ac66 Privacy Policy — How We Protect Your Personal Data

ac66 ("we", "us", "our") is the data controller responsible for the personal data of all registered users of the ac66 platform. As data controller, ac66 determines the purposes and means by which your personal data is collected and processed. All requests relating to your personal data — including access requests, correction requests, deletion requests, and complaints — should be directed to our Data Privacy team at [email protected] with the subject line "Data Privacy Request".

ac66 operates the online betting and casino platform available at ac66.io, serving registered players across Bangladesh. This Privacy Policy applies to all data processing activities carried out in connection with the ac66 Platform, regardless of the device or method through which you access it.

ac66 collects personal data that is necessary to provide our betting and casino services, comply with regulatory obligations, and protect the integrity of the Platform. The categories of personal data we collect are set out in the table below:

ac66 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification purposes, health data, or data concerning sexual orientation, except where specifically required by applicable law.

ac66 collects personal data through the following channels:

• Direct interactions: Data you provide when completing the registration form, submitting KYC documents, initiating a deposit or withdrawal, contacting our support team, or completing any other form on the Platform.
• Automated technologies: Data collected automatically when you access the Platform, including cookies, pixel tags, session logs, and similar tracking technologies. See Section 9 (Cookies & Tracking) for full details.
• Payment processors: Transaction confirmation data shared by bKash, Nagad, Rocket, Upay, and card processors to verify deposit and withdrawal status. ac66 receives only the minimum confirmation data required to reconcile your account — we do not receive your mobile wallet PIN or full card number at any point.
• Identity verification services: Where ac66 uses a third-party identity verification provider to validate documents submitted during KYC, that provider may share a verification result and associated metadata with ac66.
• Fraud and risk intelligence: ac66 may receive risk signals from fraud detection services, including device fingerprinting data and IP reputation scores, to protect the Platform against fraudulent activity and money laundering.
• Publicly available sources: In limited circumstances connected with enhanced due diligence, ac66 may consult publicly available information (for example, politically exposed persons databases or sanctions screening lists) to fulfil its compliance obligations.

ac66 processes your personal data for the following clearly defined purposes:

• Account creation and management: To register your ac66 account, authenticate your identity at login, and maintain your account in good standing throughout the relationship.
• Service delivery: To provide access to sportsbook betting, live casino, slots, card games, and all other Platform features to which you are entitled as a registered player.
• Payment processing: To process deposits, verify withdrawal requests, reconcile account balances, and investigate payment disputes in connection with bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank transfer transactions.
• Identity verification and KYC compliance: To verify that you meet the eligibility requirements set out in our Terms & Conditions, including age verification (21+), identity confirmation, and source-of-funds checks where required.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, multi-accounting, and any other prohibited conduct on the Platform.
• Responsible gaming compliance: To monitor gambling patterns for indicators of problem gambling behaviour, enforce deposit limits and self-exclusion instructions, and fulfil our responsible gaming obligations.
• Customer support: To respond to your enquiries, resolve disputes, manage complaints, and maintain a record of support interactions for quality assurance purposes.
• Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from competent authorities, and maintain the records required by applicable financial crime and data protection regulations.
• Platform improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall performance and user experience of the ac66 Platform.
• Marketing communications: To send you promotional offers, bonus notifications, and seasonal campaign information where you have consented to receive such communications. You may opt out at any time by contacting [email protected].

ac66 does not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you without providing an opportunity for human review. Automated risk-scoring tools used in fraud detection are subject to regular human oversight by the ac66 compliance team.

ac66 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and ac66 — including account management, service delivery, and payment processing — is carried out on the basis of contractual necessity. Without this processing, ac66 cannot provide its services to you.
• Legal obligation: Processing carried out to comply with legal requirements — including KYC/AML obligations, regulatory reporting, and responses to lawful law-enforcement requests — is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, Platform security, responsible gaming monitoring, and service improvement is based on ac66's legitimate interest in protecting the integrity of the Platform and the safety of its players. ac66 has assessed that these legitimate interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications is carried out on the basis of your freely given, specific, informed consent at the time of registration or at a subsequent opt-in point. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

ac66 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data is shared only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and card processing networks receive the minimum transaction data required to process your deposits and withdrawals. These providers are contractually bound to process your data only for payment purposes and are prohibited from using it for any other purpose.
• Identity verification providers: Where a third-party KYC provider is used to validate identity documents, that provider receives copies of your submitted documents and returns a verification result. The provider does not retain your documents beyond the verification process.
• Fraud and risk intelligence services: Aggregated device and IP risk signals may be shared with fraud prevention partners to identify patterns of fraudulent activity. These partners receive technical data only — not your name, financial account details, or contact data.
• Game content providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Ezugi, and Spribe receive a unique anonymised player session token to initialise game sessions. They do not receive your identity data, contact data, or payment data.
• IT infrastructure and cloud service providers: ac66 uses secure cloud infrastructure to host the Platform and store data. Infrastructure providers are bound by data processing agreements that restrict them to acting solely on ac66's instructions.
• Legal and regulatory authorities: ac66 will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by a valid legal obligation, court order, or binding regulatory request. ac66 will notify you of such disclosure where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of ac66's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the identity of the new data controller.

ac66 retains your personal data for only as long as is necessary to fulfil the purposes for which it was collected, including the satisfaction of legal, regulatory, tax, and accounting obligations. The specific retention periods applied by ac66 are as follows:

