cr666 Privacy Policy

Introduction

This Privacy Policy governs the collection, processing, storage, and disclosure of personal data by cr666 in connection with the cr666.io website, any associated mobile interface, and all services made available through those channels (collectively, the "cr666 Platform"). It applies to all visitors, registered players, and any other individuals whose personal data cr666 processes in connection with the operation of the platform.

cr666 takes data privacy seriously. Every measure described in this policy reflects a genuine operational commitment to protecting the personal information of players based in Bangladesh and elsewhere. Where industry-standard security practice allows cr666 to go beyond the minimum required, cr666 does so.

By accessing the cr666 Platform or registering an account, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not accept the terms of this Privacy Policy, you must not use the cr666 Platform.

Data We Collect

cr666 collects personal data through several channels: directly from you when you register an account or contact support; automatically when you browse or use the platform; and from third-party sources such as payment processors and identity verification providers. The categories of personal data cr666 collects are set out in the table below.

cr666 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required for responsible gaming purposes (e.g., a player disclosing a gambling addiction in a self-exclusion request). Where such sensitive data is provided voluntarily, it is processed solely for the purpose for which it was provided and is not used for marketing or profiling.

How We Use Your Data

cr666 uses the personal data described in Section 2 for the following purposes:

• Account Creation and Management: To register your account, verify your identity, manage your login credentials, and maintain accurate account records.
• Age and Identity Verification (KYC): To confirm that you meet the minimum age requirement of 21 years and to verify that the identity provided during registration is genuine. KYC is a mandatory step before any withdrawal is processed.
• Service Delivery: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and USDT; to credit winnings; to apply bonuses; and to deliver all betting, casino, and gaming services available on the platform.
• Customer Support: To respond to support enquiries submitted via live chat, email ([email protected]), or WhatsApp; to resolve disputes; and to follow up on account queries.
• Fraud Prevention and Security: To detect and prevent fraud, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the cr666 Terms & Conditions. This includes automated monitoring of transaction patterns and betting behaviour.
• Responsible Gaming: To enforce self-exclusion periods, apply deposit limits, send session time reminders, and monitor for indicators of problem gambling behaviour in order to fulfil cr666's duty of care obligations.
• Legal and Regulatory Compliance: To comply with applicable anti-money laundering (AML) obligations, record-keeping requirements, and any lawful request from a competent authority.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve the performance, stability, and user experience of the cr666 Platform.
• Marketing Communications: To send you promotional offers, bonus announcements, and event notifications by email or SMS, where you have provided explicit consent to receive such communications. You may withdraw this consent at any time by contacting [email protected].

cr666 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Your data is used exclusively in connection with the operation of the cr666 Platform and the purposes described above.

Legal Basis for Processing

cr666 processes personal data on one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual Necessity: Processing is necessary to perform the contract between cr666 and the registered player — specifically, to provide the betting and gaming services, process payments, and manage the player account.
• Legal Obligation: Processing is necessary for cr666 to comply with applicable legal and regulatory requirements, including AML obligations, KYC mandates, and lawful information requests from competent authorities.
• Legitimate Interests: Processing is necessary for cr666's legitimate interests — including fraud prevention, platform security, responsible gaming enforcement, and analytics for service improvement — provided those interests are not overridden by the data subject's fundamental rights and freedoms.
• Consent: Where cr666 relies on consent as the legal basis for processing (primarily for marketing communications), that consent is obtained explicitly and can be withdrawn by the data subject at any time without detriment to their account standing.

