gf66 Privacy Policy — Your Data, Protected

1 Introduction

This Privacy Policy ("Policy") describes how gf66 ("gf66", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player") who access or use the gf66 website at https://gf66.io, including all games, sports betting services, account management features, payment services, and any other features offered through the platform.

gf66 is committed to handling your personal data with transparency, integrity, and the highest standards of security. This Policy is designed to give you a clear and complete understanding of how your data is managed so that you can make informed decisions about using the gf66 platform.

By registering an account with gf66, making a deposit, placing a wager, or otherwise using the platform's services, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. This Policy forms part of gf66's broader Terms and Conditions, which govern your use of the platform.

2 Data We Collect

gf66 collects personal data in the categories described below. We collect only what is necessary and proportionate to the purposes for which it is processed. The specific data collected will depend on the services you use and your interactions with the platform.

2.1 Account Registration Data

• Full name as it appears on your government-issued identity document.
• Date of birth (used to verify you are aged 21 or above as required by our Terms and Conditions).
• Email address (used for account communications, security alerts, and support).
• Mobile phone number (used for account verification and payment method linking).
• Residential address in Bangladesh (district, city, and postal area).
• Username and encrypted password (password is hashed and is never stored or visible in plain text).

2.2 Identity Verification (KYC) Data

• Copies of government-issued identity documents, such as a National Identity Card (NID), passport, or driving licence.
• Proof of address documents where required for higher-value withdrawal processing.
• Selfie or liveness verification images where required for identity confirmation.

2.3 Financial & Transaction Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers associated with your deposits and withdrawals.
• USDT TRC-20 wallet addresses used for cryptocurrency transactions.
• Transaction history including deposit amounts, withdrawal amounts, dates, times, and method used.
• Account balance and bonus balance history for operational and compliance purposes.

2.4 Gaming & Betting Activity Data

• Bet and wager history across all casino games, live dealer tables, and sports betting markets.
• Game session data including session start and end times, games played, and results.
• Responsible gaming tool usage, including deposit limits set, cooling-off periods activated, and self-exclusion requests.

2.5 Technical & Device Data

• IP address at the time of each login session (used for fraud detection and geographic access verification).
• Device type, operating system, and browser information collected via standard server logs.
• Session cookies and local storage data used to maintain your login state and platform preferences.

2.6 Communications Data

• Content of emails, live chat messages, and other communications you send to the gf66 support team.
• Support ticket history and resolution records maintained for quality assurance and dispute resolution purposes.

3 How We Collect Your Data

gf66 collects personal data through several channels, all of which are described transparently below:

• Directly from you — when you complete the registration form, submit KYC documents, contact support, or update your account settings.
• Automatically via platform use — session data, IP addresses, device information, and game activity are collected automatically as you use the gf66 platform.
• From payment providers — bKash, Nagad, Rocket, Upay, and USDT TRC-20 network confirmations provide transaction reference data to gf66 when you make a deposit or withdrawal.
• From identity verification providers — where third-party KYC tools are used to verify your identity documents, those providers return a verification result and relevant data to gf66.
• From fraud detection systems — automated risk scoring systems may process technical and behavioural signals to flag unusual account activity for manual review.

4 How We Use Your Data

gf66 uses the personal data we collect for the following specific purposes:

gf66 does not use your personal data for direct marketing communications without your explicit opt-in consent. If you have opted into promotional communications, you may opt out at any time by contacting [email protected].

5 Legal Basis for Processing

gf66 processes your personal data on the following legal bases, depending on the specific purpose of the processing activity:

• Contractual Necessity: Processing required to fulfil the agreement between you and gf66, including account management, payment processing, and providing access to games and betting markets.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including age verification, anti-money laundering checks, and fraud reporting obligations.
• Legitimate Interests: Processing necessary for gf66's legitimate business interests, including platform security, fraud prevention, responsible gaming monitoring, and analytics to improve service quality.
• Consent: Processing for optional purposes where you have provided explicit consent, such as receiving promotional communications. Consent may be withdrawn at any time.

