66zzapp Privacy Policy
At 66zzapp, your privacy is not an afterthought. This Privacy Policy explains in plain, formal terms exactly what personal data we collect from players in Bangladesh, how we use it, who we share it with, how long we keep it, and what rights you hold over your own information. Please read it alongside our Terms & Conditions.
Our Privacy Commitments at a Glance
The six principles below summarise how 66zzapp handles your personal data. They are not a substitute for the full policy below — please read each section in detail before using the Platform.
We collect only the personal data that is strictly necessary to operate your account, process transactions, verify your identity, and comply with applicable legal obligations. We do not collect data speculatively or for unrelated commercial purposes.
All data transmitted between your device and the 66zzapp Platform is protected by TLS/SSL encryption. Stored personal data is encrypted at rest and access is restricted to authorised personnel on a need-to-know basis only.
You have the right to access, correct, export, and request deletion of your personal data at any time. Submit a data subject request to [email protected] and we will respond within 30 days in accordance with this policy.
66zzapp does not sell, rent, or trade your personal data to any third party for their own marketing or commercial gain. Data shared with service providers is limited to what is operationally required and is governed by strict contractual obligations.
We use cookies and similar technologies for session management, security, and platform analytics. We do not deploy third-party advertising cookies or cross-site tracking pixels. You can manage cookie preferences through your browser settings at any time.
Personal data is held only for as long as necessary to fulfil the purposes for which it was collected, or as required by AML and financial recordkeeping obligations. Account data is typically retained for five years following account closure.
1. Data Controller & Contact Details
For the purposes of this Privacy Policy, the data controller responsible for the personal data of players who use the 66zzapp Platform is 66zzapp, operating the website at https://66zzapp.ws (the "Platform").
As data controller, 66zzapp determines the purposes for which personal data is collected and the means by which that data is processed. Any questions, requests, or complaints relating to the handling of your personal data should be directed to our dedicated privacy contact point:
Please include "Privacy Request" in the subject line of your email. We will acknowledge your request within 5 business days and provide a full response within 30 calendar days.
This Privacy Policy applies to all personal data collected from players registered on the Platform, including data collected through the website, any mobile-optimised interfaces, customer support channels, and communications sent by 66zzapp to registered players (such as promotional emails and account notifications).
This policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall contractual framework governing your relationship with 66zzapp.
- Platform: 66zzapp.ws
- Contact: [email protected]
- Market: Bangladesh
- Policy language: English
- Effective: 1 January 2026
2. Personal Data We Collect
66zzapp collects personal data from you directly (when you register or contact us), automatically (through your use of the Platform), and from third parties (such as payment processors and identity verification services). The categories of data we collect are described below.
2.1 Registration & Account Data
When you create a 66zzapp account, we collect the following information:
- Full legal name (as it appears on your National Identity Card or passport).
- Date of birth (to verify that you meet the 18+ age requirement).
- Registered mobile phone number (used for OTP verification and account security).
- Email address (where provided; used for account communications and recovery).
- Username and encrypted password hash.
- Account creation date and time (Bangladesh Standard Time, UTC+6).
2.2 Identity Verification (KYC) Data
Before processing any withdrawal, we are required to verify your identity. During the KYC process we may collect:
- Scanned or photographed copy of your Bangladesh National Identity Card (NID), passport, or driving licence.
- A proof-of-address document (utility bill, bank statement, or government correspondence) issued within the past three months.
- A selfie or live photo to confirm that the submitted identity document belongs to the account holder.
- Proof of ownership of the payment method used for deposits (e.g., a bKash or Nagad account screenshot).
2.3 Financial Transaction Data
Each time you deposit or withdraw funds, we record:
- Transaction amount (in BDT), date, time, and transaction reference number.
- Payment method used (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, Visa, Mastercard).
- Partial payment account identifier (e.g., the last four digits of a card or the registered mobile number associated with a mobile money account).
