666kz Casino – Privacy Policy

1.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), 666kz Casino is the personal information controller ("Controller") responsible for the personal data collected through the Platform. As Controller, 666kz determines the purposes and means by which personal data is processed.

1.2 666kz has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy, the DPA, and associated regulations. The DPO may be contacted as set out in Section 12 of this Policy.

1.3 Third-party service providers engaged by 666kz that process personal data on 666kz's behalf operate as personal information processors under written data processing agreements that impose obligations consistent with this Policy and the DPA.

2.1 Registration Data. When you create a 666kz account, we collect: your full legal name; date of birth; Philippine mobile number; and a chosen password (stored in cryptographically hashed form — never in plain text).

2.2 Identity Verification Data. To comply with KYC (Know Your Customer) and AML (Anti-Money Laundering) obligations under Philippine law, 666kz may request: a government-issued photo identification document (e.g., PhilSys National ID, SSS ID, passport, or driver's licence); proof of residential address (e.g., utility bill or bank statement dated within 90 days); and, where applicable, source-of-funds documentation.

2.3 Financial Data. We collect records of deposits, withdrawals, and wagers placed through your account. We do not store full payment card numbers; GCash and Maya transactions are processed through the respective payment providers' secure systems, and 666kz retains only transaction reference identifiers and amounts.

2.4 Technical and Usage Data. We automatically collect technical information when you access the Platform, including: IP address; device type and operating system; browser type and version; login timestamps; game session data; and clickstream behaviour within the Platform. This data is collected through server logs, session cookies, and similar technologies.

2.5 Communications Data. We retain records of communications between you and 666kz customer support, including live chat transcripts and support ticket correspondence, for quality assurance and dispute resolution purposes.

666kz collects personal data through the following means:

• Directly from you: information you provide during account registration, identity verification, payment processing, customer support interactions, and any voluntary communication with 666kz;
• Automatically: technical and usage data collected through your use of the Platform via server logs, session cookies, and analytics tools operated by or on behalf of 666kz;
• Third-party sources: identity verification agencies or data aggregators engaged for KYC and AML compliance purposes; payment processors for transaction confirmation data; and fraud-detection service providers.

666kz will always identify the purposes for which data is collected at or before the point of collection, in accordance with the DPA's transparency principle.

666kz processes personal data only where a legitimate purpose and lawful basis exists under the DPA. The following table summarises the primary processing activities:

• Account creation and management — to establish and maintain your 666kz account; lawful basis: consent and contract performance;
• Identity verification (KYC/AML) — to comply with PAGCOR licensing requirements and Philippine AML law (RA 9160 as amended); lawful basis: legal obligation;
• Payment processing — to facilitate deposits, withdrawals, and refunds; lawful basis: contract performance;
• Responsible gaming monitoring — to detect problem gambling patterns, enforce self-exclusion requests, and apply deposit/session limits; lawful basis: legal obligation and legitimate interests;
• Customer support — to respond to your enquiries and resolve disputes; lawful basis: contract performance and legitimate interests;
• Fraud prevention and platform security — to detect and prevent fraudulent, abusive, or illegal activity on the Platform; lawful basis: legitimate interests and legal obligation;
• Personalised promotions — to send you 666kz bonus offers and promotional communications relevant to your gaming activity; lawful basis: consent (you may withdraw consent at any time via account settings or by contacting support);
• Platform improvement and analytics — to analyse usage patterns and improve the Platform's performance and game selection; lawful basis: legitimate interests.

5.1 666kz does not sell your personal data to third parties. We share personal data only in the following circumstances and only to the extent necessary for the relevant purpose:

• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, UnionBank, Coins.ph, and similar) — for the processing of deposits and withdrawals;
• KYC and AML service providers — for identity verification and fraud screening in compliance with Philippine AML law and PAGCOR requirements;
• Game software providers — game providers whose titles are hosted on the 666kz Platform may receive pseudonymised session and wagering data for game functionality and integrity purposes;
• IT infrastructure and cloud service providers — engaged to host the Platform and associated databases under contractual data processing obligations;
• Legal and regulatory authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by law, court order, or regulatory directive;
• Professional advisers — lawyers, auditors, and insurers, subject to obligations of confidentiality.

