cy66 Privacy Policy — How We Protect Your Personal Data

1 Data Controller and Scope

cy66 ("we", "us", "our") is the data controller responsible for the personal data of all registered players on the cy66 platform, accessible at cy66.club. As data controller, cy66 determines the purposes and means of processing personal data collected through the platform, in compliance with applicable data protection principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity.

This Privacy Policy applies to all personal data collected and processed in connection with:

• Creating and maintaining a cy66 player account, including registration data and KYC verification documents.
• Depositing and withdrawing funds via supported payment methods, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard.
• Participating in casino games, live dealer tables, sports betting markets, crash games, and promotional activities on the cy66 platform.
• Communicating with the cy66 support team via email at [email protected] or any other supported communication channel.
• Browsing cy66.club, including technical data generated by your device and browser during navigation sessions.

This policy does not apply to third-party websites or services that may be linked from cy66 promotional materials or partner content. cy66 is not responsible for the privacy practices of any third-party operator. Players who interact with third-party services do so under those parties' own privacy terms.

2 Information We Collect

cy66 collects personal data through several channels: data you actively provide during registration and account use, data generated automatically by your use of the platform, and data received from third-party service providers such as payment processors and identity verification partners. The categories of data cy66 collects are described in full below.

Data You Provide Directly

Data Collected Automatically

When you access cy66.club, our servers and analytics systems automatically record certain technical information. This data is used for platform security, fraud detection, and performance optimisation and is not used to build advertising profiles.

• Device and Browser Data: Device type, operating system, browser type and version, screen resolution, and language settings.
• Network Data: IP address, approximate geographic location derived from IP address (country and city level), internet service provider name.
• Session Data: Pages visited, time spent on each page, navigation paths, game sessions opened, bet placement timestamps, and login/logout timestamps.
• Cookie and Tracking Data: First-party cookie identifiers used for session management, preference storage, and fraud detection. See Section 4 for full cookie details.

Data Received from Third Parties

cy66 may receive supplementary data about you from certified third-party partners in the following circumstances:

• Payment Processors: Transaction confirmation data (transaction ID, amount, timestamp, status) from bKash, Nagad, Rocket, Upay, and card payment processors. cy66 does not receive your full bank account number or full card number from these processors.
• Identity Verification Partners: Verification status results (pass/fail/pending) from KYC identity verification services that cross-reference your submitted documents against authoritative data sources.
• Fraud Prevention Services: Risk signals and device fingerprint data from certified fraud prevention partners used to detect account takeover attempts and multi-account activity.

3 How We Use Your Data

cy66 processes your personal data only for defined, legitimate purposes. The table below sets out each processing purpose, the lawful basis on which cy66 relies, and the data categories involved.

cy66 does not use automated decision-making or profiling that produces legally significant effects on players without human review. Responsible gaming alerts and fraud flags generated by automated systems are reviewed by a human compliance team member before any account action is taken.

4 Cookies and Tracking Technologies

cy66 uses cookies — small text files stored on your device — and similar tracking technologies to operate the platform securely, remember your session preferences, and monitor for fraudulent access. cy66 does not use third-party advertising cookies or behavioural tracking cookies that build cross-site advertising profiles.

Types of Cookies Used by cy66

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They manage your login session, maintain your account state across pages, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your selected language, preferred currency display (BDT/৳), and table/game lobby layout settings — to provide a consistent experience across sessions.
• Analytics Cookies: cy66 uses first-party analytics cookies to understand how the platform is used in aggregate — which game categories attract the most sessions, which pages have the highest exit rates, and where technical performance issues occur. This data is aggregated and anonymised; it does not identify individual players.
• Security and Fraud Detection Cookies: These cookies store a device fingerprint reference used to detect unusual login patterns, multiple simultaneous sessions from different geographic locations, and other signals associated with account takeover or bonus abuse.

Cookie Retention Periods

• Session cookies: Deleted automatically when you close your browser.
• Persistent functional cookies: Retained for up to 12 months from last activity, then automatically expired.
• Analytics cookies: Retained for up to 13 months, then automatically expired and refreshed.
• Security cookies: Retained for up to 24 months to maintain a fraud-detection baseline for your device.

Managing Your Cookie Preferences

You may configure your browser to reject or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from logging in or using core platform features. Instructions for managing cookies are available in the help documentation of all major browsers (Chrome, Firefox, Safari, Edge, Opera). cy66 does not use a separate cookie consent manager widget — the categories described above are the complete set of cookies used on cy66.club.

5 Data Sharing and Third Parties

cy66 does not sell, rent, or trade your personal data. Data is shared with third parties only in the specific, limited circumstances described below, and in every case, cy66 requires the receiving party to implement appropriate data protection safeguards.

