ac66 Privacy Policy

ac66 collects personal data through several channels: directly from you when you register an account or interact with the platform, automatically through your device and browser as you use the site, and from third-party sources such as identity verification providers and payment processors. The categories of personal data we collect are set out in the table below.

Data We Do Not Collect

ac66 does not collect full payment card numbers, CVV codes, or full bank account numbers. ac66 does not store your account password in plaintext — passwords are stored using one-way cryptographic hashing. ac66 does not knowingly collect data from persons under the age of 18.

ac66 does not sell your personal data. We share data only with the categories of third parties described below, and only to the extent necessary to deliver the service or meet a legal requirement. All third-party service providers who process personal data on behalf of ac66 are bound by written data processing agreements that restrict their use of that data to the purposes for which it was shared.

Categories of Third-Party Recipients

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive the financial data necessary to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and regulatory obligations.
• Identity Verification Providers: ac66 uses a third-party KYC (Know Your Customer) service provider to verify the identity and age of players when required. This provider receives identity document images and biometric comparison data solely for verification purposes.
• Game Studios and Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and player identifiers necessary to deliver their games within the ac66 platform. These providers do not receive your full identity or financial data.
• Analytics and Platform Technology Providers: ac66 uses technology service providers for platform hosting, database management, and aggregated analytics. These providers process technical and activity data under strict contractual controls and may not use the data for their own purposes.
• Fraud Prevention and AML Services: ac66 may share transaction data and device identifiers with specialised fraud prevention services to detect patterns consistent with money laundering, account takeover, or payment fraud.
• Legal and Regulatory Authorities: ac66 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or to protect the rights and safety of ac66 and its players.

International Data Transfers

Some of ac66's third-party service providers may process data outside of Bangladesh. Where personal data is transferred internationally, ac66 ensures that appropriate safeguards are in place — such as standard contractual clauses or equivalent data protection measures — to ensure that your data receives a comparable level of protection to that provided under Bangladeshi data protection norms.

ac66 implements a layered approach to data security, combining technical controls, operational procedures, and access management to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. The following measures are in place as standard across the ac66 platform.

Technical Safeguards

• All data in transit between your device and ac66's servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Stored personal data is encrypted at rest using industry-standard encryption algorithms.
• Player passwords are hashed using a computationally strong one-way algorithm. ac66 cannot retrieve your plaintext password — if you forget your password, a reset process is initiated rather than retrieval.
• Financial transaction data is tokenised wherever possible, meaning full account numbers are replaced with non-sensitive identifiers in ac66's internal systems.
• ac66's infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning.

Organisational Safeguards

• Access to personal data is restricted to ac66 staff and contractors who have a legitimate need to access it for their role. Access is granted on a least-privilege basis.
• All staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• ac66 conducts periodic internal security reviews and works with external security specialists to test platform defences.

Security Incident Response

In the event of a data security incident that poses a risk to the rights and freedoms of affected players, ac66 will notify affected players without undue delay and take all reasonable steps to contain and remediate the incident. Notifications will be sent to your registered email address or mobile number and will describe the nature of the incident, the data affected, and the steps ac66 is taking in response.

Your Role in Security

While ac66 takes extensive measures to protect your data, you also play a critical role. Use a strong, unique password for your ac66 account. Never share your login credentials or OTP codes with anyone — including persons claiming to be ac66 support agents. ac66 will never ask for your password. If you suspect your account has been compromised, contact [email protected] immediately.

As a player on the ac66 platform, you have the following rights in relation to your personal data. These rights may be exercised at any time by contacting [email protected] with a clear description of your request. ac66 will acknowledge your request within 48 hours and will aim to fulfil it within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case you will be notified.

• Right of Access: You have the right to request a copy of all personal data that ac66 holds about you, along with information about how it is being used, where it came from, and who it has been shared with.
• Right to Rectification: If any personal data that ac66 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to Erasure: In certain circumstances — for example, where your data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other lawful basis for processing — you may request that ac66 delete your personal data. Note that this right is not absolute; ac66 may be required to retain certain data to comply with legal obligations.
• Right to Restrict Processing: You may request that ac66 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of that data is being contested, or while you have raised an objection to its processing.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on ac66's legitimate interests. ac66 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Rights Related to Automated Decision-Making: Where a decision is made about you solely by automated means and has a significant effect on you, you have the right to request human review of that decision.