Privacy Policy –
sx666 Casino Pakistan

1. Data Controller

1.1 For the purposes of this Privacy Policy, the data controller responsible for your personal information is the operating entity behind the sx666 platform at sx666.biz. References to "sx666", "we", "us", or "our" throughout this Policy refer to the data controller in its capacity as operator of the Platform.

1.2 The data controller determines the purposes and means by which your personal data is processed. All data processing activities conducted by third-party service providers acting on sx666's behalf are governed by data processing agreements that require those providers to act only on sx666's documented instructions.

1.3 If you have questions about data controllership, data processing arrangements, or wish to identify the specific entity responsible for a particular processing activity, please contact the sx666 support team via the contact details provided in Section 16 of this Policy.

2. Categories of Personal Data We Collect

sx666 collects personal data across several categories, depending on how you interact with the Platform. The data collected, and the reason for its collection, are set out below:

sx666 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data, beyond what is strictly required for identity document verification in the KYC process.

3. How We Collect Your Data

sx666 collects personal data through the following channels:

• Direct provision: Data you enter voluntarily during account registration, the KYC process, deposit or withdrawal requests, support interactions, or promotional participation;
• Automated technical collection: Data collected automatically when you access the Platform, including device identifiers, IP addresses, cookie data, and session information;
• Payment processors: Confirmation data received from JazzCash, EasyPaisa, HBL, UBL, MCB, Meezan Bank, and cryptocurrency networks when processing transactions;
• Identity verification providers: Where sx666 uses third-party KYC technology to verify CNIC documents, limited data may be received from those verification providers to confirm identity;
• Fraud prevention systems: Risk signals and device fingerprinting data generated by fraud detection tools deployed across the Platform.

sx666 does not purchase player data from data brokers or third-party list providers, and does not collect data from social media platforms without your direct authorisation.

4. Purposes of Processing & Legal Basis

sx666 processes your personal data only where a lawful basis for doing so exists. The following table sets out the primary processing purposes and the corresponding legal basis for each:

Where sx666 relies on legitimate interests as the legal basis for processing, we have assessed those interests against your rights and freedoms and concluded that the processing is proportionate and does not override your fundamental privacy interests.

5. Sharing Your Data with Third Parties

5.1 Categories of Recipients. sx666 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate contractual data protection safeguards:

• Payment service providers: JazzCash, EasyPaisa, HBL, UBL, MCB Bank, Meezan Bank, and cryptocurrency network processors — data shared is limited to what is required to process your specific transaction;
• Identity verification providers: Third-party KYC technology providers who assist in verifying CNIC documents — limited to the verification process only;
• Game software providers: Where game providers require technical identifiers to operate their games on our platform — no personally identifying data beyond session tokens is shared;
• Fraud prevention and security vendors: Specialist providers who assist with detecting and preventing fraudulent activity on the Platform;
• Regulatory and licensing bodies: Where required by the applicable licensing framework, data may be disclosed to regulatory oversight bodies;
• Law enforcement: Where legally required by a valid court order, statutory obligation, or law enforcement request under applicable jurisdiction.

5.2 No Commercial Data Sales. sx666 will never sell, lease, or transfer your personal data to commercial third parties for their independent marketing or business development purposes. This prohibition is absolute.

5.3 Business Transfers. In the event of a merger, acquisition, or sale of assets involving sx666, player data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy implications in advance where practicable.

6. Cookies & Tracking Technologies

6.1 Cookie Usage. The sx666 platform uses cookies and similar tracking technologies to operate essential platform functions, maintain your login session, detect fraud, analyse platform performance, and (where consented) deliver personalised content.

6.2 Cookie Categories:

• Essential cookies: Required for the Platform to function. These cannot be disabled as they are integral to session management, security, and basic platform operation;
• Analytics cookies: Used to understand how players navigate the Platform — page load times, game popularity, navigation paths. Data is aggregated and anonymised where possible;
• Functionality cookies: Remember your preferences, language settings, and display options to personalise your sx666 experience;
• Security cookies: Used by fraud detection systems to identify anomalous behaviour patterns that may indicate account compromise or automated activity.