6 Data Sharing & Third Parties

gf66 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following strictly limited circumstances:

• Payment Processors: bKash, Nagad, Rocket, Upay, and USDT network processors receive only the transaction data required to process your deposit or withdrawal. gf66 does not store full payment credentials.
• Identity Verification Providers: KYC document data is shared with certified identity verification partners solely for the purpose of confirming your age and identity. These partners are contractually bound to process data only for that purpose.
• Game Studio Providers: Game providers including Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, and Microgaming may receive pseudonymised player identifiers to facilitate game round resolution and technical support. No full personal data profiles are shared with game studios.
• Fraud & Security Vendors: Fraud detection and cyber-security service providers may process technical data (IP address, device fingerprint, session metadata) to identify and mitigate fraudulent activity on the platform.
• Law Enforcement & Regulatory Authorities: gf66 will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by a valid legal order, warrant, or applicable law. gf66 will notify affected players of such disclosure where legally permitted to do so.

7 Data Retention

gf66 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual. Anonymised aggregate data may be retained for statistical and analytical purposes beyond these periods.

8 Cookies & Tracking Technologies

gf66 uses cookies and similar technologies to enable core platform functionality, maintain your login session, and collect aggregate analytics data to improve the platform experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing the platform from operating correctly.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and responsible gaming tool configurations, so you do not need to re-enter them on each visit.
• Analytics Cookies: Used to collect aggregate, anonymised data about how players navigate the gf66 platform. This data helps gf66 identify usability issues and improve platform performance. No individual user is identified by analytics data.

gf66 does not deploy third-party advertising cookies, social media tracking pixels, retargeting cookies, or any tracking technology that profiles your behaviour across other websites. Your browsing activity on other websites is not tracked or collected by gf66.

Most web browsers allow you to manage cookie preferences through the browser settings menu. Disabling strictly necessary cookies may impair platform functionality. Disabling functional or analytics cookies will not prevent you from accessing the core platform services.

9 Your Data Rights

As a gf66 player, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact gf66 at [email protected] with the subject line "Data Rights Request" and your registered account username. gf66 will respond within 30 days of receiving a valid request.

• Right of Access: You have the right to request a copy of all personal data that gf66 holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held by gf66. You can update most account information directly in your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may apply.
• Right to Restrict Processing: You have the right to request that gf66 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you do not want the data erased.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to gf66 in a structured, machine-readable format, where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where gf66 relies on legitimate interests as its legal basis, unless gf66 can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where gf66 processes your data on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

10 Data Security

gf66 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and gf66 servers.
• AES-256 encryption for sensitive data at rest, including identity documents and payment method identifiers.
• Strict role-based access controls ensuring only authorised personnel with a verified operational need can access player data.
• Multi-factor authentication enforced for all internal staff accounts with access to player data systems.
• Regular independent security audits and penetration testing of the gf66 platform and supporting infrastructure.
• Automated intrusion detection and real-time anomaly monitoring across all platform systems.
• Secure, encrypted backups stored in geographically separate facilities with strict access controls.
• Staff data protection training and a formal internal data handling policy reviewed annually.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, gf66 will notify affected players without undue delay, providing details of the nature of the breach, the categories of data affected, and the steps gf66 is taking to address it.

11 Children & Minors

The gf66 platform is strictly restricted to individuals who are aged 21 years or above. gf66 does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and gf66 reserves the right to request additional documentary evidence of age at any time.

If gf66 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to suspend the relevant account, void any associated transactions, and permanently delete the personal data in question. Any funds deposited by an underage player will be returned to the originating payment method, minus any amounts required to cover processing costs or potential fraudulent use.

If you are a parent or guardian and believe that your child has registered an account with gf66, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and act upon all such reports within 24 hours.

12 Changes to This Policy

gf66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or our data processing practices. When material changes are made, gf66 will notify registered players by email and/or by displaying a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent version was published. We encourage you to review this Policy periodically to stay informed of how gf66 protects your personal data. Your continued use of the gf66 platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms.

Where changes to this Policy require your explicit consent under applicable law, gf66 will seek that consent before the changes apply to your personal data. In all other cases, changes will take effect from the date of publication.

13 Contact & Data Requests

For all privacy-related enquiries, data rights requests, or concerns about how gf66 handles your personal data, please contact the gf66 Data Support team using the details below. All communications must be in English and include your registered account username to allow us to locate and verify your records.

• Email: [email protected] — use the subject line "Privacy Enquiry" for general questions or "Data Rights Request" for formal data access, correction, or deletion requests.
• Response Times: General privacy enquiries are answered within 24 hours. Formal data rights requests are processed within 30 calendar days of receipt of a valid, identity-verified request.
• Platform: https://gf66.io — your account settings panel also allows you to update certain personal data, manage communication preferences, and access responsible gaming tools directly.
• Market: gf66 serves players across all 64 districts of Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. Support is available 24/7 in English.