x666 Privacy Policy – Your Data, Your Rights

x666 is an online casino and sports betting platform available at x666-play.com. The platform is built specifically for Pakistani users and offers cricket and PSL betting, live casino games, card games, the Aviator crash game, roulette, esports betting, and slot games — all denominated in Pakistani Rupees (PKR) and accessible via Pakistani payment methods including Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and Visa/Mastercard.

For the purposes of this Privacy Policy, x666 is the data controller responsible for your personal information collected through x666-play.com and any associated communications. If you have questions about how x666 handles your data, contact the support team at support@x666-play.com.

x666 collects only the personal data necessary to operate the platform, verify player identity, process payments, provide customer support, and comply with legal obligations. The categories of data we collect are listed below.

Registration & Identity Data

CNIC details are collected only as part of the identity verification process required for account security and withdrawal processing. They are not used for any other purpose and are stored under encryption.

Payment & Transaction Data

Card numbers are never stored on x666 servers — card transactions are handled entirely by a PCI-DSS certified payment gateway. See Section 5 for full payment data security details.

Gaming & Betting Activity Data

Technical & Device Data

Technical data is used for security monitoring, fraud detection and improving platform performance. Precise GPS location is never requested or stored.

Communications Data

Communication records are retained for quality assurance and to maintain a history of account-related interactions. They are never shared for marketing purposes with third parties.

x666 collects data through three main channels:

• Directly from you — when you register, fill in a form, make a deposit, contact support, or respond to a survey or promotion on x666.
• Automatically during your use of the platform — through cookies, server logs and similar technologies that record how you interact with x666 pages and games. See Section 7 for the full cookie policy.
• From payment providers and verification services — when you make a deposit or withdrawal, x666 receives transaction reference data from Easypaisa, JazzCash, NayaPay, SadaPay, your bank or the card gateway. x666 may also receive confirmation data from identity verification services used to confirm your CNIC or date of birth.

x666 does not buy data lists from third-party marketing companies and does not receive personal data about you from social media platforms or advertising networks.

x666 uses your personal data for specific, clearly defined purposes. We do not process your data beyond what is necessary for these purposes. The table below summarises the main uses and the legal basis that justifies each one.

Payment security is one of the areas where x666 puts the most effort. Pakistani players are depositing and withdrawing real PKR, and that deserves a serious level of protection. Here is exactly how x666 handles payment data.

• Card data is never stored on x666 servers. When you pay by Visa or Mastercard, the transaction goes through a PCI-DSS Level 1 compliant payment gateway. Your 16-digit card number is handled entirely within that gateway environment. x666 receives only a transaction token and approval status — not your actual card details. Repeat card transactions use a secure tokenisation system.
• Mobile wallet numbers are stored with access controls. Your Easypaisa or JazzCash number is stored in your x666 account in an encrypted format and is used only for initiating withdrawal payments to your registered wallet. It is not shared with any third party beyond the direct transaction routing to your wallet provider.
• Bank account / IBAN data is encrypted at rest. Bank account details used for IBFT withdrawals are stored under AES-256 encryption and are accessible only to x666's payment processing system and — where legally required — to regulatory authorities.
• All transactions use 256-bit SSL encryption in transit. Every page on x666-play.com that handles personal or payment data is served over HTTPS with 256-bit SSL. The padlock in your browser confirms this on every page of the cashier.
• Access to payment data is strictly limited. Within x666's internal systems, payment account data is accessible only to staff and systems with a specific business need to access it. Access logs are maintained and reviewed regularly.

x666 shares limited personal data with third parties only in the following specific circumstances:

• Payment providers — Easypaisa, JazzCash, NayaPay, SadaPay, bank networks and the card payment gateway receive the minimum data needed to process your specific transaction. They do not receive your full account profile or gaming history.
• Identity verification services — where x666 uses a third-party service to verify your CNIC or confirm your age, that service receives only the data needed for that specific verification check. Such services are contractually bound to use the data solely for verification purposes.
• Game providers — the third-party game studios whose games appear on x666 may receive a session token and anonymised usage data needed to run the game in your browser. They do not receive your name, contact details or payment information.
• Legal and regulatory authorities — x666 is required by its operating obligations to cooperate with lawful requests from competent authorities. This includes providing account information and transaction records where legally compelled to do so. x666 will not voluntarily hand over player data beyond what is legally required.
• Fraud prevention services — anonymised or pseudonymised device and behavioural data may be shared with fraud detection partners to identify suspicious patterns. This data cannot be used to identify you directly without x666's account database.

All third parties with whom x666 shares data are contractually required to protect it and to use it only for the specific purpose for which it was shared. x666 does not allow any third party to use your data for their own marketing or commercial purposes.

x666 uses cookies and similar technologies (local storage, session tokens) to make the platform work properly and to understand how players use it. Here is a breakdown of the cookie types used on x666.

x666 does not use third-party advertising cookies or retargeting pixels. Your activity on x666 is not tracked by external ad networks.

You can manage cookie settings through your browser. Note that disabling essential cookies will affect platform functionality — for example, you will not be able to stay logged in across pages.

x666 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The specific retention periods are:

• Active account data — retained for the full duration of your x666 account being open, plus an additional period after closure as required for AML and audit purposes (typically 5 years post-closure).
• Transaction records — deposit and withdrawal records are retained for a minimum of 5 years after the transaction date to satisfy financial record-keeping obligations.
• Identity verification documents — CNIC copies and verification outcomes are retained for 5 years after the verification is completed, or for the duration of the account plus 5 years, whichever is longer.
• Gaming activity logs — bet history and game session logs are retained for 5 years from the date of the activity.
• Support communications — live chat and email records are retained for 3 years from the date of the communication unless the record is part of an ongoing dispute or investigation.
• Technical / device data — security logs are retained for 12 months. Aggregated analytics data (which contains no personal identifiers) may be retained indefinitely.

When retention periods expire, data is securely deleted or anonymised so that it can no longer be linked back to an individual. Players who request account closure may request confirmation of data deletion from support@x666-play.com — please note that data subject to legal retention obligations cannot be deleted before the applicable period expires.

As a registered player on x666, you have rights in relation to the personal data we hold about you. Below is a summary of those rights and how to exercise them.

To exercise any of these rights, contact support@x666-play.com with your registered mobile number or email address and a clear description of your request. x666 will respond within 30 days. Identity verification may be required before processing certain requests to ensure the data is only released to the correct individual.

x666 may update this Privacy Policy from time to time to reflect changes in how the platform operates, changes in applicable law, or improvements to data protection practices. When a material change is made, x666 will notify registered players by email to the address on file, or through a notice displayed on the platform.

The date at the top of this page is updated each time the policy is revised. Players are encouraged to review the Privacy Policy periodically. Continued use of x666 after an updated policy is published constitutes acceptance of the revised terms. If you disagree with any change, you may request account closure and data deletion by contacting support.

For any privacy-related questions, data access requests, correction requests, or to report a concern about how x666 has handled your personal information, please reach out to the support team. All data-related enquiries are handled by the x666 data team with responses typically within 48 hours for privacy matters.