tf666 Privacy Policy — How We Protect Your Personal Data

1. Who We Are

tf666 ("tf666", "we", "us", "our") operates the online betting and casino platform accessible at https://tf666.io (the "Platform"). tf666 serves players primarily across Bangladesh, including in Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, and Cox's Bazar, offering cricket sportsbook, live casino, slots, and related gaming services.

tf666 acts as the data controller in respect of personal data collected through the Platform. As data controller, tf666 is responsible for determining the purposes for which and the means by which your personal data is processed. This Privacy Policy sets out, in full transparency, how that processing occurs and what rights you hold as a data subject.

For all privacy-related enquiries, data access requests, and complaints, tf666 can be reached via the contact details in Section 15 of this document.

2. Data We Collect

tf666 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify that you are aged 21 or above).
• Nationality and country of residence.
• National identity card number, passport number, or other documentary identifier supplied during KYC verification.

2.2 Contact Data

• Email address registered to your tf666 account.
• Bangladesh mobile phone number registered in your own name.
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet) and postal code.

2.3 Financial & Transaction Data

• Payment method identifiers (e.g., bKash mobile number, Nagad account reference, Rocket wallet ID, Upay account, Visa or Mastercard last four digits and expiry date).
• Deposit and withdrawal amounts, dates, and transaction reference numbers.
• Account balance history and betting/gaming transaction records.
• Source-of-funds documentation where requested as part of enhanced due diligence.

2.4 Technical & Device Data

• IP address at the time of registration and each login session.
• Device type, operating system, browser type, and version.
• Device fingerprint identifiers used for fraud detection and duplicate account prevention.
• Session timestamps, page views, and in-Platform navigation data.

2.5 Behavioural & Usage Data

• Betting history including sports markets, stakes, odds, and outcomes.
• Casino and slot game activity including game titles played, session duration, and wager values.
• Bonus utilisation records, wagering progress, and promotional participation.
• Responsible gaming tool usage including deposit limits set, cooling-off periods requested, and self-exclusion records.

2.6 Communications Data

• Records of live chat conversations with tf666 support agents.
• Email correspondence submitted to [email protected].
• Feedback, complaints, and dispute records.

3. How We Collect Your Data

tf666 collects personal data through the following channels and mechanisms:

3.1 Direct Collection

The majority of personal data tf666 holds about you is provided directly by you during the account registration process, KYC verification submissions, deposit and withdrawal transactions, communications with our support team, and participation in promotions or surveys.

3.2 Automated Collection

When you access and use the tf666 Platform, certain data is collected automatically through server logs, session tracking systems, and browser-based cookies. This includes your IP address, device identifiers, session timestamps, and in-Platform behaviour data. This data is collected to ensure the security, performance, and integrity of the Platform and to detect fraud or abuse.

3.3 Third-Party Sources

tf666 may receive limited personal data from third-party sources, including:

• Payment Processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, Visa, and Mastercard to reconcile deposit and withdrawal records.
• Identity Verification Partners: Where tf666 uses a third-party KYC verification service, that service may return a verification status or risk score associated with your identity documents.
• Fraud Prevention Services: Industry-standard fraud intelligence databases used to screen accounts and transactions for known risk indicators.

4. Why We Use Your Data (Purposes of Processing)

tf666 processes your personal data for the following specific and documented purposes:

tf666 will not process your personal data for any purpose not listed in this table without first notifying you and, where required, obtaining your explicit consent.

5. Legal Basis for Processing

Each processing activity carried out by tf666 rests on one of the following recognised legal bases:

• Contractual Necessity: Processing required to create and manage your account, verify your identity, execute deposits and withdrawals, and deliver the betting and gaming services you have contracted to receive.
• Legal Obligation: Processing required to comply with applicable anti-money laundering obligations, age verification requirements, tax reporting duties, and other mandatory legal requirements.
• Legitimate Interests: Processing undertaken to protect the Platform against fraud and abuse, to maintain the security and integrity of our systems, to monitor for problem gambling indicators as part of responsible gaming obligations, and to improve Platform performance through analytics — provided that these interests do not override your fundamental rights and freedoms.
• Consent: Processing for optional purposes such as sending you promotional emails, personalised game recommendations, and marketing communications. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

