Privacy Policy — 666ff

1 Introduction & Scope

666ff is committed to protecting the privacy and personal data of everyone who uses our Platform. This Policy applies to all members, visitors, and prospective members of the 666ff Platform, regardless of the device or method used to access it. It covers all personal data collected through the website at https://666ff.bio, the mobile-optimized version of the Platform, and any communications you exchange with the 666ff support team via live chat, WhatsApp, or email.

This Policy should be read in conjunction with the 666ff Terms & Conditions and the Responsible Gaming policy, both of which form part of the overall member agreement. In the event of any conflict between this Policy and the Terms & Conditions on a data-related matter, this Policy shall prevail.

Our primary membership base is located in Indonesia. Where this Policy references applicable law, it acknowledges the Indonesian Electronic Information and Transactions Law (UU ITE) and the Personal Data Protection Law (UU PDP, enacted 2022) as the principal frameworks relevant to our Indonesian members, alongside internationally recognized data protection standards.

2 Definitions

• "Personal Data" means any information that identifies or can reasonably be used to identify a specific individual, including name, email address, phone number, national identity number (NIK), bank account details, device identifiers, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure, transmission, deletion, or destruction.
• "Data Controller" means 666ff, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party engaged by 666ff to process Personal Data on its behalf, under a binding data processing agreement.
• "Member" means any individual who has completed the 666ff registration process and whose account has been accepted by the Company.
• "KYC Data" means identity verification documents and information submitted by a Member as part of the Know Your Customer process, including but not limited to government-issued identity cards, passport copies, and selfie photographs.
• "Cookies" means small text files placed on your device by the Platform or third-party analytics providers to record session information, preferences, and usage patterns.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.

3 Data We Collect

We collect the following categories of Personal Data from members and Platform visitors:

Data Category	Examples	When Collected
Registration Data	Full legal name, email address, date of birth, Indonesian mobile number, username, password (hashed)	At account registration
KYC / Identity Data	KTP (national ID) front & back, passport data page, driver's license (SIM), selfie with document	During identity verification
Financial Data	Bank account name & number (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, others), e-wallet account (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit/withdrawal amounts in IDR	At first deposit and each transaction
Gameplay Data	Bets placed, game sessions, win/loss records, wagering history across Sportsbook, Slots, Live Casino, Mahjong, Live Dragon Tiger	Continuously during platform use
Device & Technical Data	IP address, device type, operating system, browser type and version, screen resolution, session timestamps	Automatically on each visit
Communication Data	Live chat transcripts, WhatsApp message history, email correspondence with support team	When you contact support
Marketing Preferences	Opt-in/opt-out status for promotional emails and SMS, bonus claim history	At registration and updated on request

We do not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is inherent in standard government-issued identity documents submitted for KYC purposes.

4 How We Collect Data

Personal Data is collected through the following channels and mechanisms:

• Directly from you: when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automatically through the Platform: via server logs, cookies, and session tracking technologies that record your device information, IP address, pages visited, and interaction patterns each time you access the Platform.
• From payment providers: transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• From identity verification services: confirmation responses from document authentication partners engaged to assist with KYC verification, where applicable.
• From fraud prevention and AML screening tools: risk signals and watchlist check results used to detect and prevent fraudulent account activity or money laundering.

5 Purposes of Processing

We process your Personal Data for the following specific, legitimate purposes:

1. Account management: creating, maintaining, and operating your 666ff member account, including authentication and password recovery.
2. Transaction processing: facilitating deposits and withdrawals in IDR via Indonesian banking and e-wallet channels, and maintaining accurate financial records.
3. Identity verification (KYC): confirming your age (21+), identity, and payment method ownership in compliance with our AML obligations and responsible gaming commitments.
4. Customer support: responding to your queries, complaints, and dispute requests via live chat, WhatsApp, and email.
5. Fraud prevention and security: detecting unauthorized account access, identifying suspicious betting patterns, and investigating potential violations of our Terms & Conditions.
6. Responsible gaming: monitoring gameplay patterns to identify members who may be exhibiting problem gambling behavior, and applying protective tools such as deposit limits or self-exclusion where appropriate.
7. Platform improvement: analyzing aggregated, anonymized usage data to improve the Platform's performance, content, and user experience.
8. Marketing communications: sending promotional offers, bonus notifications, and platform updates to members who have opted in to receive such communications. You may opt out at any time.
9. Legal and regulatory compliance: fulfilling record-keeping obligations and responding to lawful requests from competent authorities.

