ap66 Privacy Policy — How We Handle Your Personal Data

1. Introduction

This Privacy Policy ("Policy") is issued by ap66 ("ap66", "we", "us", "our") and describes how we collect, use, store, share, and protect the personal data of individuals ("Player", "User", "you", "your") who register for, access, or use the ap66 online casino and sports betting platform available at ap66.io, including all associated mobile interfaces, support channels, and promotional communications.

ap66 is committed to handling your personal data responsibly and in accordance with internationally recognised privacy principles. This Policy has been written in plain English so that every player — including those based in Dhaka, Chittagong, Sylhet, Khulna, and across Bangladesh — can clearly understand their rights and our obligations without requiring specialist legal knowledge.

By registering an ap66 account or by continuing to use the ap66 platform after this Policy takes effect, you acknowledge that you have read and understood the data practices described herein. If you do not agree with any part of this Policy, you should cease using the ap66 platform and contact us at [email protected] to close your account and request data deletion where applicable.

2. Personal Data We Collect

ap66 collects only the personal data that is necessary for the legitimate purposes described in this Policy. The main categories of personal data we process are as follows:

2.1 Identity and Registration Data

When you register an ap66 account, we collect your full legal name, date of birth, gender, and nationality. This data is required to create your account, verify that you meet the minimum age requirement of 21 years, and comply with our know-your-customer (KYC) obligations under ap66's international gaming licence.

2.2 Contact Data

We collect your email address, mobile phone number, and residential address (including city, district, and postal code). This data is used to communicate with you about your account, process your transactions, respond to support requests, and — where you have opted in — send you promotional communications about ap66 offers relevant to your interests.

2.3 Financial and Payment Data

To process deposits and withdrawals, we collect the details of your chosen payment method. For bKash, Nagad, Rocket, and Upay users, this includes the mobile wallet number registered in your name. For bank card users, we collect the card number (stored in masked format after initial verification), expiry date, and billing name. Full card numbers and CVV codes are never stored on ap66 servers — all card processing is handled by our PCI-DSS-compliant payment processing partners.

2.4 Verification Documents

To satisfy KYC and anti-money-laundering (AML) obligations, ap66 may request copies of identity documents such as your national identity card (NID), passport, or driving licence, as well as proof of address documents such as a utility bill or bank statement. These documents are stored securely and accessed only by authorised compliance personnel.

2.5 Transaction and Gaming Data

We maintain detailed records of all financial transactions processed through your ap66 account, including deposits, withdrawals, bonuses credited, and wagering activity. We also record game session data including game type, session start and end times, bet amounts, and outcomes. This data is essential for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.

2.6 Technical and Device Data

When you access the ap66 platform, we automatically collect certain technical data including your IP address, device identifier, browser type and version, operating system, screen resolution, and time zone. This data helps us maintain platform security, detect fraud, enforce geographic restrictions, and optimise the platform for different devices and connection types commonly used in Bangladesh.

2.7 Usage and Behavioural Data

We collect information about how you interact with the ap66 platform, including the pages and features you visit, the games you play, the duration of your sessions, and the sequence of actions you take during a session. This data is used in aggregate to improve the platform and in individual form to support responsible gaming monitoring and fraud detection.

3. How We Collect Your Personal Data

ap66 collects personal data through the following primary channels:

• Direct collection at registration: The information you provide when completing the ap66 registration form, including name, date of birth, contact details, and preferred payment method.
• During account use: Data generated through your ongoing use of the platform, including transaction records, game session logs, support communications, and responsible gaming tool activations.
• Verification processes: Documents and information you submit in response to KYC or enhanced due-diligence requests from our compliance team.
• Automated technical collection: Data collected automatically by our servers and analytics tools each time you access the platform, including IP addresses, device fingerprints, and session metadata.
• Cookies and tracking technologies: Data collected through first-party cookies and similar technologies as described in Section 7 of this Policy.
• Third-party sources: In limited circumstances, ap66 may receive data about you from third-party identity verification services or fraud prevention databases where necessary to verify your identity or assess risk. ap66 will always have a lawful basis for receiving such third-party data.

4. Legal Basis for Processing Your Personal Data

ap66 processes personal data only where a valid legal basis exists for doing so. The legal bases we rely on are:

• Contractual necessity: Processing that is necessary to perform the contract we have with you as a registered player — for example, creating your account, processing your deposits and withdrawals, and settling your bets.
• Legal obligation: Processing that ap66 is required to carry out to comply with applicable law and regulatory requirements — for example, identity verification under KYC obligations, transaction record-keeping for AML compliance, and age verification to prevent underage gambling.
• Legitimate interests: Processing carried out in ap66's legitimate interests or the legitimate interests of our players, provided those interests are not overridden by your privacy rights — for example, fraud detection, platform security, responsible gaming monitoring, and internal analytics to improve the service.
• Consent: Where none of the above bases apply, ap66 relies on your freely given, specific, informed consent — for example, sending optional marketing communications about bonuses and promotions. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

5. How We Use Your Personal Data

ap66 uses your personal data for the following purposes, each of which is tied to a lawful basis as described in Section 4:

