six6a Privacy Policy

This Privacy Policy ("Policy") describes how six6a ("the Platform", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "the Player") who visit, register on, or otherwise interact with the six6a platform at six6a.io. The Policy applies to all services offered by six6a, including sports betting, live casino, slot games, virtual sports, and any future products introduced on the Platform.

six6a is committed to handling your personal data with transparency, integrity, and in accordance with recognised data protection standards. We operate our platform in English and direct our services exclusively to adults aged 21 and above located in Bangladesh. By creating an account or using any six6a service, you acknowledge that you have read, understood, and consent to the data practices described in this Policy.

This Policy should be read alongside the six6a Terms & Conditions and the Responsible Gaming guidelines, both of which are incorporated by reference. In the event of any conflict between this Policy and the Terms & Conditions regarding data handling, this Policy shall prevail.

six6a collects personal data through several channels: directly from you when you register or use the Platform, automatically through your interactions with the website, and in some cases from third-party verification and payment partners. The categories of data we collect are described below.

• Full legal name as it appears on your government-issued identity document
• Date of birth (used to verify the 21+ age requirement)
• Residential address (district, division, postal code, Bangladesh)
• Mobile phone number (used for account verification and support)
• Email address (used for account communications and notifications)
• Username and encrypted password credentials

• National Identity Card (NID) number and a scan or photograph of the NID
• Passport number and/or driving licence number where submitted as alternative identification
• Proof of address documentation (e.g., utility bill, bank statement)
• Selfie or liveness-check photograph where required for enhanced verification

• bKash, Nagad, Rocket, or Upay mobile wallet numbers used for deposits and withdrawals
• Bank account details where bank transfer is used (account number, bank name, branch)
• Visa/Mastercard last four digits and billing address where card payment is used
• Deposit amounts, withdrawal amounts, transaction reference numbers, and timestamps
• Account balance history and wagering activity records

• IP address at the time of registration and each subsequent login
• Device type, operating system, browser type and version
• Session duration, pages visited, games played, and bet history
• Referring URL (the page from which you arrived at six6a.io)
• Geolocation data (country/region level, derived from IP address)
• Cookie identifiers and similar tracking technologies (see Section 6)

• Content of support messages, live chat transcripts, and email correspondence
• Records of responsible gaming requests (deposit limits, self-exclusion, cooling-off)
• Formal complaint submissions and responses
• Feedback and survey responses where voluntarily provided

six6a uses collected personal data for clearly defined purposes only. We do not use your data for purposes incompatible with the original reason for collection without obtaining fresh consent. The primary purposes are set out below.

six6a does not use personal data for automated decision-making that produces significant legal effects on players, except in the context of fraud and AML screening where automated flags are always reviewed by a human compliance officer before action is taken.

six6a processes personal data on the following legal bases, which vary depending on the purpose of processing.

• Contractual Necessity: Processing your registration data, KYC information, and financial data is necessary to fulfil our contractual obligations to you under the Terms & Conditions — specifically, to open your account, process your transactions, and deliver the gaming services you have requested.
• Legal Obligation: Processing for KYC verification, AML monitoring, fraud prevention, and record-keeping is required by applicable legal and regulatory obligations. We are required to retain certain records for defined periods regardless of account closure.
• Legitimate Interests: Processing for fraud detection, platform security, analytics, and responsible gaming monitoring is carried out on the basis of six6a's legitimate interests in operating a secure and fair platform, provided those interests are not overridden by your data protection rights.
• Consent: Where we process data for optional marketing communications (e.g., promotional email newsletters), we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time by contacting [email protected] or updating your communication preferences within your account settings.

six6a does not sell, rent, or disclose your personal data to unrelated third parties for their own commercial benefit. We share data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

To fulfil our KYC obligations, six6a works with identity verification service providers who process your name, date of birth, NID data, and document images to confirm your identity and age. These providers operate under strict data processing agreements and may not use your data for any purpose other than verification on our behalf.

Transaction data is shared with the relevant payment processors — including bKash, Nagad, Rocket, Upay, and supported banks — solely to initiate, complete, and record your deposits and withdrawals. Each provider operates under its own privacy policy. six6a does not store full card or mobile wallet credentials on its own servers.

When you play a game hosted by a third-party studio — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi — a session token and anonymised player identifier are passed to the game server to initialise the game session. No directly identifiable personal data (such as your name or NID) is shared with game studios.

six6a may share transaction patterns, IP addresses, and account behaviour signals with specialist fraud prevention and AML screening services to detect and prevent financial crime. These services are contractually bound to process data solely for the purpose of fraud and AML detection on behalf of six6a.

six6a will disclose personal data to competent authorities, law enforcement agencies, or judicial bodies where required to do so by applicable law, court order, or regulatory mandate. We will notify you of any such disclosure to the extent permitted by law.

six6a uses cookies and similar technologies to operate the Platform, maintain your login session, detect fraud, and gather anonymised analytics data that helps us improve the user experience. The following categories of cookies are used on six6a.io.

