Privacy Policy — How vd66 Collects, Uses, and Protects Your Data

1 Introduction & Scope

This Privacy Policy ("Policy") describes how vd66 ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects personal information provided by or collected from individuals ("you", "your", "the User") who access or use the vd66 website located at https://vd66.io and all associated services, games, betting markets, and features (collectively, "the Services").

vd66 is committed to protecting the privacy and security of all users of the Platform, including registered players based in Bangladesh. This Policy applies to all personal data collected through the website, mobile browsers, customer support interactions, payment processing flows, and any other channel through which you interact with vd66.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and any other document, this Policy shall govern with respect to data protection matters.

By accessing the Platform or creating an account, you confirm that you are at least 21 years of age and that you consent to the collection and processing of your personal data in accordance with this Policy.

2 Personal Data We Collect

vd66 collects personal data through several distinct channels. The categories of data we collect, and the circumstances in which they are collected, are set out below.

2.1 Data You Provide Directly

When you register an account, use the Services, or contact our support team, you may provide us with the following personal data:

• Identity data: Full legal name, date of birth, national identity card number or passport number (for verification purposes).
• Contact data: Email address, mobile phone number, and residential address (including district, city, and postal code).
• Account credentials: Username and encrypted password (we do not store passwords in plain text).
• Financial data: Payment method identifiers (e.g., registered bKash, Nagad, Rocket, or Upay mobile number), transaction reference numbers, deposit and withdrawal amounts.
• Verification documents: Copies of government-issued identity documents, utility bills, or bank statements submitted during Know Your Customer (KYC) verification.
• Support correspondence: Content of messages, complaints, and feedback submitted to our customer support team via email, live chat, or any other channel.

2.2 Data We Collect Automatically

When you access the Platform, our systems automatically collect certain technical and behavioural data:

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, games played, betting markets accessed, session start and end times, click-through paths, and feature interactions.
• Transaction logs: A complete record of all deposits, withdrawals, bets placed, and game outcomes associated with your account.
• Cookie and session data: As described in Section 6 of this Policy.

2.3 Data from Third Parties

In certain circumstances, vd66 may receive personal data about you from trusted third parties, including:

• Payment service providers (bKash, Nagad, Rocket, Upay) confirming the status of a deposit or withdrawal transaction.
• Identity verification services used to validate documents submitted during KYC.
• Fraud prevention and anti-money laundering screening services.
• Game providers (such as Evolution Gaming, Pragmatic Play, Spribe) who may share session data relevant to game outcome disputes or technical malfunction investigations.

3 How We Use Your Personal Data

vd66 uses your personal data for the following purposes. Where a legal basis applies, it is noted alongside each purpose (refer to Section 4 for a full explanation of legal bases).

vd66 will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your explicit consent.

4 Legal Basis for Processing

vd66 processes your personal data on one or more of the following legal bases:

• Contract performance: Processing is necessary to enter into or perform the contract between you and vd66 (i.e., providing the Services you have requested by registering an account and using the Platform).
• Legal obligation: Processing is necessary for vd66 to comply with applicable legal requirements, including anti-money laundering regulations, identity verification requirements, and record-keeping obligations.
• Legitimate interest: Processing is necessary for the purposes of vd66's legitimate business interests, provided those interests are not overridden by your rights and interests. This includes fraud prevention, platform security, responsible gaming monitoring, and service analytics. vd66 has conducted legitimate interest assessments for all processing activities in this category.
• Consent: Where processing is based on your consent (e.g., sending you promotional emails or bonus notifications), you have the right to withdraw that consent at any time by contacting our support team or updating your communication preferences in your account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5 Sharing Your Personal Data

vd66 does not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients, strictly to the extent necessary for the purposes described in this Policy:

• Payment service providers: bKash, Nagad, Rocket, and Upay, for the purpose of processing deposits and withdrawals. These providers receive only the transaction data required to complete the payment.
• Identity verification providers: Third-party KYC and document verification services contracted by vd66 to validate identity documents submitted during account verification.
• Game technology providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game studios whose content is hosted on or integrated with the vd66 platform. Game providers may receive session identifiers and bet data as part of normal game operation.
• Fraud and AML screening services: Specialist providers engaged to screen accounts and transactions against fraud databases and financial crime watchlists.
• IT infrastructure and hosting providers: Cloud hosting and managed services providers that store Platform data on secure, access-controlled infrastructure.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory direction, vd66 may disclose personal data to government bodies, law enforcement agencies, or financial intelligence units.

All third-party service providers with access to your personal data are bound by written data processing agreements requiring them to handle your data in accordance with applicable privacy standards and to use it solely for the purpose for which it was shared.

6 Cookies & Tracking Technologies

vd66 uses cookies and similar technologies (including local storage and session tokens) to operate the Platform effectively and to improve your experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during an active session, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Used to remember your preferences such as your preferred language, last-visited game category, and notification settings. Disabling these cookies may reduce personalisation features.
• Analytics cookies: Used to collect anonymised or pseudonymised data about how users navigate the Platform — including page views, session durations, and feature interaction rates. This data helps vd66 identify areas for improvement. Analytics data is processed in aggregate form and is not linked to individually identifiable users where avoidable.

vd66 does not use advertising cookies, retargeting pixels, or any third-party tracking technology designed to track your behaviour across other websites for advertising purposes.