Data Sharing & Disclosure

cr666 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners receive the financial data necessary to process your deposits and withdrawals. These parties process your data under their own privacy policies and are independently responsible for their data handling practices.
• Identity Verification Providers: Third-party KYC and age verification service providers who assist cr666 in verifying the identity documents submitted by players during the KYC process.
• Game Content Providers: Game studios and platform providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi receive the minimum session data necessary to deliver their games and maintain RNG certification records.
• Fraud Detection & Security Partners: Specialist fraud prevention and cybersecurity service providers who help cr666 identify and prevent prohibited activity on the platform.
• Analytics Providers: Aggregated, anonymised usage data may be shared with analytics service providers for platform optimisation purposes. No personally identifiable data is included in such transfers.
• Legal and Regulatory Authorities: cr666 will disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or other binding legal process.
• Professional Advisors: Legal counsel, auditors, and other professional advisors engaged by cr666 may access personal data to the minimum extent necessary for the provision of their professional services, subject to professional confidentiality obligations.

Cookies & Tracking

The cr666 Platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in during a gaming session and security cookies that support fraud detection. These cookies cannot be disabled without breaking platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, game display preferences, and responsible gaming tool configurations. These cookies persist between sessions to ensure a consistent experience.
• Analytics Cookies: Used to collect anonymised data about how players interact with the platform — which pages are visited most frequently, how long sessions last, and which games are most popular. This data is used solely to improve the cr666 Platform.
• Marketing Cookies: Used to track visits from advertising channels and to measure the effectiveness of cr666's promotional campaigns. These cookies do not track your activity across third-party websites and are subject to your consent preferences.

Most modern browsers allow you to view, manage, and delete cookies through the browser settings menu. Disabling strictly necessary cookies may impair core platform functionality including login and session management. cr666 does not use cookies for cross-site tracking, fingerprinting, or the profiling of individuals across unrelated websites.

Data Retention

cr666 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised. Data subject to an ongoing legal dispute, regulatory investigation, or law enforcement request may be retained beyond the standard retention period until that matter is resolved.

Data Security

cr666 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the cr666 Platform is encrypted using 256-bit SSL/TLS. This ensures that login credentials, financial data, and personal information cannot be intercepted in transit.
• Encryption at Rest: Sensitive data stored in cr666's databases — including KYC documents, payment references, and identity data — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within cr666 is restricted on a strict need-to-know basis. Only authorised personnel with a legitimate operational requirement may access player data, and all such access is logged and auditable.
• Two-Factor Authentication: cr666 systems require multi-factor authentication for all internal administrative access. Players are strongly encouraged to enable OTP-based two-step verification on their own accounts.
• Intrusion Detection and Monitoring: cr666's infrastructure is protected by real-time intrusion detection systems, DDoS mitigation, and continuous security monitoring to identify and respond to threats promptly.
• Penetration Testing: cr666's systems undergo regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All cr666 personnel with access to personal data receive mandatory data privacy and security training and are bound by confidentiality obligations.

While cr666 applies all reasonable and industry-standard security measures, no digital platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and interests, cr666 will notify affected individuals promptly via the contact details held on their account.

Your Rights

As a data subject whose personal data cr666 processes, you hold the following rights with respect to that data. cr666 is committed to honouring these rights promptly and without undue difficulty:

• Right of Access: You have the right to request a copy of all personal data cr666 holds about you, along with information about how it is used, where it came from, and with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held on your cr666 account. Some corrections can be made directly via account settings; others require a support request.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to cr666's legal obligations to retain certain data as described in Section 7.
• Right to Restrict Processing: You have the right to request that cr666 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being evaluated, or where you contest the legal basis for processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where cr666 relies on legitimate interests as the legal basis. You also have an unconditional right to object to the use of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where cr666 relies on your consent to process personal data (primarily for marketing), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the rights listed above, contact the cr666 privacy team at [email protected]. cr666 will acknowledge your request within 3 business days and provide a substantive response within 30 calendar days. In cases of particular complexity, cr666 may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it.

Children's Privacy

The cr666 Platform is strictly intended for adults aged 21 years and above. cr666 does not knowingly collect personal data from individuals under the age of 21, and the platform takes active steps to prevent underage access through mandatory KYC age verification at the account withdrawal stage.

If cr666 discovers or is notified that personal data has been collected from an individual who is under 21 years of age, cr666 will:

• Immediately suspend the relevant account pending investigation.
• Delete all personal data associated with that account as promptly as technically feasible, subject to any mandatory legal retention obligations.
• Refund any deposits made to the account and void any associated bets or winnings.
• Take appropriate steps to prevent future access by the same individual.