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your authenticated session, remember your account preferences, and ensure the security of your interaction with the Platform. These cookies cannot be disabled without preventing you from using the service.
• Analytics Cookies: six6a uses privacy-respecting analytics tools to understand how players navigate the Platform — which pages are most visited, how long sessions last, and where technical errors occur. Analytics data is aggregated and anonymised wherever possible. No individual player profiles are created from analytics data.
• Fraud Detection Cookies: Certain cookies are used to fingerprint devices and detect suspicious login patterns, multi-account behaviour, and automated bot activity. These cookies are necessary to protect the integrity of the Platform and the security of all player accounts.
• Preference Cookies: These cookies remember your language setting, display preferences, and notification opt-in status to provide a more personalised experience on return visits.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair core platform functionality. six6a does not use third-party advertising cookies or cross-site tracking technologies for behavioural advertising purposes.

six6a applies industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The following measures are maintained on an ongoing basis.

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the six6a servers is encrypted using 256-bit SSL/TLS protocols. This applies to all pages of the Platform, not only payment pages.
• Encrypted Data at Rest: Sensitive data fields — including identity documents, payment credentials, and password hashes — are encrypted at rest using AES-256 encryption. Passwords are hashed using a one-way cryptographic algorithm; they are never stored in plain text.
• Access Controls: Access to player data is granted only to authorised six6a personnel who require it to perform their specific job function. All data access is logged and subject to regular audit review.
• Intrusion Detection: six6a operates continuous intrusion detection and monitoring systems that flag unusual access patterns, data exfiltration attempts, and other anomalous activity for immediate investigation.
• Penetration Testing: The Platform undergoes periodic security assessments, including independent penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a confirmed data breach affecting player personal data, six6a will notify affected players within a reasonable timeframe and take all reasonable steps to mitigate the impact of the breach.

While six6a takes all reasonable precautions, no system is entirely immune to security risk. Players can assist by maintaining strong, unique passwords for their six6a account and by never sharing login credentials with any third party.

six6a retains personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet applicable legal obligations. The general retention framework is outlined below.

At the end of a retention period, personal data is either securely deleted from all six6a systems or anonymised in a manner that makes it impossible to re-identify the individual. Anonymised data may be retained for longer periods for statistical analysis and service improvement purposes.

As a registered player and data subject, you hold a number of rights in relation to the personal data that six6a holds about you. These rights are summarised below. To exercise any of these rights, submit a written request to [email protected] including your account username and a description of the right you wish to exercise. We will acknowledge your request within 24 hours and respond substantively within 5 business days.

• Right to Access: You have the right to request a copy of the personal data that six6a holds about you, along with information about how it is used and with whom it is shared. We will provide this in a structured, commonly used format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For certain data fields, you may update information directly within your account settings.
• Right to Erasure: You may request that six6a delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that this right is subject to override where retention is required by law (e.g., AML record-keeping obligations).
• Right to Restriction: You may request that six6a restrict the processing of your personal data in certain circumstances — for example, while a dispute over data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a machine-readable format and to have it transmitted to another service provider where technically feasible.
• Right to Object: You may object to processing carried out on the basis of six6a's legitimate interests, including for direct marketing purposes. Where you object to direct marketing, processing for that purpose will cease immediately.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

six6a's services are strictly restricted to adults aged 21 years and above. The Platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. Registration requires confirmation of the player's age, and KYC verification is used to validate that confirmation with documentary evidence.

If six6a discovers or is notified that a person under 21 has registered an account or provided personal data through the Platform, we will immediately suspend the account, delete all associated personal data to the extent not required to be retained for legal reasons, and refund any deposits made to the payment method of origin.

If you believe that a minor has accessed the six6a Platform, please contact us immediately at [email protected]. All such reports are treated with the highest priority and handled in strict confidence.

The six6a Platform may contain references to third-party game studios and payment service providers. Where links to external services are present, clicking them will take you to a third-party website or application that is not operated by six6a. We have no control over, and accept no responsibility for, the privacy practices of those third-party services.

We encourage players to review the privacy policies of any third-party service they interact with, including bKash, Nagad, Rocket, Upay, and game studio platforms, before providing personal data to those services. six6a is not responsible for data handling practices that occur outside the six6a.io domain.

six6a reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will notify registered players by email to the address on file at least 14 days before the updated Policy takes effect. A notice will also be displayed on the Platform during this period.

For minor or non-material changes — such as correcting typographical errors, clarifying existing language, or updating contact details — six6a may update the Policy without prior notice, though the effective date at the top of this page will always reflect the date of the most recent revision.

Continued use of the six6a Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material change, you must cease using the Platform and may request account closure by contacting [email protected] before the new version takes effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way six6a handles your personal data, please contact our support team using the details below. All privacy-related correspondence should be submitted in English and directed to the email address below. Our support team operates 24 hours a day, 7 days a week on Bangladesh Standard Time (BST, UTC+6).

• Privacy Enquiries: [email protected] — use the subject line "Privacy Enquiry" for faster routing to the appropriate team member.
• Data Access & Deletion Requests: Submit to [email protected] with the subject line "Data Rights Request", your account username, and a description of the right you wish to exercise. We will acknowledge within 24 hours and respond substantively within 5 business days.
• Data Breach Reports: If you believe your six6a account has been accessed without your authorisation, contact [email protected] immediately with subject line "Security Concern". Your account will be temporarily suspended pending investigation to protect your funds and data.
• Formal Complaints: If you are dissatisfied with our response to a privacy concern, you may escalate your complaint in writing to [email protected] with the subject line "Formal Privacy Complaint". All formal complaints are reviewed by a senior compliance officer within 5 business days.
• Response Times: General privacy enquiries: within 24 hours. Data rights requests: within 5 business days. Formal complaints: within 5 business days with a full written response.
• Players Served: Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all districts throughout Bangladesh.