You may manage cookie preferences through your browser settings. Note that blocking strictly necessary cookies will prevent core Platform functionality from operating correctly. Your browser's "Help" section provides instructions for managing cookies on your specific browser.

7 Data Security

vd66 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption on all data transmissions between your device and vd66 servers, ensuring that data cannot be intercepted in transit.
• Encryption at rest for sensitive stored data, including account credentials and identity documents.
• Access controls ensuring that internal access to personal data is limited to authorised personnel who require it to perform their job functions, on a strict need-to-know basis.
• Multi-factor authentication for administrative access to internal systems that hold personal data.
• Regular penetration testing and security audits conducted by qualified security professionals to identify and remediate vulnerabilities.
• Incident response procedures to detect, investigate, and respond to data security incidents in a timely manner.

Despite these measures, no system is entirely immune to security risks. In the event of a data breach that poses a risk to your rights and freedoms, vd66 will notify affected users promptly and take all reasonable steps to contain and remediate the incident.

You also play an important role in keeping your account secure. You must keep your login credentials confidential, use a strong and unique password, and notify vd66 immediately if you suspect unauthorised access to your account.

8 Data Retention

vd66 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, subject to any applicable legal retention requirements. The following retention periods apply:

• Active account data: Retained for the duration of your account's existence on the Platform, plus a post-closure period as described below.
• Account data following closure: Upon verified account closure, your personal profile data will be deleted or anonymised within 90 days, subject to the exceptions below.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction to comply with applicable anti-money laundering and financial record-keeping obligations. This retention obligation applies regardless of account closure.
• KYC and identity verification documents: Retained for a minimum of 5 years from the date of account closure or the last transaction, whichever is later, in accordance with applicable regulatory requirements.
• Support correspondence: Retained for 3 years from the date of the interaction, to support dispute resolution and quality assurance purposes.
• Analytics data: Anonymised analytics data may be retained indefinitely as it cannot be used to identify individual users.

Where personal data is retained beyond the standard deletion period due to a legal obligation, vd66 will restrict processing of that data to the minimum necessary to fulfil the legal purpose and will delete it promptly once that obligation has been discharged.

9 Your Rights Over Your Personal Data

As a user of the vd66 platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at the address provided in Section 13.

• Right of access: You have the right to request a copy of the personal data that vd66 holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update certain account details directly through your account settings dashboard.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that this right is subject to our legal retention obligations described in Section 8.
• Right to restrict processing: You may request that vd66 restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability: Where processing is based on your consent or contract performance and is carried out by automated means, you have the right to receive a structured, machine-readable copy of your personal data for the purpose of transferring it to another service.
• Right to object: You have the right to object to processing based on vd66's legitimate interest. vd66 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where the processing is necessary for the establishment or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before withdrawal.

vd66 will respond to all data rights requests within 30 days of receipt. Where a request is complex or numerous, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason within the initial 30-day period.

vd66 will not charge a fee to process a data rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied or the request may be declined.

10 Children & Minors

vd66 is strictly an adult platform. The Services are intended exclusively for individuals who are 21 years of age or older. vd66 does not knowingly collect personal data from anyone under the age of 21.

If vd66 discovers or reasonably suspects that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete all personal data collected from that individual, and reverse any financial transactions associated with the account to the extent practicable.

If you are a parent or guardian and believe that a minor in your care has created an account on vd66 or otherwise submitted personal data to us, please contact us immediately at the address in Section 13. We will investigate and take appropriate action without undue delay.

11 Third-Party Links & Services

The vd66 Platform may contain references to or integrations with third-party game providers and payment services whose privacy practices are governed by their own respective privacy policies. vd66 has no control over the data practices of these third parties beyond the contractual safeguards described in Section 5.

Specifically, when you play a game provided by a third-party studio such as Evolution Gaming, Pragmatic Play, Spribe, or others, a portion of your session data may be processed directly by that provider in accordance with their own privacy policy and data handling practices. vd66 encourages you to review the privacy policies of any third-party service providers whose services you access through the Platform.

Similarly, when you initiate a payment transaction through bKash, Nagad, Rocket, or Upay, the transaction is processed by that payment provider under their own terms and privacy policy. vd66 only receives confirmation of the transaction outcome and the reference number — we do not have access to your full payment account details or your usage history with those providers.

12 Updates to This Privacy Policy

vd66 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the Services we provide. The "Last Updated" date at the top of this document will be revised whenever material changes are made.

Where changes are material — meaning they significantly affect how your personal data is collected, used, or shared — vd66 will notify registered users via the email address associated with their account and/or by displaying a prominent notice on the Platform prior to the changes taking effect. The updated Policy will be effective from the date specified in the notice.

We encourage you to review this Policy periodically to stay informed about how vd66 protects your privacy. Continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use of the Platform and may request account closure by contacting our support team.

13 Contact & Privacy Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way vd66 handles your personal data, please contact our Data Protection team. All contact details below are for correspondence only and are not clickable links.

• Privacy Enquiries Email: [email protected]
• Subject Line (recommended): Privacy Policy Enquiry / Data Rights Request
• Platform: https://vd66.io
• Response Time: Within 30 days of receipt for data rights requests; within 5 business days for general privacy enquiries
• Support Hours: 24 hours a day, 7 days a week

If you are not satisfied with vd66's response to a privacy complaint, you have the right to escalate your concern to the appropriate data protection authority in your jurisdiction. vd66 will cooperate fully with any such authority in the investigation of a privacy complaint.