• Account creation and management: Setting up your ap66 account, maintaining your account record, enabling login, and facilitating account-level settings and preferences.
• Identity verification and KYC: Confirming that you are who you say you are, that you are aged 21 or over, and that the payment methods you use are registered in your own name.
• Payment processing: Facilitating deposits to and withdrawals from your ap66 account via your chosen payment method — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard.
• Fraud and financial crime prevention: Monitoring transactions and betting patterns for indicators of money laundering, identity fraud, account takeover, and other financial crime. ap66 has AML obligations under its international gaming licence and takes these seriously.
• Responsible gaming: Monitoring your betting activity for indicators of problem gambling behaviour and activating responsible gaming interventions (such as deposit limit alerts or cool-off suggestions) where appropriate. This is a core regulatory obligation for ap66 as a licensed operator.
• Customer support: Responding to your support requests, resolving disputes, investigating complaints, and communicating account-related notices.
• Platform security: Detecting and preventing unauthorised access attempts, bot activity, and other security threats to the ap66 platform and to individual player accounts.
• Legal and regulatory compliance: Meeting our obligations under ap66's international gaming licence, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records as required by applicable law.
• Platform improvement and analytics: Analysing aggregated usage data to understand how players interact with the ap66 platform and to inform decisions about new features, game selection, and user experience improvements.
• Marketing communications (consent only): Sending you emails or push notifications about ap66 bonuses, promotions, new game launches, and seasonal offers relevant to the Bangladesh market — but only where you have explicitly opted in to receive such communications.

6. Data Sharing and International Transfers

ap66 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the limited circumstances described below:

6.1 Service Providers and Data Processors

ap66 uses carefully selected third-party service providers to help operate the platform. These include payment processing partners (to facilitate bKash, Nagad, Rocket, Visa, and Mastercard transactions), identity verification providers (to carry out KYC checks), game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, who may collect limited technical data during game sessions), cloud infrastructure providers, and customer support platform providers.

All third-party service providers who process personal data on ap66's behalf are required to enter into binding data processing agreements, under which they are contractually prohibited from using your data for any purpose other than providing their contracted service to ap66, and are required to apply security standards equivalent to those described in this Policy.

6.2 Legal and Regulatory Disclosures

ap66 may disclose personal data to competent regulatory authorities, law enforcement agencies, courts, or other public bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of ap66, our players, or the public. Where permitted by law, ap66 will notify affected players of any such disclosure.

6.3 Business Transfers

In the event that ap66 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, player data may be transferred to the acquiring entity as part of that transaction. ap66 will provide reasonable advance notice to affected players before personal data is transferred to a new data controller, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

6.4 International Data Transfers

As an internationally licensed operator, ap66 may transfer personal data to countries outside Bangladesh for processing by service providers. All such transfers are carried out under appropriate safeguards, including standard contractual clauses or equivalent transfer mechanisms, to ensure that your personal data receives a level of protection consistent with this Policy regardless of where it is processed.

7. Cookies and Tracking Technologies

ap66 uses cookies and similar tracking technologies on the ap66 platform to enable core functionality, improve your experience, and maintain platform security. The main types of cookies we use are:

• Strictly necessary cookies: These cookies are essential for the ap66 platform to function. They enable session management (keeping you logged in during a game session), load balancing, and basic security functions. These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: These cookies remember your preferences — such as your preferred language, last-played game category, and display settings — so you do not need to re-enter them each time you visit. You may disable these via your browser settings, but doing so may affect the personalisation features of the platform.
• Analytics cookies: ap66 uses first-party analytics tools to understand how players navigate the platform, which features are used most frequently, and where players encounter difficulties. The data collected is processed in aggregate and does not identify individual players by name. You may opt out of analytics cookies by adjusting your browser settings.
• Security cookies: These cookies are used to detect and mitigate fraud, bot activity, and account takeover attempts. They record technical signals about your device and browsing pattern to distinguish legitimate players from automated threats.

ap66 does not use third-party advertising cookies or tracking pixels that share your data with external advertising networks. All cookies used on the ap66 platform are either set by ap66 directly or by our contracted service providers operating under strict data processing agreements.

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging into your ap66 account or participating in game sessions.

8. Data Security

ap66 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, destruction, or alteration.

• Encryption in transit: All data transmitted between your device and the ap66 platform is encrypted using TLS 1.2 or higher (SSL). The presence of the padlock icon in your browser address bar confirms that your connection to ap66 is encrypted.
• Encryption at rest: Sensitive personal data stored on ap66 servers — including identity documents, financial data, and KYC records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within ap66 is restricted to authorised personnel who require it for specific operational purposes. All internal access to player data is logged and subject to regular audit.
• Two-factor authentication: ap66 offers optional two-step verification (OTP) for player accounts and enforces multi-factor authentication for all staff with access to production systems and player data.
• Penetration testing: ap66's systems are subject to regular independent security assessments and penetration testing. Critical vulnerabilities identified through testing are remediated within defined SLA periods.
• Incident response: ap66 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to player rights and freedoms, ap66 will notify affected players and, where required, the relevant regulatory authority within the timeframes mandated by applicable law.