6 Legal Basis for Processing

For each purpose described in Section 5, processing rests on one of the following legal bases:

• Contractual necessity: processing required to perform the member agreement with you (account management, transaction processing, customer support).
• Legal obligation: processing required to comply with applicable laws, including AML obligations and KYC verification requirements (identity verification, fraud prevention, legal compliance).
• Legitimate interests: processing necessary for the Company's legitimate interests, where those interests are not overridden by your fundamental rights (fraud detection, platform security, responsible gaming monitoring, anonymized analytics).
• Consent: processing based on your freely given, specific consent, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal (marketing communications, optional cookies beyond strictly necessary ones).

7 Data Sharing & Disclosure

7.1 Service Providers

We share Personal Data with carefully selected third-party service providers who process data strictly on our behalf and under binding data processing agreements. These providers include payment processing partners (Indonesian banks and e-wallet providers), cloud hosting and infrastructure providers, identity verification and KYC solution providers, fraud detection and AML screening vendors, and customer support platform operators. All service providers are contractually prohibited from using your data for any purpose beyond the specific service they are engaged to provide.

7.2 Game Content Providers

Certain game products on the 666ff Platform are supplied by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft (PG Soft). These providers may receive anonymized session identifiers and gameplay data necessary to operate their game engines, but they do not receive your name, contact details, payment information, or KYC documents.

7.3 Legal and Regulatory Disclosures

We may disclose your Personal Data to law enforcement agencies, regulatory authorities, or courts where we are required to do so by applicable law, or where we have a good-faith belief that disclosure is necessary to protect the rights or safety of 666ff, our members, or the general public. We will, where legally permissible, notify you of such a disclosure request before complying.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of the Company's assets, your Personal Data may be transferred to the successor entity as part of that transaction. We will provide advance notice of any such transfer and the applicable privacy terms that will govern your data going forward.

7.5 No Sale of Data

666ff does not sell, rent, or trade your Personal Data to any third party for advertising or marketing purposes. This commitment applies without exception.

8 Data Retention

We retain your Personal Data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and registration data: retained for the duration of your active membership plus 5 years following account closure, to satisfy legal record-keeping requirements.
• KYC documents: retained for a minimum of 5 years from the date of verification, or longer if required by applicable AML regulations.
• Financial transaction records: retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping obligations.
• Customer support communications: retained for 2 years from the date of the interaction, to support dispute resolution and quality improvement.
• Marketing preferences and opt-in records: retained for the duration of your membership plus 3 years following account closure, to evidence the lawfulness of any marketing communications sent.
• Technical and device logs: retained for a maximum of 12 months on a rolling basis, after which they are automatically purged or anonymized.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with you.

9 Security Measures

666ff implements a layered security architecture to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• TLS 1.3 encryption for all data transmitted between your device and the Platform.
• AES-256 encryption at rest for all databases containing Personal Data and KYC documents.
• Password hashing using industry-standard bcrypt or Argon2 algorithms — your password is never stored in plain text.
• Multi-factor authentication (MFA) available for member accounts and mandatory for all internal staff accessing production systems.
• Role-based access controls (RBAC) ensuring that staff can only access the Personal Data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Audit logging of all access to sensitive data, including KYC documents and financial records.
• Incident response procedures to detect, contain, and report data security incidents within defined timelines.

While we take all commercially reasonable steps to protect your data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected members promptly and take immediate steps to mitigate the impact.

