Privacy Policy — 666ii

This Privacy Policy ("Policy") describes how 666ii ("we", "us", "our") collects, uses, discloses, retains, and protects personal data about individuals ("you", "your") who visit or register on the 666ii Platform at 666ii.one. It applies to all Members, prospective Members, and visitors regardless of the device or connection method used to access the Platform.

666ii is committed to handling your personal data responsibly and in accordance with internationally recognised data-protection principles, including purpose limitation, data minimisation, storage limitation, integrity, and confidentiality. While Indonesia is our primary target market — serving players across Jakarta, Surabaya, Bandung, Bali, Medan, and beyond — 666ii operates under an international gaming licence and applies data-protection standards aligned with global best practice.

By accessing the Platform, registering an account, or completing a deposit or withdrawal via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja, you acknowledge that you have read and understood this Policy. This Policy forms part of 666ii's Terms & Conditions; defined terms used but not defined here have the meanings given in the Terms & Conditions.

• "Personal Data" — any information that identifies or could reasonably identify a living natural person, either alone or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Controller" — the entity that determines the purposes and means of Processing Personal Data; for the purposes of this Policy, that entity is 666ii.
• "Processor" — a third party that Processes Personal Data on behalf of the Controller under a data-processing agreement (e.g., payment processors, KYC verification providers).
• "Data Subject" — the individual whose Personal Data is being Processed; in the context of this Policy, this is you as a Member or visitor.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your wishes by which you agree to the Processing of your Personal Data for a stated purpose.
• "Sensitive Personal Data" — a subset of Personal Data that warrants a higher level of protection, including government-issued identity document numbers (e.g., Indonesian KTP number), financial account details, and biometric data.

666ii collects the following categories of Personal Data:

We do not collect Special Category data (health, religion, political opinion, racial or ethnic origin) unless you voluntarily disclose such information in a support communication. In that event, the data is used solely to resolve your enquiry and is not retained beyond the support ticket lifecycle.

666ii collects Personal Data through the following channels:

• Direct submission: Information you provide when registering your account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated collection: Technical Data gathered automatically when you access the Platform, including via cookies, web beacons, server logs, and session-tracking technologies. See Section 10 (Cookies & Tracking) for full details.
• Third-party sources: Identity and document verification data returned by our KYC provider; fraud-risk scores returned by our payment-fraud screening service; publicly available sanctions and PEP (politically exposed person) lists checked during onboarding and periodically thereafter.
• Payment processors: Transaction confirmation data (amount, timestamp, reference number, masked account identifier) returned by BCA, BRI, BNI, Mandiri, and e-wallet providers when you deposit or withdraw IDR funds.

Every Processing activity at 666ii has a defined purpose and a corresponding legal basis. The table below summarises the primary Processing activities:

Where Processing is based on your consent (e.g., receiving promotional communications), you may withdraw that consent at any time by updating your notification preferences in the Account dashboard or by contacting support. Withdrawal of consent does not affect the lawfulness of any Processing that occurred prior to withdrawal.

666ii does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. We disclose Personal Data only in the circumstances described below:

• Payment processors and banking partners: We share the minimum Financial and Identity Data necessary to process your IDR deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja. These partners act as independent data controllers for their own payment-processing operations and are bound by their own privacy policies and applicable financial-regulation requirements.
• KYC and identity-verification providers: We share document scans and identity particulars with our certified KYC provider solely for the purpose of verifying your age and identity in compliance with our licence obligations. The KYC provider is contractually prohibited from using your data for any other purpose.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive a pseudonymous session token and bet data in order to deliver and settle game rounds. These providers do not receive your name, contact details, or financial account information.
• Fraud-detection and AML screening services: We share Technical Data and transaction metadata with third-party fraud-screening vendors to protect the Platform and its Members from fraudulent activity and money laundering.
• Regulatory and law enforcement authorities: We may disclose Personal Data to our licensing authority, financial intelligence units, or law enforcement agencies where required by law, court order, or regulatory directive. We will notify you of such disclosure where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of 666ii's assets, your Personal Data may be transferred to the acquiring entity, subject to the same level of protection afforded by this Policy. We will notify you of any such transfer via the email address on your account.

All third-party Processors engaged by 666ii are subject to written data-processing agreements that require them to process Personal Data only on 666ii's documented instructions, to implement appropriate technical and organisational security measures, and to assist 666ii in fulfilling data-subject rights requests.

666ii operates globally, and your Personal Data may be transferred to and processed in countries other than Indonesia. These countries may have data-protection laws that differ from those applicable in your jurisdiction. Wherever such transfers occur, 666ii implements appropriate safeguards to ensure that your Personal Data continues to receive an equivalent level of protection, including:

• Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved by relevant data-protection authorities.
• Binding contractual obligations imposed on all data importers requiring them to protect your Personal Data in accordance with this Policy.
• Technical measures such as end-to-end encryption of data in transit and at rest, ensuring that even if data is intercepted during transfer, it remains unreadable to unauthorised parties.

666ii retains Personal Data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by our international gaming licence, anti-money-laundering obligations, or other applicable legal requirements. The following default retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification. Anonymised or aggregated data (which can no longer identify you) may be retained indefinitely for statistical analysis and Platform improvement.

