cy66 Privacy Policy
— Your Data, Protected

cy66 ("the Platform", "we", "us", "our") operates an internationally licensed offshore online gaming and sports betting service available at cy66.io. We are committed to protecting the privacy and personal information of every individual ("Player", "you", "your") who accesses, registers on, or otherwise interacts with our platform.

This Privacy Policy sets out in plain language what personal data cy66 collects, the purposes for which it is processed, the legal basis underpinning that processing, how long we retain it, who we share it with, and what rights you have over your own information. This policy applies to all Players using the cy66 platform from Bangladesh, including players located in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar, as well as any other individual who accesses the platform regardless of geographic location.

cy66 processes personal data responsibly and applies technical and organisational security measures proportionate to the sensitivity of the information handled. We do not sell personal data to third parties for commercial marketing purposes. All data processing activities at cy66 are carried out in accordance with the principles of purpose limitation, data minimisation, accuracy, storage limitation, and integrity.

cy66 collects personal data in several categories depending on the nature of your interaction with the platform. The categories of personal data we may collect include:

cy66 applies the principle of data minimisation: we collect only the data that is necessary for the specific, stated purpose. We do not collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, or health data, except where a Player voluntarily discloses such information in the context of a responsible gaming request (for example, disclosing a gambling-related health concern when requesting self-exclusion).

cy66 collects personal data through the following channels and mechanisms:

• Direct Registration: When you create a cy66 account, you voluntarily provide identity and contact data including your name, date of birth, email address, and mobile number.
• Account Use: As you use the platform — placing bets, playing casino games, making deposits or withdrawals — gaming activity data and financial data are generated and recorded automatically.
• KYC Verification Submissions: When you submit identity documents in response to a verification request, we collect and process the personal data contained within those documents.
• Payment Transactions: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or bank transfer, your payment provider transmits transaction reference data to cy66 for processing confirmation.
• Technical Automated Collection: When you access the cy66 platform, our servers and analytics tools automatically record technical data including your IP address, device identifiers, browser type, and session duration. See Section 7 for details on cookies.
• Customer Support Interactions: When you contact cy66 via email at [email protected] or through any in-platform support channel, we collect and retain the content of your communications to facilitate resolution of your query.
• Third-Party Game Providers: Our licensed game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may provide cy66 with aggregated game session data for dispute resolution and fairness auditing purposes.

cy66 uses the personal data it collects for the following specific purposes:

• Account Management: To create, maintain, and administer your cy66 player account, including processing registrations, password resets, and account preference updates.
• Service Delivery: To provide the core gaming and betting services you have requested, including processing bets, settling wagers, crediting winnings, and delivering casino game access.
• Payment Processing: To process deposits and withdrawals through your selected payment method (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank) and to maintain accurate financial records.
• Identity Verification (KYC): To verify your identity and confirm that you meet the eligibility requirements for platform use, including the minimum age requirement of 21 years.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, bonus abuse, and other forms of financial crime or platform abuse.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling behaviour, to enforce deposit limits and self-exclusion requests, and to proactively reach out to Players who may require responsible gaming support.
• Legal & Regulatory Compliance: To comply with applicable anti-money laundering (AML), know-your-customer (KYC), and data protection obligations under the laws of our licensing jurisdiction.
• Customer Support: To respond to your support queries, resolve disputes, and improve the quality of our customer service operations.
• Platform Analytics & Improvement: To analyse aggregated and anonymised usage data for the purpose of improving platform performance, game selection, user interface design, and overall service quality.
• Communications: To send you essential account notifications, transaction confirmations, security alerts, and — where you have provided consent — promotional communications about cy66 offers relevant to Bangladesh players.

cy66 processes personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is necessary to perform the contract between cy66 and the Player — including account registration, bet settlement, payment processing, and customer support — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC identity verification, AML record-keeping, and responding to lawful requests from competent authorities, is carried out on the basis of legal obligation.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, internal analytics, and improving service quality is carried out on the basis of cy66's legitimate interests, provided those interests are not overridden by the privacy rights and freedoms of individual Players.
• Consent: Where cy66 processes personal data for optional purposes — such as sending promotional communications or newsletters about cy66 bonuses, BPL/IPL promotions, or special seasonal offers — such processing is carried out on the basis of your freely given, informed, and specific consent. You may withdraw consent for marketing communications at any time by contacting [email protected].

cy66 shares personal data only in the limited circumstances described below. We do not disclose personal data beyond what is strictly necessary for each stated purpose:

• Licensed Game Providers: Your account identifier and game session data are shared with our licensed third-party game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) solely to facilitate game delivery and dispute resolution. These providers are contractually bound to process data only for authorised purposes.
• Payment Processors: Transaction reference data is shared with your chosen payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank) solely to process the specific deposit or withdrawal you have initiated.
• KYC & Identity Verification Partners: Where cy66 uses a third-party KYC verification service to validate identity documents, your verification data is shared with that provider under strict data processing agreements.
• Fraud Prevention & AML Services: Where required, transaction data and account activity may be shared with specialist fraud prevention or anti-money laundering screening services to protect the integrity of the platform.
• Legal & Regulatory Authorities: cy66 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by a lawful order, legal obligation, or where disclosure is necessary to protect the rights, property, or safety of cy66, its Players, or the general public.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of cy66 assets, personal data held by cy66 may be transferred to the successor entity, subject to equivalent privacy protections being maintained.

cy66 uses cookies and similar tracking technologies on the cy66.io platform to ensure the site functions correctly, to improve user experience, and to support security and analytics operations. A cookie is a small text file placed on your device when you access a website. The categories of cookies used by cy66 include:

