66iii Privacy
Policy

The following terms carry the meanings defined below throughout this Privacy Policy:

This Privacy Policy applies to all Personal Data collected by 66iii through the Platform at 66iii.vip, including data submitted during account registration, KYC verification, deposits and withdrawals, gameplay, customer support interactions, and promotional activities.

66iii acts as the Data Controller for all Personal Data collected directly from Players through the Platform. Where 66iii engages third-party Data Processors — such as payment gateway providers and identity verification services — those processors act solely on 66iii's instructions and are contractually prohibited from using your data for their own independent purposes.

This Policy is directed at Players who access the Platform from Indonesia, where our primary user base is located. By registering an Account or otherwise providing your Personal Data to 66iii, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and Processing of your data as described herein.

66iii collects only the Personal Data necessary to provide, secure, and continuously improve our services. The categories of data we collect are set out below:

66iii collects Personal Data through the following means:

• Direct Submission: Data you provide when registering an Account, completing KYC, making a deposit or withdrawal request, contacting support, or participating in a promotion.
• Automated Technologies: Data collected automatically as you use the Platform, including cookies, server logs, and browser fingerprinting used for session management and fraud prevention.
• Third-Party Verification Partners: Identity and age verification data returned to us by our licensed KYC service providers when processing your identity documents.
• Payment Providers: Transaction confirmation data returned by BCA, BRI, BNI, Mandiri, and e-wallet processors (OVO, DANA, GoPay, ShopeePay, LinkAja) to confirm successful deposits and withdrawals.
• Device & Browser Data: Technical metadata collected automatically each time your device connects to the Platform, including IP address, device identifiers, and browser configuration.

We do not purchase Personal Data from data brokers or third-party list providers. All data we hold about you originates from your direct interactions with 66iii or from the service providers listed above who assist in delivering our platform services to you.

66iii processes your Personal Data for the following purposes, each supported by a defined legal basis:

Where we rely on consent as our legal basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for marketing communications will not affect your ability to continue using the Platform.

66iii does not sell your Personal Data to any third party. We share your data only in the following limited and controlled circumstances:

• Payment Processors: Financial data necessary to process your IDR deposits and withdrawals is shared with our licensed payment gateway partners. These providers are PCI-DSS certified and contractually bound to handle your data securely and exclusively for payment processing purposes.
• KYC & Identity Verification Partners: Identity documents and personal details required for verification are shared with our third-party KYC service provider. Verification results are returned to 66iii; your documents are not retained by the verification partner beyond their own regulatory obligations.
• Platform Technology Providers: Hosting infrastructure, database management, and cybersecurity service providers who access data solely to maintain and operate the Platform on 66iii's behalf, under binding data processing agreements.
• Game Content Providers: When you play a game developed by a third-party studio (such as Pragmatic Play, Evolution Gaming, or PG Soft), limited technical session data (player ID, bet token, game result) is transmitted to that studio's certified gaming server for game execution. Studios are contractually prohibited from using this data for profiling or marketing.
• Legal & Regulatory Authorities: Where required by applicable law, court order, or a valid request from a regulatory or law enforcement authority, 66iii will disclose the minimum Personal Data necessary to comply with that obligation. We will notify you of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of 66iii's business assets, Personal Data held by 66iii may be transferred to the acquiring entity. Players will be notified in advance of any such transfer and provided an opportunity to close their Account before the transfer completes, if they wish.

The 66iii Platform serves Players primarily located in Indonesia. Our core data infrastructure is hosted in data centres selected for their geographic proximity to Indonesia and their certified security standards. However, some of our third-party service providers — including KYC verification partners and game studio servers — may be located outside Indonesia.

Where Personal Data is transferred outside Indonesia, 66iii ensures that appropriate safeguards are in place, including:

• Binding contractual clauses that require the recipient to protect your data to a standard equivalent to that described in this Policy.
• Transfers only to service providers who maintain internationally recognised security certifications (e.g., ISO/IEC 27001, SOC 2 Type II, PCI-DSS).
• Minimum-data-transfer principles — only the data strictly necessary for the specific service is shared with each international partner.

For further information about the specific safeguards applicable to any international transfer of your data, please contact our Data Protection team at [email protected].