5.2 Where personal data is transferred outside the Philippines (for example, to cloud infrastructure providers with data centres abroad), 666kz ensures that appropriate safeguards are in place in accordance with the DPA's cross-border transfer requirements, including contractual clauses that impose DPA-equivalent protections on the receiving party.

6.1 666kz retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods imposed by Philippine law and PAGCOR requirements:

• Account registration data and transaction records: a minimum of five (5) years from the date of account closure, in compliance with AML record-keeping obligations under RA 9160;
• KYC identity documents: five (5) years from the date of verification or account closure, whichever is later;
• Customer support communications: three (3) years from the date of the interaction;
• Technical and server log data: twelve (12) months, unless retained for longer as part of an active fraud investigation or legal proceeding.

6.2 After the applicable retention period expires, personal data will be securely deleted, anonymised, or otherwise rendered non-personally identifiable in a manner consistent with DPA requirements and industry best practice.

7.1 666kz implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and 666kz servers;
• Cryptographic hashing of account passwords — passwords are never stored in recoverable plain text;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Multi-factor authentication requirements for internal administrative systems;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Intrusion detection systems and continuous monitoring of Platform infrastructure.

7.2 Personal Data Breach Notification. In the event of a personal data breach that is reasonably likely to give rise to a real risk of serious harm to affected players, 666kz will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players as required by the DPA and NPC circulars.

8.1 666kz uses cookies and similar tracking technologies (collectively, "cookies") to operate and improve the Platform. Cookies are small text files stored on your device when you access the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session authentication, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences (such as language settings and layout choices) across sessions.
• Analytics cookies: Used to collect aggregated information about how players use the Platform, enabling 666kz to measure and improve performance. Analytics data is processed in pseudonymised form.
• Marketing cookies: Used to deliver personalised promotional communications based on your activity on the Platform. You may opt out of marketing cookies at any time through account settings.

8.2 You may configure your browser to refuse all cookies or to alert you when cookies are being set. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly.

As a data subject under the Philippine Data Privacy Act, you have the rights described in the summary cards above (Sections 2–6 of that summary). To exercise any of these rights, submit a written request to 666kz's Data Protection Officer using the contact details in Section 12. We will acknowledge your request within five (5) business days and substantively respond within thirty (30) calendar days, as required by NPC regulations. Where a request requires additional time or information to fulfil, we will notify you of the extended timeline and the reason for it.

Where 666kz processes your personal data based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal. Withdrawal of consent for processing that is required for legal compliance purposes (e.g., KYC/AML) may necessitate account closure.

If you believe 666kz has not handled your personal data in accordance with the DPA, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

10.1 The 666kz Platform is not intended for, and does not knowingly collect personal data from, individuals under 21 years of age. The minimum age requirement for access to 666kz is 21 years, in accordance with PAGCOR regulations and Philippine law.

10.2 If 666kz becomes aware that personal data has been collected from a person under 21 years of age without the appropriate consent of a parent or guardian, it will take immediate steps to suspend the relevant account, delete the personal data concerned, and, where required, report the matter to relevant authorities.

10.3 Parents and guardians who believe their child may have accessed or registered on the 666kz Platform should contact support immediately using the contact details in Section 12.

11.1 666kz reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. The "Effective date" at the top of this Policy will be updated to reflect the date of the most recent revision.

11.2 Material changes to this Policy will be communicated to registered Players via SMS to the registered mobile number or through a prominent notice on the Platform, at least seven (7) days before the amended Policy takes effect. Your continued use of the 666kz Platform following notification of changes constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to 666kz's processing of your personal data, please contact 666kz's Data Protection Officer:

• Email: [email protected] (plain text — not a clickable link)
• Live chat: Available 24/7 through the 666kz Platform, with Tagalog and English-speaking agents

For complaints or escalations that remain unresolved after engaging 666kz's DPO, you may contact the National Privacy Commission of the Philippines through its official channels.