- Running account balance history for AML audit purposes.
2.4 Gameplay & Betting Data
We maintain records of your gambling activity on the Platform, including:
- Games played, bet amounts, win/loss outcomes, and session durations.
- Sports markets wagered on (e.g., BPL cricket, IPL, T20 World Cup, volleyball).
- Bonus credits claimed, wagering progress, and bonus expiry events.
- Self-imposed responsible gaming limits and any self-exclusion events.
2.5 Technical & Device Data
When you access the Platform, our servers automatically record certain technical information:
- IP address and approximate geolocation (country/city level only).
- Device type, operating system version, and browser type.
- Session timestamps, pages visited, and in-page interactions (for security and performance monitoring).
- Cookie identifiers and session tokens (see Section 6 for full cookie details).
2.6 Customer Support Communications
When you contact our support team via email, we retain a copy of the correspondence, including the content of your message, any attachments you send, your contact details, and the date and time of the communication. These records are used to resolve your query and to improve our service quality.
You are not obliged to provide all requested data, but failure to supply mandatory registration or KYC information will prevent us from opening or maintaining your account, or from processing withdrawal requests.
3. How We Use Your Data
66zzapp uses the personal data described in Section 2 for the following purposes. Each purpose is linked to a legal basis for processing, which is detailed in Section 4 below.
Account Management & Service Delivery
We use your registration data and account credentials to create and maintain your player account, authenticate your identity at login, and provide you with access to the full range of Platform services, including the games lobby, sportsbook, and cashier.
Payment Processing & Fraud Prevention
Financial transaction data is used to process deposits and withdrawals accurately, to reconcile account balances, and to detect and prevent fraudulent payment activity, including chargeback fraud, money laundering, and unauthorised account access. We use automated risk-scoring tools to flag unusual transaction patterns for manual review by our compliance team.
Identity Verification & AML Compliance
KYC data is used to verify that you are who you say you are, that you are at least 18 years of age, and that your use of the Platform is consistent with applicable anti-money-laundering (AML) obligations. We are required by law to retain KYC and financial transaction records for a minimum of five years.
Responsible Gaming & Player Protection
Gameplay and betting data is used to monitor for signs of problem gambling behaviour, to enforce self-imposed responsible gaming limits, and to identify accounts that may require outreach from our player protection team. This use of data is a core part of our commitment to safe and responsible gambling.
Platform Security & Technical Operations
Technical and device data is used to maintain the security and integrity of the Platform, to detect and prevent bot activity and account takeovers, to diagnose and resolve technical faults, and to monitor Platform performance and uptime. IP addresses are also used to detect access from jurisdictions where the Platform is unavailable.
Customer Support
Support correspondence is used to resolve your queries, to investigate complaints, and to train and quality-assure our support team. We do not use support communications for marketing purposes without your explicit consent.
Marketing & Promotions
Where you have given your consent, we may use your contact details (email or mobile number) to send you information about bonuses, seasonal promotions (such as Eid offers, BPL cricket season campaigns, and Pohela Boishakh specials), and other 66zzapp news. You may withdraw this consent at any time by contacting us at [email protected] or by using the unsubscribe link in any promotional email.
4. Legal Basis for Processing
The table below sets out the legal basis on which 66zzapp processes each category of personal data. We rely on one or more of the following grounds: contractual necessity, legal obligation, legitimate interests, and consent.
