c667 Privacy Policy

This Privacy Policy ("Policy") describes how c667 ("c667", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to the c667 platform at https://c667.io ("the Platform"). This Policy forms part of the c667 Terms & Conditions and should be read alongside them. By registering an account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood its contents.

1 Data Controller

c667 is the data controller responsible for personal data collected through the Platform. As data controller, c667 determines the purposes for which, and the means by which, personal data is processed. All questions, requests, or concerns relating to the processing of personal data under this Policy should be directed to the c667 Data Protection contact at [email protected].

2 How We Collect Your Data

c667 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting a feedback form.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including IP addresses, session data, device identifiers, and gameplay logs. This data is collected via server logs, session management systems, and first-party analytics tools.
• Payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard when you make deposits or withdrawals.
• Identity verification services: Data received from third-party KYC and identity verification providers when we conduct age or identity checks as required by our compliance obligations.
• Game providers: Aggregated gameplay data received from game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi in connection with game round outcomes and session activity.

3 How We Use Your Data

c667 uses the personal data we collect for the following purposes:

3.1 Account Management and Service Delivery

We use identity, contact, and financial data to create and manage your account, verify your identity and age (21+ requirement), process deposits and withdrawals, and deliver the core gaming and sports betting services available on the Platform.

3.2 Fraud Prevention and Security

Technical and financial data is used to detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited conduct. c667 operates automated fraud-detection systems that analyse transaction patterns and session behaviour in real time. Where suspicious activity is identified, we may restrict account access pending further investigation.

3.3 Legal and Regulatory Compliance

c667 processes personal data as required to comply with applicable anti-money laundering obligations, age verification requirements, and record-keeping duties. This includes retaining transaction records for the legally required retention period and responding to lawful requests from competent authorities.

3.4 Responsible Gaming

Usage and gameplay data is used to power c667's responsible gaming tools, including session time reminders, deposit limit enforcement, cool-down periods, and self-exclusion management. Monitoring player activity for signs of problem gambling is a core use of personal data at c667 and reflects our genuine commitment to player welfare.

3.5 Customer Support

Communications data — including support chat transcripts and email correspondence — is used to resolve queries, investigate complaints, and improve the quality of the c667 support service. Support interactions may be reviewed by quality assurance personnel for training and monitoring purposes.

3.6 Platform Improvement

Aggregated and pseudonymised usage data is used to analyse Platform performance, identify technical issues, and inform product development decisions. Where possible, this analysis is performed on anonymised datasets that do not identify individual players.

3.7 Marketing Communications

Where you have provided explicit consent, c667 may send you promotional communications about new games, seasonal offers (such as Eid specials, Pohela Boishakh promotions, or BPL tournament bonuses), and platform updates. You may withdraw consent to marketing communications at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

4 Sharing Your Data

c667 does not sell personal data to third parties. We share personal data only in the following limited circumstances:

• Payment processors: Financial data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard solely to process transactions initiated by you.
• Identity verification providers: Identity and verification document data is shared with KYC service providers engaged by c667 to conduct age and identity checks. These providers are contractually bound to process data solely for verification purposes.
• Game providers: Anonymised or pseudonymised session and gameplay data may be shared with game providers for the purpose of resolving game disputes or investigating technical malfunctions.
• Legal authorities: c667 will disclose personal data to competent legal authorities where required to do so by law, court order, or lawful regulatory request. We will notify affected account holders of such disclosures to the extent permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of c667's business, personal data held about players may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third-party service providers who receive personal data from c667 are subject to data processing agreements that restrict their use of that data to the specific purpose for which it was shared.

