b6677 Privacy Policy — How We Collect, Use, and Protect Your Data

1 About This Policy

This Privacy Policy applies to all personal data collected and processed by b6677 in connection with the operation of the online gaming and sports betting platform accessible at https://b6677.io, including all associated web pages, mobile-optimised interfaces, APIs, and customer support channels (collectively, "the Platform").

This document is addressed to all individuals who access, browse, register on, or otherwise interact with the b6677 Platform, including registered Players, prospective Players who visit the Platform without registering, and any individuals who contact b6677 via its support channels (collectively, "you" or "the Player").

b6677 acts as the data controller in respect of the personal data described in this Privacy Policy. As data controller, b6677 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

This Privacy Policy should be read in conjunction with the b6677 Terms & Conditions, which are published at b6677.io/terms-conditions, and the Responsible Gaming Policy, published at b6677.io/responsible-gaming.

2 Personal Data We Collect

b6677 collects personal data from you in three principal ways: data you provide directly when registering and using the Platform; data collected automatically as you interact with the Platform; and data obtained from authorised third-party sources for the purposes of identity verification and fraud prevention.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi), email address, and a username chosen by you.
• Identity verification documents: Government-issued photo identification (e.g., National Identity Card, passport, or driving licence) and proof of address documents, submitted when requested for KYC (Know Your Customer) verification.
• Payment information: Mobile financial service account details (bKash, Nagad, Rocket, Upay), bank account numbers (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank), and card details (Visa, Mastercard) as used for deposits and withdrawals. Card and mobile payment data is processed directly by our regulated payment partners and is not stored in raw form on b6677's servers.
• Support communications: Any information you include in emails, live chat messages, or other communications directed to the b6677 support team at support@b6677.io.
• Responsible gaming data: Any self-reported information you provide when requesting deposit limits, session time alerts, cool-off periods, or self-exclusion through the responsible gaming tools.

2.2 Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and language settings.
• Usage data: Pages visited, games played, bet amounts and frequency, session duration, click-stream data, login timestamps, and navigation paths within the Platform.
• Transaction data: Records of all deposits, withdrawals, wagers placed, game results, bonus claims, and account balance changes.
• Cookie and session data: Session identifiers, authentication tokens, and preference data stored via cookies and local storage. See Section 7 for full details.

2.3 Data from Third-Party Sources

• Identity verification providers: b6677 may receive confirmation data from authorised third-party identity verification services used to validate the accuracy of registration information you provide.
• Fraud and risk screening: b6677 may receive risk-scoring data from third-party fraud prevention services to assist in identifying potentially fraudulent account activity.
• Payment processors: b6677 receives transaction status confirmations (approved, declined, pending) from payment processors. We do not receive raw card numbers or full mobile account credentials from processors.

3 How We Use Your Personal Data

b6677 uses the personal data collected as described in Section 2 for the following specific purposes:

b6677 does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review. Where automated screening tools are used in fraud prevention or responsible gaming, any adverse decision (such as account restriction) is reviewed by a member of the b6677 team before being finalised.

4 Legal Basis for Processing

b6677 processes your personal data only where a lawful basis exists for doing so. The primary legal bases on which b6677 relies are as follows:

• Contractual necessity: Much of the data processing described in Section 3 is necessary to perform the contract between you and b6677 — namely, the account agreement established when you register and the Terms & Conditions you accept at that point. This includes processing your registration data, payment information, and transaction data.
• Legal obligation: Certain processing activities — including KYC identity verification, anti-money-laundering checks, and the maintenance of transaction records — are required by applicable law. b6677 must carry out this processing regardless of your preferences.
• Legitimate interests: b6677 processes technical and usage data on the basis of its legitimate interest in operating a secure, reliable, and commercially sustainable gaming platform. This includes fraud prevention, platform security, and aggregated analytics. In each case, b6677 has assessed that its legitimate interests are not overridden by your data protection rights.
• Consent: Where b6677 sends you optional marketing communications (such as promotional offers or seasonal bonus notifications), this is done on the basis of your consent. You may withdraw consent at any time by contacting support@b6677.io. Withdrawal of consent for optional communications does not affect the lawfulness of processing carried out prior to withdrawal.

