Privacy Policy

1 Overview

This Privacy Policy ("Policy") describes how tk66y ("tk66y", "We", "Us", "Our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "member", "user") who register for, access, or otherwise interact with the tk66y online betting and casino platform available at tk66y.io.

tk66y is committed to handling all personal data responsibly and transparently, in accordance with applicable data protection principles. This Policy is intended to give you a clear and complete picture of our data practices so that you can make fully informed decisions about your use of the platform.

This Policy applies to all personal data collected through the tk66y website, any associated mobile-optimised interfaces, email communications, live chat and support interactions, and all other channels through which you interact with tk66y. It does not apply to third-party websites or services that may be linked from tk66y — those services operate under their own separate privacy policies.

This Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the tk66y platform.

2 Data Controller

For the purposes of this Privacy Policy, the data controller — that is, the entity that determines the purposes and means of processing your personal data — is tk66y, the operator of the platform accessible at tk66y.io.

All data protection enquiries, rights requests, complaints, and correspondence relating to this Policy should be directed to our dedicated data protection contact:

tk66y takes its obligations as a data controller seriously. We maintain internal records of data processing activities, conduct periodic privacy impact assessments for high-risk processing operations, and review this Policy at least annually to ensure it remains accurate and up to date.

3 Data We Collect

tk66y collects personal data from you directly (when you register, complete forms, or contact support), automatically (through your use of the platform), and occasionally from third parties (such as identity verification providers and payment processors). The categories of personal data we collect are set out below.

3.1 Registration and Account Data

• Full legal name
• Date of birth (used for age verification — 21+ requirement)
• Email address
• Mobile phone number
• Residential address (city, district, postal code)
• Username and encrypted password
• Preferred language and currency (Bangladeshi Taka / BDT)
• Referral source (how you heard about tk66y, where applicable)

3.2 Identity Verification (KYC) Data

• Government-issued photo ID (National Identity Card, passport, or driving licence)
• Proof of address document (utility bill, bank statement dated within 90 days)
• Selfie or facial verification image (where required for enhanced verification)
• Source-of-funds documentation (where required by compliance thresholds)

3.3 Financial and Transaction Data

• bKash, Nagad, Rocket, or Upay mobile wallet identifiers (account numbers)
• Bank account details for bank transfer channels (Dutch-Bangla Bank, City Bank, BRAC Bank)
• Masked card numbers for Visa and Mastercard transactions
• Deposit amounts, withdrawal amounts, transaction timestamps, and reference numbers
• Account balance history and transaction ledger

3.4 Betting and Gaming Activity Data

• Bet history (sport, market, event, stake amount, odds, outcome, settlement)
• Casino game history (game title, provider, session duration, stake, result)
• Bonus and promotion participation history
• Responsible gaming limit settings (deposit limits, loss limits, session time limits)
• Self-exclusion or cooling-off requests and their effective dates

3.5 Technical and Usage Data

• IP address and approximate geolocation (city/region level)
• Device type, operating system, and browser version
• Session start and end timestamps
• Pages visited, features accessed, and clickstream data within the platform
• Error logs and crash reports
• Cookie and tracking technology identifiers (see Section 9)

3.6 Communications Data

• Content of live chat, email, and support ticket correspondence with tk66y staff
• Survey responses and feedback submissions
• Records of any complaints or disputes raised and their resolution

4 How We Use Your Data

tk66y processes personal data only for specific, defined purposes. The table below provides a clear mapping of each processing purpose to the categories of data used.

tk66y does not use automated decision-making processes that produce legal or similarly significant effects on members without human review. Where automated systems flag an account for review (for example, due to unusual activity patterns), a qualified member of our compliance team will conduct a manual assessment before any action affecting your account is taken.

5 Legal Basis for Processing

tk66y processes personal data on the following legal bases, which may apply individually or in combination depending on the specific processing activity:

5.1 Contractual Necessity

Much of the processing described in this Policy is necessary to perform the contract between you and tk66y — specifically, to operate your account, process deposits and withdrawals, settle bets, and deliver the services you have requested. Without this processing, we cannot provide the platform to you.

5.2 Legal Obligation

tk66y is subject to legal obligations relating to identity verification, age verification, anti-money laundering (AML), counter-terrorism financing (CTF), and record retention. Processing your KYC documents, transaction records, and compliance-related data is required by applicable law, not merely a business choice.

