gy666 Privacy Policy

1 Introduction

gy666 ("we", "us", "our") operates the online casino and sports betting platform accessible at gy666.io (the "Platform"). This Privacy Policy describes how gy666 collects, uses, stores, shares, and protects personal data relating to individuals ("you", "your") who visit, register with, or otherwise interact with the Platform.

This Policy applies to all users of the gy666 Platform, including registered account holders and unregistered visitors who browse the Platform without creating an account. By accessing the Platform or creating an account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

gy666 is committed to maintaining the highest standards of data protection and privacy. We process personal data only for the purposes set out in this Policy and in a manner consistent with our obligations under applicable data protection law. If you have questions about how your data is handled, please contact our support team at [email protected].

2 Data Controller

gy666 acts as the data controller in respect of personal data collected through the Platform. As data controller, gy666 determines the purposes for which and the means by which personal data is processed. Any requests relating to your personal data — including access requests, correction requests, and deletion requests — should be directed to us using the contact details provided in Section 15 of this Policy.

Where gy666 engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification providers, and analytics platforms), those providers act as data processors under written agreements that require them to process data only on gy666's instructions and in compliance with applicable data protection law.

3 Data We Collect

gy666 collects and processes the following categories of personal data:

gy666 does not collect or process special category data (such as racial or ethnic origin, health data, biometric data, or religious beliefs) unless required by applicable KYC or anti-money laundering regulations, in which case it is collected with your explicit consent and handled with heightened security controls.

4 How We Collect Data

gy666 collects personal data through the following channels:

• Direct interactions: Data you provide when creating an account, completing KYC, making deposits or withdrawals, contacting support, or updating your account settings.
• Automated technologies: Technical and usage data collected automatically via cookies, server logs, and similar tracking technologies when you visit the Platform. See Section 10 for full details on our cookie practices.
• Third-party sources: Identity and age verification data received from our KYC verification partners when they confirm the validity of documents you submit. Payment verification data received from bKash, Nagad, Rocket, Upay, Visa, and Mastercard when you initiate a transaction.
• Fraud prevention partners: Risk signals and device fingerprint data received from our fraud detection service providers to protect the Platform and its users from fraudulent activity.

Where we receive data about you from a third party, we verify that the third party had a lawful basis to share that data with us before we process it.

5 Purpose & Legal Basis

gy666 processes personal data only when it has a lawful basis to do so. The table below sets out the primary purposes for which we process your data and the corresponding legal basis for each:

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test to confirm that our interests do not override your fundamental rights and freedoms. You may request a copy of our legitimate interests assessment by contacting [email protected].

6 Data Sharing

gy666 does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own commercial purposes. We may share your data with the following categories of recipient, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and card payment processors (Visa/Mastercard networks) receive the transaction data required to process your deposits and withdrawals. These providers are bound by their own regulatory obligations and data protection commitments.
• Identity Verification Providers: Our KYC partners receive copies of identity documents you submit during verification. These partners are contractually prohibited from using your data for any purpose beyond the verification service they provide to gy666.
• Fraud Detection and Risk Services: We share technical and behavioural signals with specialist fraud prevention platforms to protect the Platform against money laundering, account takeover, and bonus abuse.
• Game Software Providers: When you play a third-party game (from providers such as Pragmatic Play, Evolution Gaming, Spribe, or Ezugi), your player session data is shared with that provider for the purpose of delivering the game. Game providers do not receive your full identity or financial details.
• Customer Support Tools: Our live chat and ticketing platform receives the content of your support communications to enable our team to assist you effectively.
• Legal and Regulatory Authorities: Where required by applicable law, court order, or instruction from a competent regulatory authority, gy666 may disclose personal data to law enforcement or other government bodies. We will notify you of any such disclosure where we are legally permitted to do so.

7 International Data Transfers

gy666 operates primarily in Bangladesh and processes the majority of player data within the region. However, some of our third-party service providers — particularly global game software suppliers and cloud infrastructure partners — may process data on servers located outside Bangladesh.

Where personal data is transferred to a country that does not provide an equivalent level of data protection as Bangladesh, gy666 ensures that appropriate safeguards are in place. These safeguards typically include:

• Contractual clauses that bind the receiving party to handle data with standards equivalent to those applicable in Bangladesh.
• Transfers only to service providers that maintain ISO 27001 certification or equivalent recognised security standards.
• Regular review of the data protection practices of international partners to ensure continued compliance.

If you would like further information about the international transfers we carry out and the safeguards in place, please contact us at [email protected].

8 Data Retention

gy666 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. The following retention periods apply as a general guide:

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised, aggregated data may be retained for longer periods for statistical and analytical purposes, as it no longer constitutes personal data.