• Strictly Necessary Cookies: These cookies are essential for the cy66 platform to function. They enable core features such as account login sessions, bet slip functionality, and page navigation. These cookies cannot be disabled without rendering the platform non-functional.
• Performance & Analytics Cookies: These cookies collect aggregated, anonymised data about how Players use the cy66 platform — including which pages are visited most frequently, how long sessions last, and which features are used — to help us improve platform performance and user experience.
• Security Cookies: These cookies support fraud detection and platform security by tracking login attempts, session integrity, and unusual activity patterns that may indicate unauthorised access attempts.
• Preference Cookies: These cookies remember your account preferences — such as display settings and language configuration — to deliver a more personalised experience on return visits.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to use the cy66 platform. For detailed guidance on managing cookies, consult your browser's help documentation.

cy66 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal and regulatory retention requirements. The following general retention periods apply:

• Active Account Data: Personal data associated with an active cy66 account is retained for the lifetime of the account plus a minimum of five (5) years following account closure, to satisfy AML and KYC regulatory record-keeping requirements.
• Financial Transaction Records: Records of deposits, withdrawals, and betting transactions are retained for a minimum of five (5) years from the date of the transaction to comply with financial record-keeping obligations.
• KYC Verification Documents: Identity documents submitted for verification purposes are retained for a minimum of five (5) years from the date of submission or from account closure, whichever is later.
• Customer Support Correspondence: Support communications are retained for a period of three (3) years from the date of the interaction, unless a longer retention period is required in connection with an ongoing dispute or legal matter.
• Marketing Consent Records: Records of marketing consent are retained for as long as the consent remains active and for a period of three (3) years following withdrawal of consent.
• Technical & Log Data: Server logs and technical access data are retained for a maximum of twelve (12) months unless required for a longer period in connection with an active security investigation.

Upon expiry of the applicable retention period, cy66 will securely delete or anonymise personal data so that it can no longer be attributed to any individual Player.

cy66 takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or alteration. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the cy66 platform is encrypted using 256-bit SSL/TLS protocols, ensuring that your personal and financial information cannot be intercepted in transit.
• Encrypted Password Storage: Account passwords are never stored in plain text. cy66 uses industry-standard cryptographic hashing algorithms to store password credentials securely.
• Access Controls: Access to personal data within cy66's internal systems is restricted on a strict need-to-know basis. Staff members are granted access only to the categories of data necessary for their specific operational role.
• Fraud Detection Systems: cy66 operates automated fraud detection and anomaly monitoring systems that flag unusual account activity, suspicious login patterns, and irregular transaction behaviour for review by our security team.
• Regular Security Audits: The cy66 platform and its underlying infrastructure undergo regular independent security assessments to identify and remediate vulnerabilities.
• Data Breach Response: In the event of a personal data breach that poses a risk to the rights and freedoms of Players, cy66 will take immediate remediation steps and notify affected individuals in accordance with applicable data protection obligations.

As a Player whose personal data is processed by cy66, you hold the following rights in relation to your personal information. To exercise any of these rights, contact cy66 at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data cy66 holds about you and to receive information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update certain account details directly through your account settings panel.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to cy66's legal and regulatory data retention obligations described in Section 8.
• Right to Restriction of Processing: You have the right to request that cy66 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while a legitimate interests objection is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of cy66's legitimate interests, including profiling. cy66 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

cy66 will respond to all verified data rights requests within thirty (30) days of receipt. In cases of complexity or high volume, this period may be extended by a further sixty (60) days, in which case we will notify you of the extension and the reason for the delay.

The cy66 platform is strictly intended for adults aged 21 years and above. cy66 does not knowingly collect, retain, or process personal data belonging to individuals under the age of 21. If we discover or are notified that an account has been registered by a person under 21 years of age, that account will be immediately suspended, all associated data reviewed, and the account permanently closed in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account on the cy66 platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". cy66 will investigate all such reports promptly and take appropriate action.

The cy66 platform may contain informational references to third-party game providers, payment services, or sports organisations (such as the ICC, BCB, and BPL governing bodies). cy66 is not responsible for the privacy practices of any third-party entity and does not control how such organisations collect, use, or protect personal data.

Where any third-party service is integrated with the cy66 platform — such as a game provider's software or a payment gateway — that provider's own privacy policy and data handling practices will apply to data processed within their systems. cy66 recommends that Players review the privacy policies of any third-party services they interact with independently of the cy66 platform. This Privacy Policy governs only the data processing activities carried out directly by cy66.

cy66 reserves the right to update, amend, or replace this Privacy Policy at any time. When material changes are made to this policy, the "Last Updated" date shown at the top of this page will be revised accordingly. Where changes are significant — such as the introduction of a new category of data processing or a change to data sharing practices — cy66 will take reasonable steps to notify registered Players via email or through an in-platform notification.

Your continued use of the cy66 platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the changes and your agreement to be bound by the updated terms. It is your responsibility to review this Privacy Policy periodically. If you have questions about any proposed or recent change to this policy, contact us at [email protected] before continuing to use the platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data cy66 holds about you, please contact our Data Support team. We are available 24 hours a day, 7 days a week, at Bangladesh Standard Time (BST, UTC+6).

Email: [email protected]

When contacting us about a data privacy matter, please include your registered cy66 username and a clear description of your request or concern. Use one of the following subject lines to ensure your enquiry is routed to the correct team:

• "Data Rights Request" — for access, rectification, erasure, portability, or objection requests
• "Marketing Opt-Out" — to withdraw consent for promotional communications
• "Minor Account Report" — to report a suspected underage account
• "Data Breach Report" — to report a suspected security incident affecting your account
• "Privacy Policy Query" — for general questions about this policy