If you are a parent or guardian and believe that a minor in your care has accessed the cr666 Platform and provided personal data, please contact cr666 immediately at [email protected] with sufficient details to identify the account. cr666 will treat such reports as urgent and respond within 24 hours.

Third-Party Services

The cr666 Platform integrates with a number of third-party services to deliver its full range of features. Each third-party service provider operates under its own privacy policy and is independently responsible for its data processing practices. cr666 selects third-party partners carefully and requires that they maintain data protection standards consistent with cr666's own commitments.

Third-party integrations on the cr666 Platform include, but are not limited to:

• Live Casino and Slots Providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi receive session-level data to deliver their games. No personally identifiable data beyond a pseudonymous player session identifier is transmitted to game providers.
• Mobile Payment Gateways: bKash, Nagad, Rocket, and Upay process payment transactions and receive the financial data necessary to complete those transactions. Their data handling is governed by their respective privacy policies and by applicable Bangladesh Bank regulations.
• Identity Verification Services: Third-party KYC providers receive copies of identity documents submitted by players for age and identity verification. These providers are contractually required to process such data only for KYC purposes and to delete it once verification is complete or the retention period expires.
• Analytics Services: cr666 uses analytics tools that process anonymised, aggregated data about platform usage. No personally identifiable information is shared with analytics providers.

cr666 does not embed third-party social media tracking pixels, advertising networks, or cross-site retargeting scripts on the cr666 Platform. Your activity on cr666.io is not tracked by or shared with social media platforms such as Facebook, Instagram, or YouTube.

International Data Transfers

cr666 operates in the Bangladesh market and stores the majority of player data on servers located in data centres serving the Asia-Pacific region. However, certain service providers — particularly game content providers, KYC services, and analytics tools — may process data on infrastructure located outside Bangladesh.

Where personal data is transferred outside Bangladesh to jurisdictions that do not offer an equivalent level of data protection, cr666 ensures that appropriate safeguards are in place prior to the transfer, including:

• Contractual clauses that require the recipient to process personal data to the same standard as cr666 and as described in this Privacy Policy.
• Data processing agreements with all third-party processors that include binding obligations on data security, retention, deletion, and breach notification.
• Where available, reliance on the recipient jurisdiction's adequacy status or recognised certification schemes for data protection.

You may request further information about the safeguards cr666 applies to international data transfers by contacting [email protected].

Changes to This Policy

cr666 reserves the right to update or modify this Privacy Policy at any time to reflect changes in operational practices, applicable law, or the services offered on the cr666 Platform. When material changes are made to this policy, cr666 will:

• Update the "Last Updated" date at the top of this document and in the hero section of this page.
• Display a prominent in-platform notice to registered players at login for a reasonable period following the change.
• Send a notification to the email address or phone number registered on your account, where technically feasible and where the change materially affects your rights or how your data is processed.

Your continued use of the cr666 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised policy, you must stop using the platform and may request account closure by contacting [email protected].

cr666 recommends that you review this Privacy Policy periodically. The most current version of this document is always available at cr666.io/privacy-policy.

Contact & Data Requests

All privacy-related enquiries, data subject rights requests, and concerns regarding this Privacy Policy should be directed to the cr666 privacy team using the contact details below. cr666 handles all privacy correspondence in English.

• Privacy & Data Queries (email): [email protected] — plain text, not a clickable link.
• General Support (email): [email protected]
• WhatsApp: +880 1700-000666 (Monday to Saturday, 09:00–23:00 BST)
• Live Chat: Available 24/7 via the cr666 Platform website.

When submitting a data subject rights request, please include your registered email address or username, a description of the right you wish to exercise, and any relevant details that will help cr666 identify and process your request efficiently. cr666 may need to verify your identity before acting on a request to ensure that data is not disclosed to or acted upon by an unauthorised party.