9. Data Retention

ap66 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The specific retention periods for each data category are summarised in the table in Section 2 above and detailed below:

• Identity, contact, and verification data: Retained for the duration of your active account and for a minimum of five years following account closure, to meet KYC record-keeping obligations under ap66's gaming licence and applicable AML regulations.
• Financial and transaction data: Retained for the duration of your active account and for a minimum of seven years following account closure, in line with standard financial record-keeping requirements applicable to licensed gaming operators.
• Technical and usage data: Retained for a rolling period of 13 months from the date of collection, after which it is aggregated and anonymised or deleted.
• Marketing preference data: Retained until you withdraw consent to marketing communications, plus one additional year to maintain a suppression record confirming that your opt-out preference is respected.
• Support correspondence: Retained for three years from the date of the last communication in a support thread, or longer where the correspondence relates to an unresolved dispute or ongoing investigation.

When a retention period expires, personal data is securely deleted from ap66's live systems and backup infrastructure. Where full deletion is technically impractical within a given timeframe (for example, due to backup rotation cycles), the data is isolated, flagged for deletion, and not used for any further processing until deletion is complete.

10. Your Privacy Rights

As a player using the ap66 platform, you have the following rights in relation to your personal data. ap66 is committed to honouring these rights promptly and without unnecessary friction. To exercise any of the rights below, please contact [email protected] with your registered username and a clear description of your request.

• Right of access: You have the right to request a copy of the personal data ap66 holds about you, along with information about how it is used and shared. ap66 will provide this information within 30 days of receiving a valid request.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data. For straightforward corrections (such as a misspelled name), you can update certain details directly through your account settings. For changes to core identity data, ap66 may require supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where the data was processed unlawfully. Please note that ap66 may be required to retain certain data for legal and regulatory reasons even where an erasure request is made, as described in Section 9.
• Right to restriction of processing: You have the right to request that ap66 restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data, or where you have objected to processing and ap66 is assessing whether its legitimate interests override your rights.
• Right to data portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data that is carried out on the basis of ap66's legitimate interests. ap66 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where ap66 relies on your consent as the legal basis for processing (for example, for marketing communications), you may withdraw that consent at any time by clicking "Unsubscribe" in any marketing email, by updating your communication preferences in your account settings, or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

11. Marketing Communications

ap66 may send you promotional emails, SMS messages, or push notifications about bonuses, new game releases, seasonal promotions (such as offers tied to Eid, Pohela Boishakh, or BPL cricket season), and other ap66 services — but only where you have given explicit opt-in consent to receive such communications at the time of registration or subsequently through your account settings.

You may opt out of marketing communications at any time using any of the following methods:

• Clicking the "Unsubscribe" link at the bottom of any marketing email sent by ap66.
• Replying "STOP" to any marketing SMS message sent by ap66.
• Updating your communication preferences in the Notifications section of your ap66 account settings.
• Contacting ap66 support at [email protected] with a request to opt out of all marketing communications.

Once you opt out, ap66 will process your opt-out request within 5 business days. You may continue to receive transactional and account-related communications (such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts) even after opting out of marketing, as these are necessary for the management of your account and are not subject to marketing consent requirements.

12. Children and Minors

The ap66 platform is strictly intended for adults aged 21 and above. ap66 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the ap66 registration process, and additional identity document checks may be required where ap66 has reason to doubt that a player meets the minimum age requirement.

If ap66 becomes aware that personal data has been collected from a player who is under 21 years of age, ap66 will immediately suspend the relevant account, refund any deposits made (net of any withdrawals already processed, subject to investigation), delete the personal data of the underage individual, and, where required by applicable law, notify the relevant authority.

13. Amendments to This Privacy Policy

ap66 may update this Privacy Policy from time to time to reflect changes in our data practices, changes to applicable law or regulatory requirements, or changes to the services we provide. All amendments will be published on this page at ap66.io/privacy-policy with an updated effective date shown at the top of the document.

Where an amendment represents a material change to how ap66 processes your personal data — for example, a new category of data being collected, a new sharing arrangement with a third party, or a change in the legal basis for a key processing activity — ap66 will notify registered players by email at least 14 days before the change takes effect. Continued use of the ap66 platform after the effective date of an amendment constitutes acceptance of the updated Policy.

ap66 encourages all players to review this Privacy Policy periodically to stay informed about how their personal data is being handled. The current version of the Policy is always available at ap66.io/privacy-policy.

14. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how ap66 has handled your personal data, please contact us using the details below. All privacy-related correspondence is handled by ap66's dedicated compliance and data protection team.

ap66 aims to resolve all privacy concerns informally and directly. If you are not satisfied with ap66's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection or gaming regulatory authority in the jurisdiction under which ap66 holds its international gaming licence.

ap66's support team is available around the clock via the live chat function on the ap66 platform and via email at [email protected]. Response times for privacy-related enquiries are typically within 2 business days for initial acknowledgement and within 30 calendar days for full resolution.