verification technology specifically to prevent minors from accessing online gaming services.

13 Third-Party Links

The m666 Platform may contain references to third-party payment service providers — including JazzCash and EasyPaisa — for the purpose of facilitating your deposits and withdrawals. m666 does not operate or control the privacy practices of these third-party services.

When you interact with a third-party payment service in connection with a transaction on m666, that interaction is governed by the privacy policy of the relevant third party. m666 is not responsible for the data practices of third-party services and recommends that you review the applicable privacy policies before providing any personal data to those services.

14 Marketing Communications

Where you have provided consent, m666 may contact you with promotional communications about our services — including new casino games, PSL cricket betting promotions, bonus offers, and VIP programme updates. Marketing communications are sent to your registered email address.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link included in any marketing email from m666;
• Updating your communication preferences in your m666 Account settings;
• Contacting our support team at support@m666.lol requesting removal from marketing lists.

Opting out of marketing communications will not affect the delivery of transactional or account communications — including deposit confirmations, withdrawal notifications, KYC requests, and responsible gaming alerts — which are necessary for the operation of your account and cannot be disabled.

15 Changes to This Privacy Policy

m666 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, or the services we offer. When material changes are made to this Policy, m666 will notify registered users via the email address associated with their account and will update the "Last Updated" date at the top of this page.

Your continued use of the m666 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you disagree with any changes to this Policy, you should cease use of the Platform and may request closure of your account in accordance with our Terms & Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how m666 protects your data. Previous versions of this Policy are available on request by contacting our support team.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way m666 handles your personal data, please contact us using the details below. All data-related enquiries are handled by our dedicated compliance and data protection team.

If you are not satisfied with our response to a data-related enquiry or complaint, you have the right to escalate the matter to the supervisory authority applicable under m666's operating jurisdiction or to seek independent legal advice. m666 will cooperate fully with any investigation conducted by a competent supervisory authority.

When submitting a data rights request or complaint, please include your registered username or email address, a clear description of your request or concern, and — where relevant — any supporting documentation. All communications must be submitted in English.