| Processing Purpose | Data Category | Legal Basis |
|---|---|---|
| Account creation & management | Registration data, credentials | Contractual necessity — required to enter into and perform our agreement with you |
| Payment processing | Financial transaction data | Contractual necessity; legal obligation (financial recordkeeping) |
| KYC identity verification | KYC documents, selfie, proof of address | Legal obligation (AML / age verification requirements) |
| Fraud detection & AML screening | Transaction data, device data, IP address | Legal obligation; legitimate interests (protecting the Platform and other players) |
| Responsible gaming monitoring | Gameplay data, betting history | Legitimate interests (player protection); legal obligation |
| Platform security & technical ops | Device data, session logs, IP address | Legitimate interests (maintaining Platform integrity) |
| Customer support | Support correspondence | Contractual necessity; legitimate interests (service improvement) |
| Marketing & promotions | Contact details (email, mobile) | Consent (you may withdraw at any time) |
5. Third-Party Data Sharing
66zzapp does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients where it is necessary to provide our services or to comply with our legal obligations:
Payment Service Providers
To process your deposits and withdrawals, we share relevant financial transaction data with our payment processing partners, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card processing networks (Visa / Mastercard). These providers receive only the data necessary to complete the specific transaction and are contractually prohibited from using your data for any other purpose.
Identity Verification Partners
We may use third-party KYC and identity verification service providers to assist in verifying the documents you submit during the KYC process. These providers process your identity documents on our behalf under strict data processing agreements and are not permitted to retain your documents after verification is complete.
Game Content Providers
The games available on the 66zzapp Platform are supplied by licensed third-party game studios, including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, your session data (including bet amounts and game outcomes) is processed by the relevant game provider's servers for the purpose of conducting the game and confirming the outcome. Game providers do not receive your name, contact details, or payment information.
Legal & Regulatory Disclosures
We may disclose your personal data to law enforcement authorities, financial intelligence units, courts, or other regulatory bodies where we are required to do so by law, court order, or binding regulatory instruction. Such disclosures are made only to the extent required and are not subject to prior notification to you where notification would prejudice the legal process.
Business Transfers
In the event that 66zzapp undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, we will notify registered players via email at least 30 days before their data is transferred and the new entity's privacy policy takes effect.
Data Processing Agreements: All third-party service providers who process personal data on 66zzapp's behalf are required to sign a data processing agreement confirming that they will handle your data securely, use it only for the agreed purpose, and delete it when the processing relationship ends.
7. Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The table below provides an overview of our standard retention periods by data category.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | AML compliance; dispute resolution |
| KYC identity documents | 5 years from account closure | Legal obligation under AML requirements |
| Financial transaction records | 5 years from transaction date | Financial recordkeeping; AML audit trail |
| Gameplay & betting history | 3 years from account closure | Dispute resolution; responsible gaming review |
| Customer support emails | 3 years from last correspondence | Service quality; complaint investigation |
| Technical / device / IP logs | 12 months from collection | Security monitoring; fraud detection |
| Marketing consent records | Until consent is withdrawn + 1 year | Proof of consent for regulatory purposes |
| Self-exclusion records | Duration of exclusion + 5 years | Re-registration prevention; player protection |
When data reaches the end of its applicable retention period, it is securely deleted or anonymised in a manner that prevents re-identification. Anonymised aggregate data (such as overall Platform usage statistics) may be retained indefinitely for analytical purposes, as it no longer constitutes personal data.
If you submit a data deletion request under Section 8 below, we will delete your personal data as promptly as possible, subject to our right to retain data that we are legally required to keep for the retention periods specified above. In such cases, we will inform you which data categories must be retained and the applicable retention period.
To request deletion of your personal data, contact us at [email protected] with the subject line "Data Deletion Request". We will confirm the categories of data deleted and identify any data we are legally required to retain.
8. Your Privacy Rights
As a 66zzapp player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within 30 calendar days of receiving your request.
-
Right of Access: You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format (JSON or CSV) upon request.
-
Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. Name changes must be supported by an updated identity document.
-
Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal retention obligations described in Section 7.
-
Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved, or where you have objected to processing and we are considering your objection.
-
Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a portable copy of your data in a structured format so that you can transfer it to another service provider.
-
Right to Object: You may object to processing carried out on the basis of legitimate interests — including automated profiling for fraud detection — and to the use of your data for direct marketing purposes. Marketing objections are actioned immediately; other objections are reviewed within 30 days.
