Privacy Policy — 66iii
Online Betting Platform

Introduction

66iii (hereinafter referred to as "we", "us", "our", or "the Platform") operates the online betting and gaming service accessible at https://66iii.cam. We are committed to protecting the personal data of every individual who registers an account, visits the Platform, or interacts with our customer support services.

This Privacy Policy ("Policy") describes how 66iii collects, uses, stores, shares, and protects personal data in connection with the provision of our services to players primarily located in Indonesia. It also sets out the rights you hold in respect of your personal data and how you may exercise those rights.

By creating a 66iii account or using our Platform in any capacity, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. This Policy is incorporated into and should be read alongside our Terms & Conditions.

Definitions

• "Personal Data" — Any information that relates to an identified or identifiable living individual. This includes, but is not limited to, your name, email address, date of birth, residential address, payment account details, and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" — 66iii, being the entity that determines the purposes and means by which your personal data is processed.
• "Data Processor" — A third party that processes personal data on behalf of 66iii under a contractual arrangement and in accordance with our instructions.
• "Player" / "User" — Any individual who has registered an account on the 66iii Platform or otherwise interacts with our services.
• "KYC Data" — Identity and address verification documents submitted by a Player as part of the Know Your Customer process, including government-issued ID and proof of address.
• "Cookies" — Small text files placed on your device by the Platform for the purposes of session management, analytics, and personalisation.
• "Sensitive Data" — A subset of personal data warranting heightened protection, including financial account details, identity document numbers, and any information that could be used to identify a Player's political or religious views.

Data We Collect

66iii collects personal data across several categories depending on how you interact with the Platform. The table below summarises the main categories of data we hold:

We do not knowingly collect special-category sensitive data such as health information, biometric identifiers, or racial/ethnic origin beyond what may appear incidentally in identity documents submitted during KYC. Where such data does appear, it is held solely for verification purposes and subject to the same security standards as all other personal data.

How We Collect Data

66iii collects personal data through the following means:

• Direct Interactions: Data you provide voluntarily when registering an account, completing KYC, making deposits or withdrawal requests, contacting customer support, or participating in promotions.
• Automated Technologies: Data collected automatically when you visit the Platform, including via cookies, web beacons, pixel tags, and server-side logging of IP addresses, session durations, and clickstream data.
• Payment Processors: Transaction confirmation data received from Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
• Identity Verification Partners: Data returned by third-party KYC and fraud-screening services we engage to validate the authenticity of documents you submit.
• Analytics Providers: Aggregated and pseudonymised usage data provided by web analytics tools that help us understand how Players navigate the Platform.
• Third-Party Sources: In limited circumstances, we may receive information about you from fraud-prevention databases or publicly available sources where it is necessary to protect the integrity of the Platform or comply with legal obligations.

How We Use Your Data

66iii uses your personal data for the following purposes:

1. Account Management: To create, maintain, and administer your 66iii account, including verifying your identity, processing login requests, and managing your account preferences and settings.
2. Service Delivery: To provide access to our sports betting markets — including BRI Liga 1 fixtures, EPL, La Liga, Champions League, and international events — our live dealer casino products by Evolution Gaming, togel (Indonesia's traditional numbers lottery) draws, and slot titles from Pragmatic Play and Pocket Games Soft.
3. Financial Transactions: To process deposits and withdrawals accurately and securely, reconcile your account balance, and maintain transaction records for accounting and audit purposes.
4. KYC & Regulatory Compliance: To verify that you meet the eligibility requirements set out in our Terms & Conditions (including the 21+ age restriction), and to comply with applicable anti-money-laundering and know-your-customer obligations.
5. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, collusion, and other activity that threatens the integrity of the Platform or the safety of our Players.
6. Responsible Gaming: To monitor wagering patterns that may indicate problem gambling behaviour, to facilitate the activation of player-protection tools, and to respond to self-exclusion requests promptly and effectively.
7. Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance in connection with your account or any transaction on the Platform.
8. Marketing Communications: Where you have given your explicit consent, to send you information about promotions, bonuses, seasonal offers (such as Idul Fitri special rewards or Ramadhan cashback campaigns), and new product features that may be of interest to you. You may withdraw this consent at any time.
9. Platform Improvement: To analyse usage patterns and technical performance data in order to improve the user experience, fix bugs, and develop new features.
10. Legal Obligations: To comply with any court order, regulatory direction, or other legal requirement to which 66iii is subject, including the disclosure of data to law-enforcement authorities where required by law.