5.3 Legitimate Interests

In some cases, tk66y processes personal data in pursuit of its legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Examples include fraud detection, platform security monitoring, responsible gaming analytics, and aggregate platform improvement analysis. We balance our interests against your rights when relying on this basis.

5.4 Consent

Where processing is based on your consent — most notably for marketing communications and optional personalisation features — we will always ask for your consent clearly and specifically before that processing begins. You may withdraw your consent at any time without it affecting the lawfulness of any processing carried out before withdrawal. Withdrawing marketing consent does not affect your access to the platform or any of its core features.

6 Data Sharing and Disclosure

tk66y does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your data only in the specific, controlled circumstances described below.

6.1 Service Providers and Technology Partners

tk66y works with carefully selected third-party service providers who process personal data on our behalf as data processors. These include identity verification providers, payment gateway operators (covering bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing), cloud hosting providers, game software providers (such as Evolution Gaming, Pragmatic Play, Spribe, and Ezugi), customer support platform operators, and cybersecurity service providers. All processors are bound by data processing agreements that restrict their use of your data to the specific services they provide to tk66y.

6.2 Legal and Regulatory Disclosure

tk66y may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are required to do so by applicable law, a valid court order, or a lawful regulatory directive. We will, where permitted by law, attempt to notify affected members of such disclosures.

6.3 Fraud Prevention and Security

In cases of suspected fraud, money laundering, or platform security breaches, tk66y may share relevant personal data with fraud prevention agencies, financial intelligence units, or other platforms within our partner network to prevent further harm. Such sharing is conducted on the basis of legal obligation or legitimate interests in preventing financial crime.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of tk66y's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected members in advance of such a transfer and will ensure that the receiving entity is bound by privacy obligations at least as protective as those in this Policy.

7 Data Retention

tk66y retains personal data only for as long as is necessary for the purposes for which it was collected, taking into account applicable legal retention requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data cannot be immediately deleted due to technical constraints (for example, within backup archives), it will be isolated from active processing systems until the next scheduled deletion cycle.

8 Data Security

tk66y takes the security of your personal data extremely seriously. We implement and maintain a comprehensive set of technical and organisational security measures designed to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include:

• Encryption in transit: All data exchanged between your browser or device and our servers is encrypted using TLS 1.3 with 256-bit AES encryption. The tk66y website enforces HTTPS across all pages.
• Encryption at rest: Sensitive data fields — including passwords, payment identifiers, and KYC documents — are stored in encrypted form using industry-standard algorithms. Passwords are hashed and salted using bcrypt; they are never stored in plain text.
• Access controls: Access to personal data within tk66y's systems is restricted on a strict need-to-know basis using role-based access controls (RBAC). Access by staff is logged and subject to regular audit review.
• Two-factor authentication (2FA): All tk66y internal staff accounts require two-factor authentication. Members are strongly encouraged to enable 2FA on their own accounts from within the security settings panel.
• Intrusion detection and monitoring: tk66y operates 24/7 network and application monitoring with automated intrusion detection systems to identify and respond to suspicious activity in real time.
• Penetration testing: We conduct regular third-party penetration testing of the tk66y platform to identify and remediate security vulnerabilities before they can be exploited.
• Staff training: All tk66y staff who handle personal data receive mandatory data protection and information security training on joining the organisation and at least annually thereafter.

9 Cookies & Tracking Technologies

tk66y uses cookies and similar tracking technologies (such as web beacons and local storage objects) on its platform to deliver core functionality, maintain your session, analyse usage patterns, and — where you have provided consent — personalise your experience. The following categories of cookies are used:

9.1 Strictly Necessary Cookies

These cookies are essential for the operation of the tk66y platform. They enable you to log in securely, navigate between pages without losing your session state, and use features such as the bet slip and account dashboard. These cookies cannot be disabled without significantly impairing your ability to use the platform. No consent is required for strictly necessary cookies.

9.2 Performance and Analytics Cookies

We use analytics cookies to understand how members interact with the tk66y platform — for example, which pages are visited most frequently, where users encounter errors, and how long sessions typically last. This data is aggregated and anonymised before analysis and is used solely to improve the platform experience. Analytics cookies require your consent before being set.