666ii applies a defence-in-depth security strategy to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational measures include, but are not limited to:

• Encryption in transit: All data exchanged between your device and the 666ii Platform is protected by TLS 1.3 (256-bit) encryption. The Platform's SSL certificate is publicly verifiable via your browser's padlock icon.
• Encryption at rest: Sensitive Personal Data stored in our databases — including identity document data, financial account identifiers, and hashed passwords — is encrypted using AES-256.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis using role-based access controls (RBAC). All internal access events are logged and reviewed.
• Two-step verification: Members are strongly encouraged to enable SMS OTP two-step verification. 666ii's internal administrative systems require mandatory multi-factor authentication for all staff.
• Penetration testing: 666ii commissions independent penetration tests of the Platform at least twice per year. Critical findings are remediated within 48 hours; non-critical findings within 30 days.
• Incident response: In the event of a Personal Data breach that is likely to result in a risk to your rights, 666ii will notify affected Members via their registered email address within 72 hours of becoming aware of the breach, detailing the nature of the incident, data involved, and remediation steps taken.

While 666ii implements these robust measures, no security system is entirely impenetrable. You are responsible for maintaining the confidentiality of your own login credentials and for notifying 666ii immediately if you suspect unauthorised access to your account.

The 666ii Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, to analyse usage patterns, and to detect fraud. The categories of cookies we use are described below:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that maintain your logged-in state, CSRF protection tokens, and load-balancing cookies. They cannot be disabled without severely impairing Platform functionality.
• Functional cookies: Remember your preferences such as language choice, preferred currency display format (Rp vs IDR), and responsible gaming tool settings. These persist across sessions for up to 12 months.
• Analytics cookies: Collect pseudonymous data about how Members navigate the Platform — which pages they visit, how long they spend on each section, and which features they use most. This data is used in aggregate to improve the Platform. We use self-hosted analytics tools; your data is not shared with third-party analytics platforms.
• Security and fraud-detection cookies: Fingerprint your device and browser to detect anomalous login attempts, account takeover, and multi-account abuse. These are part of our fraud-prevention infrastructure and cannot be disabled.

You may manage your cookie preferences (except strictly necessary and security cookies) via your browser settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Please note that blocking functional or analytics cookies may affect your experience on the Platform. For step-by-step guidance on managing cookies in popular browsers, consult your browser's official help documentation.

Subject to applicable law and certain exceptions, you hold the following rights in relation to your Personal Data held by 666ii:

• Right of access: You may request a copy of the Personal Data 666ii holds about you, along with information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. You can update most Account Data directly via the Account Settings page.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Note that data subject to mandatory regulatory retention periods (see Section 8) cannot be deleted before those periods expire.
• Right to restriction of processing: You may request that 666ii restrict Processing of your Personal Data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where Processing is based on contract or consent and is carried out by automated means, you may request a machine-readable copy of the Personal Data you have provided to 666ii.
• Right to object: You may object at any time to Processing based on legitimate interest, including direct marketing. Where you object to direct marketing, 666ii will cease that Processing immediately.
• Right to withdraw consent: Where Processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior Processing.

To exercise any of these rights, submit a written request to support@666ii.one with the subject line "Data Subject Request — [your username]". 666ii will acknowledge your request within 2 business days and fulfil it within 30 calendar days. We may request proof of identity before acting on any data-subject request. This process is free of charge unless a request is manifestly unfounded or excessive.

The 666ii Platform is strictly intended for adults aged 21 and above. 666ii does not knowingly collect Personal Data from individuals under the age of 21. Our registration process includes a mandatory date-of-birth declaration, and accounts where the stated date of birth indicates the user is under 21 are automatically blocked from completing registration.

Where 666ii subsequently discovers that Personal Data has been collected from a person under 21 — whether through falsification of date of birth or any other means — we will immediately close the associated account, void any transactions, and delete or anonymise the minor's Personal Data from our systems as quickly as operationally possible, subject to any mandatory legal retention obligations.

If you are a parent or guardian and believe your child has registered on the 666ii Platform, please contact us immediately at support@666ii.one with subject line "Underage Account Report". We treat such reports as the highest priority and will act within 24 hours (WIB).

The 666ii Platform may contain links to third-party websites or services — for example, links to game-provider information pages or payment-partner terms pages. This Policy does not apply to those third-party sites. 666ii has no control over, and accepts no responsibility for, the content, privacy practices, or security measures of any third-party site. We encourage you to review the privacy policy of any external site you visit before submitting Personal Data to it.

Game studios integrated into the 666ii Platform (such as Pragmatic Play, Evolution Gaming, and Spribe) operate their own data-processing environments for the purpose of running game sessions. As noted in Section 6, these providers receive only a pseudonymous session token and are contractually prohibited from using session data to identify you or for any purpose beyond game-round delivery and settlement.

666ii reviews this Privacy Policy at least annually and whenever a material change to our data-processing practices occurs. When we make material changes, we will notify registered Members by email to the address on their account at least 14 days before the updated Policy takes effect, and we will update the "Effective Date" at the top of this page.

Your continued use of the 666ii Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure and deletion of your data (subject to mandatory retention obligations) by contacting support.

Previous versions of this Privacy Policy are available on request by emailing support@666ii.one with the subject line "Privacy Policy — Previous Version Request".

If you have questions, concerns, or requests relating to this Privacy Policy or your Personal Data, please reach out to the 666ii Data Protection team using the details below. Our Indonesian-speaking support agents are available 24 hours a day, 7 days a week.

• Email: support@666ii.one — use subject line "Privacy Enquiry" for data-protection matters and "Data Subject Request — [username]" for rights requests.
• Response time: Acknowledgement within 2 business days; full response within 30 calendar days (WIB timezone).
• Languages: English and Indonesian (Bahasa Indonesia).