Legal Basis for Processing

66iii processes your personal data only where a valid legal basis exists. The primary legal bases we rely upon are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract we have entered into with you when you created your 66iii account — including operating your account, processing transactions, and delivering our services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering obligations, age-verification requirements, and responses to lawful requests from public authorities.
• Legitimate Interests: Processing necessary for the legitimate interests of 66iii or a third party, including fraud prevention, network security, improving our services, and direct marketing to existing Players — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis for processing (primarily for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent can be made through your account settings or by contacting us at [email protected].

Sharing Your Data

66iii does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly to the extent necessary for the purposes set out in this Policy:

• Payment & Banking Partners: Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) require transactional data to execute deposits and withdrawals on your behalf.
• KYC & Identity Verification Providers: Specialist third-party services that assist us in verifying the authenticity of identity documents and screening against fraud and sanctions databases.
• Game Content Providers: Suppliers such as Pragmatic Play, Evolution Gaming, Pocket Games Soft, NetEnt, and Microgaming may receive pseudonymised player session data in order to deliver their game products and maintain their own licensing compliance.
• Technology & Infrastructure Partners: Cloud hosting providers, content delivery networks, and cybersecurity vendors that process data on our behalf under strict data-processing agreements and are prohibited from using that data for their own purposes.
• Analytics Providers: Web analytics services that receive pseudonymised, aggregated usage data to help us understand Platform performance. These providers do not receive personally identifiable information.
• Legal & Regulatory Authorities: Courts, law-enforcement agencies, and regulatory bodies where disclosure is required by a binding legal obligation or to protect the rights, property, or safety of 66iii, its Players, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of the assets of 66iii, personal data may be transferred to the acquiring entity, which will be required to honour the commitments made in this Policy.

Data Retention

66iii retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account and for a period of five (5) years following permanent account closure, to comply with anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or the date of account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, consistent with standard financial record-keeping obligations.
• Customer Support Communications: Retained for three (3) years from the date of the most recent interaction, to support dispute resolution and quality assurance processes.
• Marketing Preferences & Consent Records: Retained for the duration of your account and for two (2) years following account closure or consent withdrawal, as evidence of your consent decision.
• Technical & Usage Data: Retained in identifiable form for up to twelve (12) months, after which it may be aggregated and anonymised for analytical purposes.

When personal data is no longer required, it is securely deleted or anonymised in accordance with our internal data-disposal procedures. Where deletion is not immediately possible due to technical constraints, the data is isolated from active processing and scheduled for deletion at the earliest practicable opportunity.

Data Security

66iii implements a multi-layered security programme to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our technical and organisational security measures include:

• 256-Bit SSL/TLS Encryption: All data in transit between your browser or device and the 66iii Platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encryption at Rest: Sensitive personal data stored in our databases — including financial account details and KYC document files — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and receive regular data-protection training.
• Two-Factor Authentication (2FA): All 66iii administrative systems require multi-factor authentication for access. Players are strongly encouraged to enable 2FA on their own accounts.
• Intrusion Detection & Monitoring: Our systems are subject to continuous automated monitoring for suspicious activity, unauthorised access attempts, and anomalous data transfers.
• Penetration Testing: We conduct regular third-party security assessments and penetration tests of our Platform infrastructure.
• Incident Response: In the event of a data breach that is likely to result in a risk to your rights or freedoms, 66iii will notify affected Players promptly and take immediate remedial action.

Despite these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials. If you suspect your account has been compromised, please contact our support team immediately at [email protected].