Upon expiry of the applicable retention period, ac66 will securely delete or anonymise your personal data in accordance with industry-standard secure deletion practices. Anonymised data (from which all personal identifiers have been permanently removed) may be retained indefinitely for statistical and analytical purposes.

ac66 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• Transport encryption: All data transmitted between your device and the ac66 Platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates. Unencrypted HTTP connections are automatically redirected to HTTPS.
• Data at rest encryption: Personal data stored in ac66's databases is encrypted at rest using AES-256 encryption. Database access is restricted to authorised systems and personnel only.
• Access controls: Access to personal data within ac66's internal systems is governed by role-based access controls (RBAC). Staff members are granted access only to the data they require to perform their specific job functions. All internal data access is logged and regularly audited.
• Two-factor authentication: ac66 supports two-factor authentication (2FA) for player accounts and enforces mandatory 2FA for all internal staff accessing systems that contain personal data.
• Vulnerability management: ac66 conducts regular security assessments and penetration tests of the Platform's infrastructure. Identified vulnerabilities are triaged, prioritised, and remediated in accordance with ac66's security patch management policy.
• Incident response: ac66 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ac66 will notify affected individuals without undue delay and no later than 72 hours after becoming aware of the breach, where feasible.
• Staff training: All ac66 employees with access to personal data complete mandatory data protection training at onboarding and annually thereafter. Staff are trained to recognise and report suspected data breaches and social engineering attempts.

ac66 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and improve your experience. The categories of cookies used on ac66 are as follows:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They manage session authentication, load balancing, and security token validation. These cookies cannot be disabled as they are required for the Platform to operate. No personal data is used for marketing purposes through these cookies.
• Functional cookies: These cookies remember your preferences, such as your selected language, display settings, and last-visited game category, to provide a more personalised experience on return visits. Disabling these cookies may affect the functionality of certain Platform features.
• Analytics cookies: ac66 uses analytics tools to collect aggregated, anonymised data about how players navigate the Platform — including which pages are most visited, where players spend the most time, and how users move through the registration and deposit flows. This data is used exclusively to improve the Platform's usability.
• Fraud prevention cookies: These cookies assign a persistent device identifier to your browser session to assist in detecting multi-accounting, bot activity, and other forms of fraudulent behaviour. The data collected is used solely for security and compliance purposes.

Most web browsers accept cookies by default. You can configure your browser to reject all cookies or to alert you when cookies are being set. However, please note that disabling strictly necessary cookies will prevent you from logging in to the ac66 Platform. Instructions for managing cookies are available in the settings menu of all major browsers including Chrome, Firefox, Safari, and Edge.

ac66 does not use third-party advertising cookies or social media tracking pixels that share your browsing behaviour with external advertising networks.

As a registered player on ac66, you hold the following data protection rights in respect of the personal data we hold about you. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Right Type]".

ac66 will not charge a fee for exercising your data protection rights in standard circumstances. Where requests are manifestly unfounded, repetitive, or excessive, ac66 reserves the right to charge a reasonable administrative fee or decline to act on the request, with written notice provided.

The ac66 Platform is strictly for adults aged 21 and above. ac66 does not knowingly collect, store, or process personal data relating to persons under the age of 21. If ac66 discovers that an account has been registered by or on behalf of a person under 21, that account will be immediately closed, any balance will be handled in accordance with our Terms & Conditions, and all associated personal data will be securely deleted.

If you are a parent or guardian and you believe that a minor has registered an ac66 account, please contact us immediately at [email protected] with the subject line "Underage Account — Urgent". ac66 will investigate and act on all such reports within 24 hours.

ac66 primarily stores and processes personal data on servers located within secure data centres serving the Asia-Pacific region. In limited circumstances, personal data may be transferred to and processed in countries outside Bangladesh — for example, where ac66 uses cloud infrastructure providers or fraud detection services that operate internationally.

Where personal data is transferred outside Bangladesh, ac66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection principles. These safeguards may include contractual clauses that obligate the recipient to process your data only in accordance with ac66's instructions and to apply security measures consistent with those described in Section 8 of this Policy.

ac66 does not transfer your personal data to countries or territories that are known to present a high risk to data subjects' rights and freedoms without first implementing enhanced contractual protections and conducting a documented transfer impact assessment.

ac66 may update this Privacy Policy from time to time to reflect changes in applicable law, our data processing practices, or the features and services available on the Platform. All updates will be published on this page with a revised "Last Updated" date at the top of the document.

Where a proposed change is material — meaning it significantly alters the way ac66 processes your personal data or affects your data protection rights — ac66 will provide at least 14 days' advance notice by sending an email notification to the address registered on your account before the change takes effect. Your continued use of the ac66 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically so that you remain informed about how ac66 is protecting your data. The version number and effective date at the top of this page will always indicate whether you are viewing the current version.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ac66 processes your personal data, please contact our Data Privacy team using the details below. All privacy-related communications must be submitted in writing to ensure they are properly logged and tracked within our compliance management system.

When submitting a data rights request, please include your registered email address, your ac66 username, and a description of your request so that our team can verify your identity and process your request efficiently. ac66 may ask you to provide additional verification information before fulfilling a data access or deletion request to ensure that data is not disclosed to or deleted at the request of an unauthorised third party.