9.3 Functionality Cookies

Functionality cookies remember your preferences — such as your selected sport category, notification settings, and display preferences — so that the platform behaves consistently across sessions. These cookies enhance your experience but are not strictly necessary for core functionality.

9.4 Cookie Duration

Session cookies expire when you close your browser. Persistent cookies remain on your device for a defined period (up to 13 months for analytics cookies; up to 30 days for most functionality cookies) or until you delete them manually. You may clear cookies at any time through your browser settings.

10 Your Data Rights

As a member of the tk66y platform, you hold a number of rights in relation to your personal data. tk66y is committed to honouring these rights in a timely and transparent manner. Your rights are as follows:

• Right of Access: You have the right to request a copy of the personal data that tk66y holds about you, along with information about how it is being processed. We will respond to access requests within 30 days.
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update many account details directly from your account settings panel.
• Right to Erasure ("Right to Be Forgotten"): Subject to our legal retention obligations (see Section 7), you may request that we delete your personal data. We will assess all erasure requests against our retention requirements and delete data that is no longer required for a lawful purpose.
• Right to Restrict Processing: In certain circumstances — for example, if you contest the accuracy of data we hold or object to a particular processing activity — you may request that we pause processing of your data while the matter is resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive a structured, commonly used, machine-readable copy of your personal data for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. You also have an absolute right to object to your data being used for direct marketing purposes at any time.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. As noted in Section 4, tk66y does not make such decisions without human review.

11 Protection of Minors

tk66y strictly prohibits access to or use of its platform by anyone under the age of 21. Our platform is designed and intended exclusively for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21.

During the registration process, all applicants are required to confirm that they are aged 21 or over. tk66y further verifies age through its KYC identity verification process, which is mandatory for all members before withdrawal processing commences. Accounts found to belong to individuals under 21 will be closed immediately, and any funds held will be handled in line with our anti-fraud procedures.

If you believe that a minor has registered on the tk66y platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate the report promptly and take all appropriate action. We recommend that households with minors use parental control tools and content filtering software to prevent access to online gambling platforms.

12 International Data Transfers

tk66y's primary data infrastructure is hosted in secure data centres serving the South and Southeast Asia region to minimise latency for Bangladeshi members and to keep data geographically proximate to its members wherever commercially feasible. However, some of our service providers and technology partners — including game software providers such as Evolution Gaming, Pragmatic Play, and Spribe — operate global infrastructure that may involve the transfer of certain categories of data to servers located outside Bangladesh.

Where personal data is transferred to a jurisdiction that does not offer an equivalent level of data protection to Bangladesh, tk66y ensures that appropriate safeguards are in place. These safeguards include binding contractual clauses in data processing agreements that obligate recipient entities to handle data in a manner consistent with the principles set out in this Policy, and security standards equivalent to those applied by tk66y itself.

By using the tk66y platform and consenting to this Privacy Policy, you acknowledge and agree to the transfer of your personal data to the countries and jurisdictions described above, subject to the safeguards outlined in this section.

13 Changes to This Privacy Policy

tk66y reserves the right to update or am end this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. When we make material changes to this Policy, we will notify all registered members via email to the address associated with their account and will display a prominent notice on the tk66y platform for a period of at least 14 days before the updated Policy takes effect.

For minor or non-material changes — such as typographical corrections, clarifications that do not alter the substance of our data practices, or updates to contact details — we may update the Policy without prior notice, though the revised effective date at the top of this page will always reflect the most recent update.

Your continued use of the tk66y platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should close your account and cease using the platform before the updated Policy takes effect. Historical versions of this Policy are available on request by contacting our support team.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which tk66y processes your personal data, please do not hesitate to get in touch with us. Our privacy team is available to assist you in English, seven days a week.

We aim to acknowledge all privacy-related communications within 5 business days and to resolve substantive requests within 30 days. If you are not satisfied with our response to a data rights request or a privacy complaint, you may have the right to escalate your complaint to a relevant data protection authority in your jurisdiction.

tk66y values the trust you place in us by sharing your personal data, and we are committed to earning and maintaining that trust through transparent, responsible, and secure data handling practices at every level of our organisation.