Cookies & Tracking Technologies

66iii uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cannot be disabled without impairing core Platform functionality.
• Performance & Analytics Cookies: Collect pseudonymised data about how Players use the Platform — such as which pages are visited most frequently and where error messages are encountered — to help us improve the user experience.
• Functionality Cookies: Remember your preferences, such as your language setting, preferred game categories, and notification preferences, to provide a more personalised experience.
• Targeting & Marketing Cookies: Used, with your consent, to deliver promotional content relevant to your interests. If you have opted out of marketing communications, these cookies will not serve personalised promotional content to you.

You can manage or disable non-essential cookies through your browser's settings at any time. Please note that disabling certain cookies may affect the functionality and performance of the Platform. For detailed guidance on managing cookies in your specific browser or device, please refer to your browser's help documentation.

Your Rights

As a Player whose personal data is processed by 66iii, you have the following rights in respect of that data. To exercise any of these rights, please contact us using the details in Section 15:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is being used, who it has been shared with, and for how long it will be retained.
• Right to Rectification: You may ask us to correct any personal data that is inaccurate or to complete any data that is incomplete. For account-critical data (such as your legal name or date of birth), rectification requests will be processed following identity re-verification.
• Right to Erasure ("Right to Be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where there is no overriding legal basis for continued processing. This right is subject to our legal retention obligations — we cannot delete data that we are required by law to retain.
• Right to Restrict Processing: You may ask us to suspend the processing of your data while a rectification or objection request is assessed, or where you contest the accuracy of the data held.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that we provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You may object at any time to the processing of your personal data where that processing is based on our legitimate interests, including profiling and direct marketing. Where you object to direct marketing, we will cease that processing immediately.
• Rights in Relation to Automated Decision-Making: Where 66iii makes decisions about you solely through automated means (such as automated fraud-flag systems), you have the right to request human review of that decision and to contest its outcome.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to all verified rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

Minors & Age Restriction

66iii is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes a mandatory age declaration, and we enforce KYC-based age verification as a condition of processing any withdrawal.

If we become aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the associated account, reverse any deposits made, and permanently delete that individual's personal data from our systems, subject to any legal obligation to retain evidence of the underage access event for a defined period.

If you are a parent or guardian and believe that your child may have accessed 66iii without your knowledge, please contact us immediately at [email protected] so that we can take prompt action.

International Data Transfers

66iii operates as an internationally oriented platform, and some of the third-party service providers we engage — including cloud infrastructure providers, KYC verification partners, and game content suppliers — may be located in jurisdictions outside Indonesia. Where personal data is transferred internationally, 66iii ensures that appropriate safeguards are in place, which may include:

• Entering into data-processing agreements that incorporate internationally recognised standard contractual clauses providing equivalent data-protection guarantees.
• Transferring data only to countries or entities that are recognised as providing an adequate level of data protection by relevant standards.
• Implementing supplementary technical measures, such as end-to-end encryption of transferred data, where required by risk assessment.

By using 66iii, you acknowledge that your personal data may be processed in countries outside Indonesia. In all cases, the protections described in this Privacy Policy apply regardless of where your data is processed.

Changes to This Policy

66iii reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The revised Policy will be published at https://66iii.cam/privacy-policy with an updated "Last Updated" date at the top of the page.

Where changes are material — for example, where we introduce a new purpose for processing your data or a new category of third-party recipient — we will notify you by email to your registered address and display a prominent notice upon your next login, giving you an opportunity to review the changes before continuing to use the Platform.

Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data-subject rights, or want to submit a complaint about how 66iii has handled your personal data, please contact our Privacy team using the details below:

• Email: [email protected] — please include "Privacy Request" in the subject line for faster routing. Typical response time: 2–6 hours.
• Live Chat: Available 24 hours a day, 7 days a week via the chat interface in your Account dashboard. For formal privacy requests, please follow up by email to ensure a written record is created.

We will acknowledge all formal privacy requests within 48 hours and aim to provide a full response within thirty (30) days. In the event that your complaint is not resolved to your satisfaction, you have the right to escalate your complaint to the appropriate data-protection supervisory authority in your jurisdiction.