5 Sharing Your Personal Data

b6677 does not sell your personal data to any third party. b6677 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard processing partners receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and regulatory obligations.
• Identity verification providers: Authorised third-party KYC service providers receive your registration data and identity document images solely for the purpose of verifying your identity and age (21+). These providers are contractually prohibited from using your data for any other purpose.
• Fraud prevention services: Third-party risk and fraud screening providers receive technical data and transaction data to assist b6677 in identifying and preventing fraudulent account activity and money laundering.
• Game content providers: Where game providers (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi) operate games within the b6677 Platform, limited technical session data may be shared with those providers to enable the delivery of the game. These providers do not receive your full registration or payment details.
• Technology and infrastructure providers: Cloud hosting, content delivery, and platform infrastructure providers may process technical and usage data in the course of providing services to b6677. These providers act as data processors under contract with b6677 and are not permitted to use your data for their own purposes.
• Legal and regulatory authorities: b6677 may disclose personal data to law enforcement agencies, courts, regulators, or other public authorities where required or permitted to do so by applicable law, including in connection with the investigation of fraud, money laundering, or other criminal activity.

6 Data Retention

b6677 retains your personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or legitimate business need. The following general retention periods apply:

Upon expiry of the applicable retention period, b6677 will securely delete or irreversibly anonymise your personal data. Anonymised, aggregated data that cannot be used to identify any individual may be retained indefinitely for platform analytics purposes.

If you request closure of your b6677 account, your account will be deactivated and your personal data will be retained for the periods set out above before being deleted. Your data cannot be erased immediately upon account closure where a legal retention obligation applies.

7 Cookies and Tracking Technologies

b6677 uses cookies and similar local storage technologies to operate core platform functions, maintain session security, and analyse aggregated usage patterns. The following categories of cookies are in use on the b6677 Platform:

• Strictly necessary cookies: These cookies are required for the Platform to function. They include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. Without these cookies, you cannot log in to your account or use the Platform securely. These cookies cannot be disabled.
• Functional cookies: These cookies remember your preferences — such as your selected language (English) and display settings — so that they are applied consistently across your sessions. These cookies are set only upon your first login and are retained for the duration of your account.
• Analytics cookies: b6677 uses privacy-respecting, first-party analytics to understand how Players navigate the Platform, which games and markets are most used, and where technical issues arise. Analytics data is aggregated and anonymised — it does not identify you personally. These cookies are set for a maximum of 12 months.

Most browsers allow you to control cookies through their settings. Blocking strictly necessary cookies will prevent you from logging in to your b6677 account. Blocking functional or analytics cookies will not affect your ability to use the Platform but may result in your preferences not being remembered between sessions.

8 Data Security

b6677 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• TLS/SSL encryption: All data transmitted between your device and b6677's servers is encrypted in transit using TLS 1.2 or higher. The entire b6677 Platform is served exclusively over HTTPS.
• Encryption at rest: Sensitive data stored on b6677's servers — including identity documents and account credentials — is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to personal data within b6677's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Two-factor authentication: b6677 strongly recommends that all Players enable two-factor authentication (2FA) on their accounts. The b6677 internal systems also enforce 2FA for all staff accessing Player data.
• Penetration testing: b6677's infrastructure and application layer undergo regular security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, b6677 will notify affected Players as promptly as practicable, providing details of the nature of the breach, the data affected, and the steps being taken to address it.

While b6677 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You play an important role in protecting your account by using a strong, unique password and enabling 2FA. If you suspect that your account has been accessed without authorisation, contact support@b6677.io immediately.

9 Your Data Rights

As a Player whose personal data is processed by b6677, you hold the following rights in respect of your data. To exercise any of these rights, please contact b6677 at support@b6677.io in English, clearly stating your request and your registered account email address.