6.3 Cookie Management. You may control non-essential cookies through your browser settings. Disabling essential cookies will impair or prevent access to the Platform. sx666 does not use third-party advertising cookies or participate in cross-site tracking for commercial advertising purposes.

7. Payment Data & Financial Security

7.1 Payment Data Handling. sx666 does not store your full JazzCash PIN, EasyPaisa m-Wallet password, or bank account credentials on its own servers. Payment authentication is handled directly by the respective payment service provider through a secure, tokenised integration.

7.2 Transaction Records. sx666 retains records of all deposit and withdrawal transactions associated with your Account as required by anti-money laundering (AML) regulations and the terms of its licensing framework. These records include transaction amounts, dates, times, and payment method references — but not your payment credentials.

7.3 AML Monitoring. Transaction data is monitored for patterns consistent with money laundering, structuring, or other financial crimes as required by applicable regulatory obligations. Suspicious activity is reported to the relevant authorities in accordance with legal requirements, which may occur without prior notice to you.

7.4 Cryptocurrency Transactions. For USDT TRC20 and ERC20 transactions, wallet addresses used for deposits or withdrawals are recorded as part of the transaction record. Blockchain transactions are inherently public; sx666 is not responsible for the public nature of on-chain data beyond its own systems.

8. KYC & CNIC Document Handling

8.1 Why We Collect CNIC Data. Collection of CNIC information is a mandatory requirement for age verification (confirming 21+ eligibility), identity verification to prevent fraud and duplicate accounts, and compliance with the anti-money laundering obligations applicable to licensed gaming operations. CNIC data collection is not optional and is a prerequisite for real-money play on sx666.

8.2 How CNIC Data is Stored. CNIC images and extracted data are stored in encrypted form in a restricted-access environment separate from general Platform databases. Access is limited to authorised compliance personnel and the third-party identity verification providers bound by data processing agreements.

8.3 CNIC Data is Not Shared Commercially. Your CNIC number, name, and identity document image are never shared with commercial third parties for marketing, profiling, or data aggregation purposes. Disclosure is limited to: identity verification providers, regulatory bodies upon lawful request, and law enforcement under valid legal compulsion.

8.4 Retention of KYC Documents. KYC documents are retained for the duration of your Account plus an additional period as required by applicable anti-money laundering and licensing regulations. Following the expiry of the required retention period, documents are securely and permanently destroyed.

9. Data Retention

9.1 Retention Principle. sx666 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable regulatory, legal, or licensing obligations.

9.2 Retention Schedule:

• Account data (active accounts): Retained for the lifetime of the account plus 5 years following account closure, to meet regulatory obligations;
• KYC / CNIC documents: Retained for account lifetime plus minimum 5 years post-closure, or as mandated by applicable AML regulations;
• Transaction records: Retained for a minimum of 5 years post-transaction as required by anti-money laundering frameworks;
• Support communications: Retained for 2 years from the date of the interaction unless part of an ongoing dispute;
• Marketing data (opted-in): Retained until you withdraw consent, with annual consent refresh requests where commercially practical;
• Analytics and technical data: Retained in aggregated or pseudonymised form for up to 2 years for platform improvement purposes.

9.3 Secure Deletion. Data that has reached the end of its retention period is permanently and securely deleted or anonymised using methods appropriate to the sensitivity of the data involved. Deletion of KYC documents uses cryptographic erasure of encryption keys alongside physical file deletion.

10. Data Security Measures

10.1 Technical Safeguards. sx666 implements the following technical security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure:

• 128-bit SSL/TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and payment references;
• Multi-factor authentication requirements for all administrative access to player data systems;
• Automated intrusion detection and prevention systems monitoring for anomalous access patterns;
• Regular security penetration testing conducted by independent third-party security professionals;
• Strict role-based access controls ensuring staff access only data necessary for their specific function.

10.2 Organisational Measures. In addition to technical safeguards, sx666 maintains organisational security measures including mandatory data protection training for all staff with data access, a documented data breach response procedure with regulatory notification timelines, and contractual data protection obligations in all third-party service agreements.

10.3 Data Breach Response. In the event of a personal data breach that poses a risk to player rights, sx666 will notify affected players and relevant regulatory authorities within the timeframes required by applicable data protection obligations. Notifications will include the nature of the breach, data affected, likely consequences, and remedial measures taken.

