6xix Privacy Policy — Your Data, Your Rights

1 Introduction & Who We Are

This Privacy Policy is issued by the operator of the 6xix platform, accessible at https://6xix.io and all associated subdomains and mobile interfaces (collectively, the "Platform"). References to "6xix", "we", "us", or "our" throughout this document refer to the Platform operator.

6xix is Bangladesh's premier online betting and casino platform, serving players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and throughout Bangladesh. We offer cricket betting, live casino games, slots, and instant mobile wallet transactions via bKash, Nagad, and Rocket.

This Privacy Policy explains in plain English how we collect, use, store, share, and protect personal data. It also sets out the rights you have in relation to your personal data and how you can exercise them. This policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, both of which are available on this Platform.

2 Data We Collect

6xix collects personal data in the following categories. We collect only what is necessary for the stated purpose.

2.1 Identity & Contact Data

• Full legal name, date of birth, gender
• National ID number, passport number, or driving licence number (for KYC)
• Residential address (current and correspondence)
• Email address and mobile phone number
• Photograph or selfie (where required for identity verification)

2.2 Account & Transaction Data

• Username, encrypted password, account registration date and IP address
• Deposit history, withdrawal requests, transaction timestamps, and amounts in BDT
• Payment method identifiers (e.g., bKash wallet number, Nagad number, bank account last four digits — never full payment credentials)
• Bonus and promotion history, wagering records
• Bet history, game session logs, win/loss records

2.3 Technical & Usage Data

• IP address, device type, operating system, browser type and version
• Pages visited, session duration, click-stream data, referral source
• Geolocation data (country and city level, derived from IP address)
• Device identifiers and, where applicable, mobile advertising IDs

2.4 Communication Data

• Records of communications between you and the 6xix support team via email, live chat, or any other support channel
• Survey responses, feedback submissions, and voluntary preference information

2.5 Responsible Gaming Data

• Deposit limits, session limits, cooling-off periods, and self-exclusion status set by you or applied by 6xix
• Responsible gaming assessments or questionnaire responses, where applicable

3 How We Collect Your Data

We collect personal data through the following means:

3.1 Direct Collection

You provide data directly when you register an account, complete KYC verification, make a deposit or withdrawal, place a bet, contact our support team, respond to a survey, or participate in a promotion.

3.2 Automated Collection

When you access the Platform, we automatically collect technical and usage data through cookies, web beacons, server logs, and similar technologies. This includes your IP address, browser type, device characteristics, and session activity. See Section 7 (Cookies) for full details.

3.3 Third-Party Sources

We may receive supplementary data about you from the following trusted third-party sources:

• Identity verification providers — to confirm the authenticity of documents submitted during KYC
• Payment processors — transaction status and confirmation data from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other supported payment partners
• Fraud prevention and AML screening services — to check transactions and identities against watchlists and fraud databases
• Analytics providers — aggregate, anonymised traffic and behavioural data to help us improve Platform performance

4 Purposes & Legal Bases for Processing

The table below sets out each purpose for which 6xix processes your personal data, the categories of data involved, and the legal basis on which we rely.

Where we rely on consent as our legal basis (for example, sending you marketing emails about new promotions), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before your withdrawal. To withdraw consent for marketing communications, contact us at [email protected] or use the unsubscribe link in any marketing email.

5 Sharing Your Data

6xix does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances and only with parties who are contractually obligated to protect it:

5.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under strict data processing agreements. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — to process deposits and withdrawals
• Identity verification providers: to validate government-issued ID documents during KYC
• Game studios: Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi — to deliver game content and live streaming; these providers may receive session data required to run the game
• Cloud infrastructure providers: to host Platform data on secure, access-controlled servers
• Customer support software providers: to manage and log support interactions
• Fraud screening and AML services: to screen transactions and user identities against fraud and sanctions databases

5.2 Legal & Regulatory Disclosure

6xix may disclose personal data to law enforcement agencies, courts, regulators, or other government authorities where required to do so by law, court order, or regulatory directive. We will notify you of such disclosure where legally permitted to do so.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of 6xix's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy commitments that apply to your data following completion.

5.4 Aggregated & Anonymised Data

We may share aggregated, fully anonymised statistical data (such as total monthly active users by city, or aggregate bet volumes by game category) with business partners or for publication. Such data cannot be used to identify any individual and is not considered personal data for the purposes of this policy.

6 International Data Transfers

The 6xix Platform serves users in Bangladesh, and we seek to process and store personal data within secure facilities. Where we engage service providers located outside Bangladesh — for example, international game studios or cloud infrastructure providers — your data may be transferred internationally.