Certified Service Partners

cy66 engages trusted service partners to deliver core platform functions. These partners act as data processors on cy66's behalf and are contractually prohibited from using your data for any purpose other than the specific service they provide:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive the minimum data necessary to process your deposit or withdrawal transaction.
• Identity Verification Partners: KYC verification services receive your identity document data to confirm your identity and age. Once verification is complete, cy66 retains only the verification status result, not a copy of your document images on our primary servers.
• Game Content Providers: Certified studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a pseudonymous player identifier and game session data to deliver game content and calculate RTP. These studios do not receive your full name, contact details, or financial data.
• Fraud Prevention Services: Certified fraud prevention partners receive device fingerprint and session data to generate risk signals. No raw personal data (name, NID number, payment details) is transmitted to fraud prevention partners.

Legal and Regulatory Disclosures

cy66 may disclose personal data to law enforcement agencies, financial intelligence units, or other government authorities without prior notice to the player where cy66 is required to do so by a valid legal instrument — including court orders, regulatory directives, or lawful requests related to money laundering investigations, fraud investigations, or other criminal proceedings. cy66 will disclose only the minimum data required to satisfy the legal obligation and will document all such disclosures in its compliance records.

Business Transfers

In the event that cy66 undergoes a merger, acquisition, asset sale, or corporate restructuring, player data may be transferred to the successor entity as part of that transaction. Players will be notified of any such transfer via their registered contact details and the successor entity will be bound by the terms of this Privacy Policy or an equivalent policy providing equivalent protections.

6 Data Retention and Storage

cy66 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, to comply with applicable legal retention obligations, and to resolve disputes or enforce agreements. The retention periods applied to each data category are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identified or identifiable individual. Backup copies are purged on the next scheduled backup rotation cycle following the retention expiry date.

All cy66 data is stored on servers with physical and logical access controls. Access to production data systems is restricted to authorised cy66 personnel on a role-specific need-to-know basis, and all access events are logged for security audit purposes.

7 Your Privacy Rights

As a registered cy66 player whose personal data cy66 processes, you hold the following rights with respect to your data. Requests to exercise any of these rights should be submitted in writing to [email protected] with the subject line "Privacy Rights Request" and sufficient information to verify your identity before cy66 processes the request.

Right of Access

You have the right to request a copy of all personal data that cy66 holds about you. cy66 will provide this information in a structured, machine-readable format within 30 calendar days of receiving a verified request. If the volume of data is exceptionally large, cy66 may notify you and request an additional 30 days, with explanation.

Right to Rectification

If any personal data cy66 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Where the inaccurate data relates to identity fields (name, date of birth), cy66 may require supporting documentation before making the correction to maintain KYC integrity.

Right to Erasure

You may request deletion of your personal data where: (a) the data is no longer necessary for the purpose it was collected; (b) you withdraw consent and there is no other lawful basis for processing; or (c) you object to processing based on legitimate interest and cy66 cannot demonstrate overriding grounds. cy66 will fulfil erasure requests subject to legal retention obligations — data that must be retained for anti-money laundering, financial records, or dispute resolution purposes cannot be deleted before the applicable retention period expires.

Right to Data Portability

Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a portable, machine-readable format (JSON or CSV) so that you can transfer it to another service provider. This right applies to account registration data and transaction history.

Right to Object to Marketing

You have an unconditional right to object to the processing of your personal data for direct marketing purposes. Upon receipt of a marketing opt-out request at [email protected], cy66 will cease all marketing communications to you within 5 business days. Opting out of marketing does not affect the processing of your data for account management, payment processing, or legal compliance purposes.

Right to Restrict Processing

You may request that cy66 restrict the processing of your data — meaning that cy66 stores it but does not actively process it — while a rectification request, objection, or erasure request is being assessed. During a processing restriction, your account may be placed in a suspended state pending resolution of the underlying request.

8 Privacy Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise a data rights request, or have a concern about the way cy66 has handled your personal data, please contact the cy66 Privacy team using the details below.

Privacy Enquiries

All privacy-related communications should be directed to the cy66 support team at [email protected] with the subject line "Privacy Enquiry" or "Privacy Rights Request". The cy66 support team handles all privacy matters in English and is available 24 hours a day, 7 days a week, with a target response time of 30 minutes during standard BST (UTC+6) operating hours.

Changes to This Privacy Policy

cy66 reviews this Privacy Policy periodically and updates it when necessary to reflect changes in platform functionality, applicable law, or data processing practices. When material changes are made, cy66 will notify all registered players via their registered email address or mobile number at least 7 calendar days before the changes take effect. The updated policy will be published on this page with a revised effective date. Continued use of the cy66 platform following the effective date of a revised policy constitutes acceptance of the updated terms.

Complaints

If you are not satisfied with cy66's response to a privacy enquiry or rights request, you may escalate your complaint by emailing [email protected] with the subject line "Privacy Complaint — Escalation". cy66's compliance team will conduct an independent internal review of the complaint and provide a final written response within 14 calendar days. cy66 takes all privacy complaints seriously and treats escalated complaints as a priority matter.