-
Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
-
Right Not to Be Subject to Automated Decisions: You have the right to request human review of any automated decision that produces a legal or similarly significant effect on you, such as a withdrawal hold triggered by automated fraud-detection systems.
Email [email protected] with the subject line "Data Subject Request — [Right Type]". Include your registered mobile number or username so we can locate your account. We will verify your identity before processing the request and will respond within 30 calendar days. Complex requests may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.
Exercising your privacy rights is free of charge. We may charge a reasonable administrative fee only in cases of manifestly unfounded or excessive requests, in which case we will explain the fee before proceeding. You always have the right to withdraw a request if you do not wish to incur a fee.
9. Data Security Measures
66zzapp implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The key measures we employ are described below.
Encryption in Transit and at Rest
All data transmitted between your device and the 66zzapp Platform is encrypted using TLS 1.2 or higher. Sensitive personal data stored in our databases — including KYC documents, identity data, and financial records — is encrypted at rest using AES-256 encryption. Password credentials are stored as salted cryptographic hashes and are never held in plain text.
Access Controls
Access to personal data within 66zzapp's internal systems is governed by role-based access controls (RBAC). Employees and contractors are granted access only to the data categories required to perform their specific job functions. All internal access to personal data is logged and subject to periodic access reviews. Privileged administrative access requires multi-factor authentication.
Network Security
The Platform is hosted on infrastructure protected by enterprise-grade firewalls, intrusion detection systems (IDS), and distributed denial-of-service (DDoS) mitigation. Our systems are monitored 24 hours a day, 7 days a week, by automated security tools that flag anomalous activity for immediate review.
Data Breach Response
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, 66zzapp will notify affected players via their registered email address without undue delay, and in any case within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the steps we have taken or propose to take to address the breach.
Staff Training
All 66zzapp staff who handle personal data receive mandatory data protection training upon joining the organisation and refresher training on an annual basis. Staff are required to adhere to our internal data handling policies and are subject to disciplinary action in the event of a breach of those policies.
- TLS 1.2+ encryption in transit
- AES-256 encryption at rest
- Salted password hashing
- Role-based access controls
- 24/7 intrusion monitoring
- DDoS mitigation infrastructure
- 72-hour breach notification
- Annual staff data protection training
If you suspect that your 66zzapp account has been compromised, contact us immediately at [email protected]. We will suspend the account pending investigation and assist you in securing access.
10. Updates to This Policy
66zzapp reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When we make material changes to this policy, we will notify registered players by email to their registered address at least 7 days before the changes take effect and will post a prominent notice on the Platform homepage.
Non-material changes — such as typographical corrections, clarifications that do not alter the substance of the policy, or updates to contact details — may be made without advance notice. The "Effective Date" displayed at the top of this page will always reflect the date of the most recent revision.
Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with the updated policy, you must cease using the Platform and request account closure by contacting us at [email protected] before the amendment's effective date.
We recommend that you review this Privacy Policy periodically. Archived versions of previous policies are available upon request by emailing [email protected] with the subject line "Privacy Policy Archive Request".
- Current version: January 2026
- Review frequency: Annual minimum
- Material changes notified by email
- Past versions available on request
- Queries: [email protected]
Explore 66zzapp With Confidence
Now that you understand how 66zzapp protects your personal data, explore our full game library — from BPL cricket betting and slots to live casino tables. 18+ only. Please gamble responsibly.
Explore 66zzapp Casino 66zzapp LoginReview our Terms & Conditions for the full rules governing your use of the 66zzapp Platform, including bonus terms, account obligations, and dispute resolution procedures.
Visit our Responsible Gaming page to learn about self-exclusion tools, deposit limits, and support resources available to players across Bangladesh. 18+ only.
Have questions about your account or our data practices? Our FAQ page covers the most common queries from 66zzapp players in Dhaka, Chittagong, Sylhet, and across Bangladesh.