Whenever personal data is transferred internationally, 6xix ensures that appropriate safeguards are in place, including:

• Contractual clauses that require the recipient to protect personal data to at least the same standard as 6xix
• Transfer only to service providers who maintain recognised information security certifications (e.g., ISO 27001, SOC 2 Type II)
• Minimisation of data transferred — only the data fields necessary for the specific service are shared

By using the 6xix Platform and creating an account, you acknowledge that your personal data may be transferred to and processed in countries other than Bangladesh in accordance with the safeguards described above.

7 Cookies & Tracking Technologies

6xix uses cookies and similar technologies (web beacons, pixel tags, local storage) to operate the Platform effectively and improve your experience. The table below explains each category of cookie we use.

6xix does not use third-party advertising or retargeting cookies. We do not allow advertising networks to place tracking cookies on the Platform.

You can manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary or security cookies will impair your ability to use the Platform, including logging in and making transactions.

8 Data Retention

6xix retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. The following retention periods apply:

When the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Data held for legal or regulatory compliance purposes will not be deleted early solely on the basis of an erasure request, though the request will be acknowledged and actioned as soon as the legal hold expires.

9 Security Measures

6xix implements a comprehensive, layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. Our current security measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and our servers
• Salted password hashing — passwords are never stored in readable form; even 6xix staff cannot retrieve your password
• Two-factor authentication (2FA) via SMS OTP, available to all registered users and strongly recommended
• Role-based access controls (RBAC) — internal staff access to personal data is restricted on a need-to-know basis, with all access events logged and audited
• Automated anomaly detection — real-time monitoring systems flag unusual login patterns, bulk data access, and suspicious transaction sequences for immediate review
• Regular penetration testing — independent security professionals conduct periodic penetration tests of Platform infrastructure
• Encrypted data at rest — all databases containing personal data are encrypted at the storage layer
• Secure data centre facilities — physical server infrastructure is held in access-controlled, ISO 27001-aligned facilities

While 6xix takes all reasonable steps to protect your data, no method of internet transmission or electronic storage is 100% secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, 6xix will notify affected users promptly and take all necessary remedial action.

10 Your Rights & Choices

As a 6xix account holder, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving your request.

10.1 Right to Access

You have the right to request a copy of all personal data 6xix holds about you, including the categories of data, the purposes for which it is processed, and the recipients with whom it has been shared. We will provide this information in a structured, commonly used, machine-readable format where technically feasible.

10.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor updates (such as a change of email address or phone number) can be made directly through your account settings without contacting support.

10.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where the data has been processed unlawfully. Note that 6xix may retain certain data for the minimum periods required by applicable law even following an erasure request — see Section 8 for retention periods.

10.4 Right to Restriction of Processing

In certain circumstances — for example, while a data accuracy dispute is being resolved — you have the right to request that 6xix restrict the processing of your personal data. Restricted data will be retained but not actively processed except for storage and the purpose of resolving the dispute.

10.5 Right to Data Portability

Where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that it be transmitted directly to another data controller where technically feasible.

10.6 Right to Object

You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing carried out on the basis of legitimate interests, on grounds relating to your particular situation. Where you object to marketing processing, we will cease that processing immediately.

10.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal. To withdraw marketing consent, use the unsubscribe link in any marketing communication or contact us directly.

11 Children & Minors

The 6xix Platform is strictly intended for individuals aged 21 and above. We do not knowingly collect, store, or process personal data belonging to any person under the age of 21. If you are under 21, you must not register an account or use the Platform in any capacity.

If 6xix becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, delete the personal data as soon as reasonably practicable (subject to any legal retention obligations), and where appropriate, escalate the matter to the relevant authorities.

If you are a parent or guardian and believe that your child may have registered an account or provided personal data to 6xix, please contact us immediately at [email protected] with the subject line "Minor Account Report" and we will investigate and act promptly.

12 Changes to This Policy

6xix reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When we make material changes to this policy, we will notify registered users by email to the address on file and/or by displaying a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this policy will always reflect when the most recent revision was published. We encourage you to review this policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated policy.

If you do not agree with the updated policy, you must cease using the Platform and contact us to request account closure. Upon closure, your data will be handled in accordance with the retention periods specified in Section 8.

13 Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data 6xix holds about you, please reach out using the contact details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: "Data Rights Request"
• Subject line for privacy complaints: "Privacy Complaint"
• Subject line for minor account reports: "Minor Account Report"
• Support availability: 24 hours a day, 7 days a week, including all Bangladesh public holidays
• Response time: Within 30 calendar days for formal data rights requests; within 24 hours for general privacy enquiries

We are committed to resolving all privacy-related concerns fairly and promptly. If you feel that your concern has not been adequately addressed, you have the right to escalate the matter to the appropriate data protection authority in your jurisdiction.