10 Cookies & Tracking Technologies

10.1 Types of Cookies Used

The 666ff Platform uses the following categories of cookies and similar tracking technologies:

• Strictly necessary cookies: essential for the Platform to function correctly. These include session authentication tokens, load balancing cookies, and security cookies. These cookies cannot be disabled without breaking Platform functionality.
• Functional cookies: remember your preferences such as language settings, display preferences, and previously visited game categories to improve your experience on return visits.
• Analytics cookies: collect anonymized data about how visitors use the Platform — pages visited, time on page, navigation paths — to help us understand usage patterns and improve the Platform. We use aggregate-level data only; individual-level analytics data is not linked to your account.
• Marketing cookies: used only where you have explicitly consented to receive personalized promotional communications. These cookies help us deliver relevant bonus offers and platform updates. You may opt out at any time.

10.2 Managing Cookies

Strictly necessary cookies are active by default and cannot be disabled. For all other cookie categories, you may adjust your preferences through your browser settings or by contacting support at [email protected]. Note that disabling functional or analytics cookies may affect your experience on the Platform.

11 Your Rights as a Data Subject

As a member of 666ff based in Indonesia, you are entitled to the following rights in relation to your Personal Data, in accordance with the Indonesian Personal Data Protection Law (UU PDP) and internationally recognized data protection principles:

• Right of Access: you may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: you may request that we correct inaccurate or incomplete Personal Data. For minor updates (email address, phone number), you can make changes directly within your account dashboard. For changes to legal name or date of birth, a formal request with supporting documentation is required.
• Right to Erasure: you may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where processing is unlawful. Requests for erasure are subject to our legal retention obligations — data required to be retained by law cannot be deleted until the retention period has expired.
• Right to Restrict Processing: you may request that we restrict (i.e., pause but not delete) processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: where processing is based on consent or contractual necessity, you may request your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: you may object to processing based on legitimate interests (including profiling for responsible gaming monitoring) and to processing for direct marketing purposes. Objections to direct marketing will be honored immediately and unconditionally.
• Right to Withdraw Consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and sufficient information to verify your identity. We will respond within 30 calendar days of receiving a valid request. Complex requests may require up to 60 calendar days, in which case we will notify you of the extension and the reason for it.

12 Children's Privacy

The 666ff Platform is strictly intended for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a member account has been created by a person under 21, we will immediately close the account, void any associated bets and balances, and securely delete the minor's Personal Data in accordance with Section 8 (subject to any applicable legal retention requirements relating to the underage access incident itself). If you have reason to believe that an underage individual has created a 666ff account, please notify us immediately at [email protected].

13 Third-Party Links

The 666ff Platform does not contain outbound links to third-party websites for general browsing purposes. Any links that do appear within the Platform (for example, links to the game studios' official licensing pages or to payment provider information pages) are subject to those third parties' own privacy policies, for which 666ff assumes no responsibility. We encourage you to review the privacy policy of any third-party website you visit independently of the 666ff Platform.

14 International Data Transfers

Some of our service providers — including cloud infrastructure partners and game content studios — operate data centers outside Indonesia. Where your Personal Data is transferred to a country that does not provide an equivalent level of data protection to that offered under Indonesian law, we implement appropriate safeguards, which may include standard contractual clauses, binding corporate rules, or other contractual mechanisms recognized under applicable data protection frameworks. By using the Platform and accepting this Policy, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia for the purposes described herein, subject always to the safeguards described above.

15 Updates to This Policy

666ff reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes, we will notify registered members by email at least 7 calendar days before the updated Policy takes effect. Non-material clarifications or corrections may be updated without advance notice, with the "Last updated" date revised accordingly. Continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy. The current version of this Policy is always available at /privacy-policy.

16 Contact & Data Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or the way 666ff handles your Personal Data, please contact our Data Protection team through the following channels:

• Email: [email protected]  (plain text — not a clickable link; please use subject line "Privacy Inquiry")
• Live Chat: Available 24/7 via the chat widget on the Platform. Average first-response time: under 3 minutes.
• WhatsApp: Available 24/7. Contact details are displayed within the Platform's support section after login.

For questions about your account's responsible gaming settings or self-exclusion options, please visit the dedicated Responsible Gaming page. For full details of your contractual rights and obligations as a 666ff member, please refer to the Terms & Conditions.