6. Sharing Your Data

tf666 does not sell, rent, or trade your personal data. Data sharing with third parties is strictly limited to the following categories of recipient, each of whom is bound by contractual data protection obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and associated banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) receive the minimum data necessary to process your deposit and withdrawal transactions.
• KYC and Identity Verification Providers: Third-party services engaged by tf666 to verify identity documents and perform age verification checks receive only the specific document data and identity fields required for the verification task.
• Game Technology Providers: Studio partners including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and anonymised player identifiers to deliver their games. These providers do not receive your full name, payment details, or contact information.
• Fraud and Risk Management Services: Industry-standard fraud prevention platforms that help tf666 identify and block suspicious activity, duplicate accounts, and money-laundering patterns.
• Legal and Regulatory Authorities: Where tf666 is required by applicable law, court order, or regulatory direction to disclose personal data to government bodies, law enforcement agencies, or financial regulators, tf666 will comply with such obligations and will notify you of the disclosure where legally permitted to do so.
• IT Infrastructure and Hosting Providers: Secure server and cloud infrastructure providers engaged by tf666 to host the Platform and store data. These providers act as data processors under written agreements and may not use your data for their own purposes.

7. Cookies & Tracking Technologies

The tf666 Platform uses cookies and similar tracking technologies to ensure proper Platform functionality, maintain your login session, detect fraud, and gather anonymised analytics data. The main categories of cookies used by tf666 are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, odds format selection, and responsible gaming limits you have applied. Disabling these cookies will not break the Platform but will result in your preferences not being remembered between sessions.
• Performance and Analytics Cookies: Collect anonymised data on how users interact with the Platform — which pages are visited most, how long sessions last, and where users encounter errors. This data is used solely to improve Platform performance and user experience. No individual is identifiable from this data.
• Fraud Detection Cookies: Used alongside device fingerprinting tools to identify suspicious behavioural patterns, duplicate account activity, and bot-driven access attempts. These operate as strictly necessary security tools.

You may manage cookie preferences through your browser settings. Blocking all cookies may impair your ability to log in to your tf666 account or access certain Platform features. tf666 does not use third-party advertising or retargeting cookies.

8. Data Security

tf666 implements a layered technical and organisational security programme to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and tf666 servers is encrypted using industry-standard TLS protocols.
• Encrypted Data at Rest: Sensitive personal data fields including payment identifiers, identity document references, and passwords are encrypted at rest using AES-256 or equivalent standards.
• Password Hashing: Account passwords are never stored in plain text. tf666 uses industry-standard one-way hashing algorithms with per-account salting.
• Access Controls: Access to personal data within the tf666 organisation is restricted on a strict need-to-know basis. Staff who access player data receive mandatory data protection training and are bound by confidentiality obligations.
• Multi-Layer Firewalls: The Platform's server infrastructure is protected by enterprise-grade firewalls and intrusion detection systems.
• Regular Security Audits: tf666 conducts periodic internal security reviews and engages independent security professionals for penetration testing.
• Incident Response: tf666 maintains a documented security incident response procedure. In the event of a data breach that poses a risk to your rights and freedoms, tf666 will notify affected Members within a reasonable timeframe and will take immediate remedial action.

Despite these measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying tf666 promptly if you suspect any unauthorised access to your account.