5 Cookies & Tracking Technologies

c667 uses first-party cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function correctly, including maintaining your login session, remembering your account preferences, and securing your session against cross-site request forgery attacks. These cookies cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to collect aggregated data about Platform usage, page performance, and navigation flows. This data is used in pseudonymised form and does not identify individual players.
• Responsible gaming cookies: Used to support session time tracking and reminder tools. These cookies are essential to delivering the responsible gaming features available on the Platform.

c667 does not use third-party advertising cookies or cross-site tracking technologies. You may manage cookie preferences through your browser settings; however, disabling essential cookies may prevent you from accessing your account or using certain Platform features.

6 Data Retention

c667 retains personal data for the following periods:

• Active account data: Retained for the duration of your account and for a period of five (5) years following account closure, to comply with anti-money laundering record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial record-keeping requirements.
• KYC and verification documents: Retained for five (5) years following account closure or the completion of the relevant transaction, whichever is later.
• Support communications: Retained for two (2) years from the date of the last interaction, unless a longer period is required for dispute resolution or legal proceedings.
• Marketing consent records: Retained for the duration of your consent and for two (2) years following withdrawal of consent, as evidence of your consent decision.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes.

7 Security Measures

c667 implements the following technical and organisational security measures to protect personal data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and c667 servers.
• One-way cryptographic hashing (bcrypt) for all stored account passwords.
• Two-factor authentication (2FA) available to all account holders.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Comprehensive audit logging of all internal access to personal data records.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Encrypted storage for KYC documents and sensitive financial records.

Despite these measures, no internet-based system can be guaranteed to be entirely secure. In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, c667 will notify those players and take all reasonable steps to contain and remediate the breach without undue delay.

8 Your Rights Over Your Data

As a c667 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected]. We will respond to all verified requests within 30 calendar days.

• Right of access: You may request a copy of the personal data c667 holds about you, together with information about how it is processed.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected or completed without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other lawful basis applies), or where it has been unlawfully processed. This right is subject to overriding legal retention obligations.
• Right to restriction: You may request that we restrict the processing of your data in certain circumstances, for example while the accuracy of data is contested or while a legal claim is being established.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to object: You may object to processing of your personal data where that processing is based on legitimate interest, including profiling for marketing purposes.

9 Protection of Minors

The c667 Platform is strictly for adults aged 21 years and above. c667 does not knowingly collect, store, or process personal data relating to individuals under the age of 21. Age verification is conducted for all new account registrations as part of the KYC process. If c667 becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered an account on c667, please notify us immediately at [email protected].

10 International Data Transfers

c667 primarily processes personal data within secure data centre infrastructure. Where personal data is transferred to or processed by service providers located outside Bangladesh — for example, in connection with identity verification or game provider services — c667 ensures that appropriate safeguards are in place. These safeguards include contractual data processing agreements that require receiving parties to maintain protections equivalent to those described in this Policy. c667 does not transfer personal data to recipients in jurisdictions that do not provide an adequate level of data protection without first implementing such safeguards.

11 Third-Party Services and Links

The c667 Platform may display information about third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. c667 is not responsible for the privacy practices of these independent companies in relation to data processed within their own systems. Where personal data is shared with game providers for the purpose of dispute resolution or technical investigation, such sharing is governed by the data processing agreements described in Section 4 of this Policy.

c667 does not embed third-party social media widgets, advertising networks, or tracking pixels on the Platform. Any links to external websites that may appear in informational content are provided for reference only; c667 has no control over the content or privacy practices of external sites and accepts no responsibility for them.

12 Changes to This Privacy Policy

c667 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify registered account holders via the email address associated with their account at least 14 days before the changes take effect, and we will update the "Last Updated" date at the top of this Policy. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you should close your account before the change takes effect.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by c667, please contact our Data Protection team using the details below. All communications should be in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject line: "Privacy Request — [Your Account Username]"
• Response time: We aim to acknowledge all privacy requests within 2 business days and to provide a full response within 30 calendar days of receiving a verified request.
• Support hours: Available 24 hours a day, 7 days a week, including Eid, Pohela Boishakh, Victory Day (16 December), and Independence Day (26 March), in Bangladesh Standard Time (UTC+6).