66iii maintains a comprehensive information security programme designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• TLS 1.3 Encryption: All data in transit between your browser or device and the 66iii servers is encrypted using Transport Layer Security (TLS) version 1.3.
• Encryption at Rest: Personal Data and KYC documents stored in our databases and document vaults are encrypted at rest using AES-256 encryption.
• Password Security: Player passwords are never stored in plaintext. We use industry-standard adaptive hashing algorithms (bcrypt with a high cost factor) to store password hashes.
• Access Controls: Access to systems containing Personal Data is restricted to authorised personnel on a need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all administrative systems.
• Intrusion Detection: Our infrastructure is monitored continuously by an automated intrusion detection system (IDS) that alerts our security team to anomalous access patterns in real time.
• Penetration Testing: 66iii engages independent security specialists to conduct penetration testing and vulnerability assessments on a regular basis.
• Incident Response: In the event of a confirmed data breach affecting Player Personal Data, 66iii will notify affected Players promptly and take all reasonable steps to contain the incident, remediate the vulnerability, and prevent recurrence.

66iii retains your Personal Data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law and regulatory obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised data may be retained indefinitely for aggregate statistical and product development purposes.

66iii uses cookies and similar tracking technologies to ensure the Platform functions correctly, to keep you securely logged in during a session, and to gather aggregated analytics that help us improve the user experience. We categorise our cookies as follows:

• Strictly Necessary Cookies: Essential for core platform functionality, including session authentication, load balancing, and CSRF (cross-site request forgery) protection. These cookies cannot be disabled without breaking core Platform features.
• Performance & Analytics Cookies: Collect aggregated, anonymised data about how Players use the Platform (page visits, click paths, session duration). Used exclusively to improve Platform performance and game discovery. Individual player behaviour is not profiled.
• Fraud Prevention Cookies: Used by our security systems to detect and block automated bots, credential-stuffing attacks, and other fraudulent access attempts. These are considered operationally necessary and cannot be disabled.

66iii does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You will not be followed across the web by 66iii advertising trackers after leaving the Platform.

Most browsers allow you to view, manage, and delete cookies through the browser's settings menu. Disabling strictly necessary cookies will impair your ability to log in and use the Platform effectively. Disabling analytics cookies will not affect your gameplay experience.

As a Player on the 66iii Platform, you hold the following rights in respect of your Personal Data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a full response within 30 calendar days.

• Right of Access: You may request a copy of all Personal Data we hold about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Some corrections may require re-submission of identity documents for KYC re-verification.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected. Note that this right is subject to our legal obligation to retain certain financial and identity records for a minimum of 5 years as described in Clause 9.
• Right to Restriction: You may request that we restrict the Processing of your Personal Data in certain circumstances — for example, while a rectification request is being investigated.
• Right to Data Portability: You may request a machine-readable export of the Personal Data you have provided directly to us, in a structured, commonly used format (e.g., JSON or CSV).
• Right to Object: You may object to Processing carried out on the basis of legitimate interest, including any profiling associated with responsible gaming monitoring. Note that objecting to fraud prevention or AML processing may result in Account suspension if we are unable to fulfil our compliance obligations.
• Right to Withdraw Consent: Where Processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time via Account settings or by contacting support. Withdrawal does not affect the lawfulness of prior Processing.

The 66iii Platform is strictly for adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in our registration and KYC process, and we take all reasonable measures to prevent underage access.

If 66iii becomes aware that it has inadvertently collected Personal Data from an individual who was under 21 at the time of collection, we will immediately close the associated Account, delete or render inaccessible the Personal Data in question (subject to any mandatory legal retention requirements), and review and strengthen our age-gate controls to prevent recurrence.

The 66iii Platform does not contain outbound links to third-party websites for general browsing. However, certain in-platform services — such as live game environments powered by Evolution Gaming or Pragmatic Play — load content served from third-party certified gaming servers. These connections are purely for game delivery purposes and are governed by the respective studio's own data handling practices.

66iii is not responsible for the privacy practices or content of any third-party systems accessed in connection with using the Platform, including game studio servers, payment gateway redirect pages, or KYC verification portals. We encourage you to review the relevant privacy notices of those providers when interacting with their systems.

66iii reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable regulations, or the services we offer. When material changes are made, we will update the "Last Updated" date and version number at the top of this page. Where changes are significant — such as a new category of data collection or a new third-party sharing arrangement — we will notify registered Players by email at the address associated with their Account.

Your continued use of the Platform after the updated Policy has been posted constitutes your acceptance of those changes. If you do not agree with any updated terms, you may request Account closure in accordance with the Terms & Conditions available at 66iii.vip/terms-conditions.

We recommend bookmarking this page and checking it periodically. The version number (e.g., "Version 2.4") at the top of this page is incremented with each substantive revision to help you track what has changed.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please reach out to the 66iii team using the details below. All contact information is provided as plain text — please do not attempt automated or bulk messaging to these addresses.