• Right of access: You may request a copy of all personal data that b6677 holds about you. b6677 will provide this information in a structured, commonly used, machine-readable format within a reasonable period of receiving your request.
• Right to rectification: If any personal data held by b6677 about you is inaccurate or incomplete, you may request that it be corrected. For account details such as your registered address, you can update these directly via your account settings panel.
• Right to erasure ("right to be forgotten"): You may request that b6677 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn your consent, or where you object to processing on the basis of legitimate interests. Please note that this right is subject to b6677's legal retention obligations — data that must be retained by law cannot be erased upon request.
• Right to restrict processing: In certain circumstances — for example, where you contest the accuracy of data or have objected to processing — you may request that b6677 restrict its processing of your data while the matter is resolved.
• Right to data portability: You may request that b6677 provide your personal data in a portable, machine-readable format (such as CSV or JSON) so that you can transfer it to another service if you choose.
• Right to object: You may object to processing carried out on the basis of legitimate interests. b6677 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent (e.g., optional marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

b6677 will respond to all data rights requests in English within 30 days of receipt. Where a request is complex or involves a large volume of data, b6677 may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it. b6677 does not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive.

10 Children and Minors

The b6677 Platform is strictly restricted to individuals aged 21 and above. b6677 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Registration on the b6677 Platform by a person under 21 constitutes a material breach of the Terms & Conditions.

Where b6677 discovers or has reasonable grounds to suspect that personal data has been collected from a person under 21, b6677 will immediately suspend the associated account, delete the collected data to the extent permitted by law, and void any transactions associated with the account. Any funds deposited by an underage individual will be returned to the source payment method after verification.

11 Third-Party Links and Services

The b6677 Platform may display the names, logos, or branding of third-party game providers, payment processors, and sports data providers in the normal course of delivering the gaming and betting services. While b6677 integrates with these third-party services to operate the Platform, the b6677 Platform itself does not contain outbound links to external websites for browsing or commercial purposes.

Where third-party services are technically integrated into the b6677 Platform — for example, live dealer game streams from Evolution Gaming or Pragmatic Play, or payment processing through bKash and Nagad — those third-party providers operate under their own privacy policies and data protection practices. b6677 is not responsible for the privacy practices of any third-party service provider, and Players are encouraged to review the privacy policies of those providers independently.

b6677 has no control over the data collection or processing practices of third-party game studios and payment processors operating within their own technical environments. However, b6677 requires all such providers to maintain appropriate data security standards as a condition of their integration with the b6677 Platform, and conducts due diligence prior to onboarding any new provider.

12 Changes to This Privacy Policy

b6677 reserves the right to amend, update, or replace this Privacy Policy at any time and at its sole discretion. Any such changes will be published on this page at https://b6677.io/privacy-policy with a revised "Last Updated" date prominently displayed at the top of this document and in the table of contents sidebar.

Where changes to this Privacy Policy are material — for example, where we introduce a new category of data processing, share data with a new category of third party, or change the legal basis on which we process your data — b6677 will provide advance notice to registered Players by email to the address associated with their account, no less than 14 days before the changes take effect.

It is your responsibility to review this Privacy Policy periodically to remain informed of the current terms under which your personal data is processed. Continued use of the b6677 Platform following the publication of any amended Privacy Policy constitutes your acceptance of those changes. If you do not accept the amended Privacy Policy, you must cease using the Platform and may request account closure by contacting support@b6677.io.

13 Contact and Data Requests

For all privacy-related enquiries, data rights requests, concerns about data processing, or reports of suspected data breaches, please contact the b6677 data protection team using the details set out below. All communications should be made in English. The b6677 support team is available 24 hours a day, 7 days a week, 365 days a year, operating on Bangladesh Standard Time (BST, UTC+6).

• Email: support@b6677.io — please include "Privacy Request" in the subject line and your registered account email address in the body of your message
• Live Chat: Available through the b6677 Platform after logging in to your registered account — for urgent security concerns, live chat provides the fastest response
• Response Time: b6677 aims to acknowledge all privacy-related enquiries within 4 hours and to provide a substantive response within 30 days
• Language of Communication: English only
• Identity Verification: To protect your data, b6677 will verify your identity before processing any data rights request. You will be asked to confirm your registered email address and may be asked to provide additional verification details.

b6677 takes all privacy concerns seriously and is committed to resolving data rights requests and complaints in a fair, transparent, and timely manner. If you are not satisfied with the outcome of your request or complaint, you retain the right to escalate the matter through appropriate legal channels available in your jurisdiction.