9. Data Retention

tf666 retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted from tf666 active systems or irreversibly anonymised such that it can no longer be associated with any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

10. Your Rights

As a data subject, you hold the following rights in respect of the personal data that tf666 processes about you. tf666 is committed to honouring these rights promptly and without unnecessary obstacle:

• Right of Access: You may request a copy of all personal data tf666 holds about you (a Subject Access Request). tf666 will respond within 30 days of receiving a valid request.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data tf666 holds about you. Minor corrections (e.g., correcting a mobile number) can often be handled directly through your account settings or by contacting support.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where you object to processing based on legitimate interests. Note that certain data must be retained for legal compliance purposes (see Section 9) and cannot be erased on request during the applicable retention period.
• Right to Restriction of Processing: You may request that tf666 restrict the processing of your data in certain circumstances — for example, while a rectification request is being verified, or while an objection is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that tf666 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object to processing based on tf666's legitimate interests at any time, on grounds relating to your particular situation. tf666 will cease processing unless it can demonstrate compelling legitimate grounds that override your rights. You may also object to direct marketing at any time without providing a reason.
• Right to Withdraw Consent: Where tf666 processes your data based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

To exercise any of the rights above, contact tf666 via live chat or email at [email protected] with the subject line "Data Rights Request — [Your Username]". tf666 may request proof of identity before processing your request to ensure data is not disclosed to an unauthorised party.

11. Children & Minors

The tf666 Platform is strictly restricted to individuals aged 21 years or older. tf666 does not knowingly collect or process personal data relating to persons under the age of 21. The age verification procedures applied during account registration are designed specifically to prevent access by minors.

If tf666 becomes aware that personal data has been collected from a person under the age of 21, all associated account data will be immediately and permanently deleted, the account will be closed, and any funds held in the account will be returned to the original payment method after the deduction of any winnings derived from underage play in accordance with the Terms and Conditions.

If you believe a minor may have registered an account on tf666, please contact us immediately at [email protected] so that we can investigate and take prompt action.

12. International Data Transfers

In order to deliver the tf666 Platform to players in Bangladesh and to operate the technical infrastructure that underpins it, your personal data may be transferred to and processed in countries outside Bangladesh. This occurs specifically in the context of cloud hosting, third-party KYC services, and game studio integrations, some of which operate server infrastructure in jurisdictions outside South Asia.

Wherever personal data is transferred internationally, tf666 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. These safeguards include contractual data protection clauses binding the recipient to obligations consistent with recognised data protection standards, and, where applicable, reliance on adequacy decisions or equivalent transfer mechanisms.

tf666 does not transfer your personal data to jurisdictions that lack adequate data protection frameworks without first implementing the contractual and technical safeguards described above.

13. Third-Party Links

The tf666 Platform does not contain links to third-party websites or external platforms. All navigation within the Platform remains within the tf666 domain (https://tf666.io). If any third-party content is presented within the Platform — such as game interfaces delivered by studio partners like Pragmatic Play, Evolution Gaming, or Spribe — those interfaces operate within embedded frames and the data practices of those studios are governed by their own privacy policies. tf666 is not responsible for the data practices of third-party game providers in respect of data collected independently through their own interfaces.

14. Updates to This Privacy Policy

tf666 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new Platform features, or evolving legal and regulatory requirements. The version number and last-updated date at the top of this document indicate the current revision in effect.

Material changes to this Privacy Policy — particularly those that affect the legal basis for processing, the categories of data collected, or your rights as a data subject — will be communicated to active Members via the registered email address or mobile number at least 14 days before they take effect. For non-material clarifications and minor updates, the revised policy will be published on this page without advance individual notification.

Continued use of the tf666 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with a material change, you may close your account by contacting tf666 support prior to the effective date of the change.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or tf666's data processing practices, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly on the tf666 Platform — the fastest way to reach our team for urgent data concerns.
• Email: [email protected] — for formal data rights requests, complaints, and detailed privacy enquiries. Please use the subject line "Privacy Enquiry — [Your Username]" to ensure your message is routed to the correct team. Response time: within 2–4 hours during normal business hours (Bangladesh Standard Time, UTC+6).

tf666 takes all privacy-related communications seriously. If you submit a formal data rights request, you will receive an acknowledgement within 5 business days and a substantive response within 30 calendar days. Where a request is complex or involves a large volume of data, tf666 may extend this period by a further 30 days, in which case you will be notified of the extension and the reasons for it.

If you are not satisfied with tf666's response to a privacy concern, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. Players in Bangladesh may also seek guidance from consumer protection bodies or legal advisors familiar with digital services and data privacy law.