11. Your Data Rights

As an sx666 player, you have the following rights with respect to your personal data. These rights can be exercised by contacting our support team as described in Section 16:

To exercise any of the above rights, contact sx666 support via live chat or at the email address listed in Section 16. We may need to verify your identity before fulfilling a data rights request to ensure we are disclosing or modifying the correct player's data.

12. Children, Minors & Under-21 Policy

12.1 sx666 is strictly an adult gaming platform. Access to real-money features is limited to individuals aged 21 years or older. sx666 does not knowingly collect or process personal data from individuals under the age of 21.

12.2 Where sx666 discovers or is informed that personal data has been collected from an individual under the age of 21, that Account will be suspended immediately, the data will be reviewed in accordance with regulatory obligations, and the data will be deleted to the extent permissible by applicable legal retention requirements.

12.3 sx666 strongly recommends that adults who share devices with minors install appropriate parental control software and maintain secure, private access to their sx666 accounts. Device-level parental controls provide an additional layer of protection complementary to the Platform's CNIC-based age verification.

13. Marketing Communications

13.1 Consent-Based Marketing. sx666 sends promotional emails, SMS notifications, and in-platform messages only to players who have consented to receive such communications during the registration process or via Account settings. Marketing communications cover promotional offers, bonuses, new game launches, and platform updates.

13.2 Opting Out. You may withdraw your consent to marketing communications at any time by: using the unsubscribe link in any marketing email, updating your communication preferences in Account settings, or contacting the support team directly. Opt-out requests are processed within 5 business days.

13.3 Self-Excluded Players. Players who have activated a self-exclusion on their Account will not receive any marketing communications for the duration of the self-exclusion period. This is enforced automatically upon self-exclusion activation and does not require a separate marketing opt-out request.

13.4 Service Communications. Certain communications — such as transaction confirmations, security alerts, KYC requests, and responsible gaming notifications — are not marketing communications and will be sent regardless of your marketing preference settings, as they are required for the operation of your Account.

14. International Data Transfers

14.1 The operation of the sx666 platform involves the processing of player data in various jurisdictions, including the jurisdiction in which the Platform's infrastructure is hosted and the jurisdictions of third-party service providers such as payment processors and KYC verification services.

14.2 Where personal data is transferred outside of Pakistan to a third country, sx666 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections described in this Policy. Safeguards used include contractual data protection clauses and, where applicable, adequacy assessments of the receiving jurisdiction's data protection framework.

14.3 JazzCash and EasyPaisa transaction data, as services operating under Pakistani regulatory frameworks, is processed primarily within Pakistan. Where any data processing by these providers occurs outside Pakistan, it is governed by their respective privacy policies and the contractual protections sx666 requires of all payment partners.

15. Updates to This Privacy Policy

15.1 sx666 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable regulatory requirements, or Platform operations. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

15.2 Where changes to this Policy are material — meaning they significantly affect how we use your data or your rights — we will notify registered players via email or in-Account notification before the changes take effect.

15.3 Your continued use of the sx666 Platform following publication of an updated Privacy Policy constitutes your acknowledgement that you have been made aware of the update. We recommend bookmarking and reviewing this page periodically, particularly before making significant account activity such as large deposits or withdrawal requests.

16. Contact Us & Data Complaints

16.1 How to Contact Us. For any privacy-related query, data rights request, or concern about how sx666 handles your personal data, please contact our support team through the following channels:

• Live Chat: Available 24/7 via the Platform — fastest response for account-specific queries
• Email (plain text — not a clickable link): [email protected]
• Subject line for data requests: Please use "DATA RIGHTS REQUEST – [Your Username]" for faster routing to our data protection team

16.2 Response Times. sx666 aims to acknowledge all privacy-related contacts within 2 business days and to provide a substantive response within 30 calendar days. Complex requests involving data portability or multi-system searches may take up to 60 days, in which case we will notify you of the extended timeline.

16.3 Complaints. If you are not satisfied with sx666's response to a privacy concern, you have the right to escalate your complaint to the relevant regulatory or data protection authority applicable under the licensing framework under which the Platform operates. sx666 will cooperate fully with any investigation initiated by such authorities.