9 Security Measures

gy666 takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Key security controls include:

• Transport Encryption: All data transmitted between your device and gy666.io is encrypted using TLS 1.3 with 256-bit AES ciphers. We enforce HTTPS across the entire Platform and reject insecure connections.
• Encryption at Rest: Sensitive personal data stored on our servers — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to gy666 personnel and authorised third-party processors who require it to perform their specific function. All access is controlled by role-based permissions and logged for audit purposes.
• Two-Factor Authentication: Administrative access to systems that hold personal data requires two-factor authentication (2FA). We encourage players to enable 2FA on their accounts as an additional security measure.
• Penetration Testing: gy666 conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: gy666 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players and relevant authorities within the timeframes required by applicable law.

10 Cookies & Tracking Technologies

gy666 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device by your web browser that allow us to recognise your device across sessions. We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your account security token, and remember your cookie preferences. You cannot opt out of strictly necessary cookies without disabling the use of the Platform entirely.
• Functional Cookies: These cookies remember your preferences — such as your chosen language, display settings, and responsible gaming tool configurations — to improve your experience on return visits. They do not track your activity for advertising purposes.
• Analytics Cookies: With your consent, gy666 uses analytics cookies to collect aggregated, anonymised data about how visitors navigate and use the Platform. This data helps us identify performance issues and prioritise improvements. Analytics cookies do not identify you personally.
• Security Cookies: These cookies support our fraud prevention systems by generating session identifiers and device fingerprints that help us distinguish legitimate users from automated bots or fraudulent actors.

gy666 does not use advertising or retargeting cookies and does not share cookie data with third-party advertising networks. You can manage or delete cookies at any time using your browser's settings. Note that disabling functional cookies may affect your experience of certain features on the Platform.

11 Your Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by gy666:

• Right of Access: You have the right to request a copy of the personal data gy666 holds about you, along with information about how it is used and shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure ("Right to be Forgotten"): You may request that gy666 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where you object to processing and there are no overriding legitimate grounds. Note that this right is subject to our legal data retention obligations — we cannot delete data we are required by law to retain.
• Right to Restriction of Processing: In certain circumstances, you may request that gy666 restrict the processing of your personal data while a dispute or investigation is pending.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data that is based on gy666's legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please submit a written request to [email protected]. We will respond to your request within 30 days. We may need to verify your identity before processing your request to prevent unauthorised access to another person's data. All requests are handled free of charge for the first request in any 12-month period.

12 Minors

The gy666 Platform is strictly intended for adults aged 21 and above. We do not knowingly collect or process personal data relating to anyone under the age of 21. Age verification is a mandatory step in our registration and KYC process, and we take all reasonable steps to prevent underage access to the Platform.

If you believe that a person under the age of 21 has created an account on the Platform or otherwise provided personal data to gy666 without parental consent, please contact us immediately at [email protected]. Upon confirmation, we will promptly close the account and delete all associated personal data, including any account balance, in accordance with applicable law.

Parents and guardians are strongly encouraged to use parental control software and internet filtering tools to prevent underage individuals from accessing online gambling platforms. gy666 supports the use of such tools as part of our broader commitment to responsible gaming.

13 Marketing Communications

gy666 may send you promotional communications — including information about bonuses, new games, seasonal promotions tied to events such as BPL, IPL, Eid, or Pohela Boishakh, and platform updates — where you have opted in to receive such communications during registration or via your account settings.

Opt-Out. You can withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in your gy666 account settings.
• Clicking the "Unsubscribe" link at the bottom of any marketing email we send you.
• Sending a written opt-out request to [email protected] with the subject line "Marketing Opt-Out".

Opt-out requests are processed within 5 business days. Note that opting out of marketing communications does not affect transactional messages, which we are required to send you as part of the account service (for example, deposit confirmations, withdrawal notifications, and KYC status updates).

gy666 does not send unsolicited cold marketing to individuals who have not registered an account or opted in to receive communications from us. We do not purchase marketing lists or engage in third-party data-driven targeting of individuals who have not directly interacted with the Platform.

14 Policy Changes

gy666 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the structure of the Platform. When material changes are made, we will notify registered players by email and/or by displaying a prominent notice on the Platform. The effective date at the top of this page will always reflect the date of the most recent revision.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. If you continue to use the Platform after a revised Privacy Policy has been published, you are deemed to have accepted the updated terms. If you do not accept a material change, you should stop using the Platform and contact [email protected] to close your account.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gy666 handles your personal data, please contact our Data Protection team using the details below. We aim to respond to all privacy-related enquiries within 5 business days.

Email: [email protected]

Support Hours: 24/7 — our team is available around the clock, including Bangladesh Standard Time (BST, UTC+6) business hours, to handle your enquiries.

Postal Address: gy666 Data Protection Team, gy666.io, Dhaka, Bangladesh.

When contacting us about a data rights request, please include your registered email address and a brief description of your request so we can verify your identity and process your enquiry efficiently. We will never ask you to share your account password when handling a data rights request.