mm666 Privacy Policy – How We Protect Your Data in Pakistan

This Privacy Policy is issued by mm666 ("mm666", "we", "us", "our") and applies to all persons who access, browse or use the mm666 online casino platform at mm666.run ("the Platform"), including registered players, visitors who browse without registering, and persons who contact mm666 customer support.

mm666 is Pakistan's premier online casino, built specifically for Pakistani players. The platform is operated for the exclusive use of players accessing from Pakistan, and all payment processing is conducted in Pakistani Rupees (PKR) through Pakistan-based payment infrastructure including Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and Visa/Mastercard bank debit cards.

By using the mm666 platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any part of this policy, you should not use the platform.

mm666 collects personal data through several channels: information you provide directly when registering or contacting support, information generated automatically when you use the platform, and information received from payment processors when you make a deposit or withdrawal. The following table sets out the categories of data we collect and the purpose for which each category is collected.

Every use of your data at mm666 has a specific, documented purpose. We do not use your data for any purpose not listed here, and we do not use it beyond what is necessary for the stated purpose. The primary uses of personal data collected at mm666 are as follows:

• Account management: Creating and maintaining your mm666 account, processing your login and authentication, and keeping your account details updated.
• Payment processing: Processing deposits to your account and withdrawals to your registered payment method in PKR. Transaction records are required for financial compliance and dispute resolution.
• Identity verification: Verifying your age and identity as required before processing withdrawal requests and as part of our anti-money laundering (AML) and Know Your Customer (KYC) obligations.
• Fraud prevention and security: Detecting and preventing fraudulent activity, unauthorised account access, money laundering, and abuse of promotions. Your technical data (IP address, device fingerprint) is used for this purpose.
• Responsible gaming: Monitoring gameplay patterns that may indicate problem gambling behaviour, proactively contacting players where our monitoring identifies potential risk, and applying and enforcing responsible gaming controls you have activated.
• Customer support: Handling your support queries, complaints and disputes. Support transcripts are retained for the purposes of quality assurance and dispute resolution.
• Platform improvement: Using aggregated, anonymised behavioural data to improve the platform's performance, game selection and user experience. Individual player data is not used for this purpose in identifiable form.
• Marketing communications: Sending you promotional emails and notifications about offers and new games, where you have opted in to receive such communications. You can opt out at any time.

mm666 processes your personal data on the following legal bases, which align with internationally recognised data protection principles and the data protection framework applicable to our operations:

• Contract performance: Processing necessary to provide you with the services you have signed up for — account management, payment processing, game access and customer support. Without this processing, we cannot provide the service.
• Legal obligation: Processing required to comply with our AML, KYC and responsible gaming obligations, including age verification and suspicious transaction reporting. We have no discretion over this processing.
• Legitimate interests: Processing for fraud prevention, security monitoring and platform improvement, where our legitimate interest in operating a secure and well-functioning platform does not override your privacy interests.
• Consent: Processing for marketing communications, where you have given us explicit consent by opting in. This consent can be withdrawn at any time without affecting any other aspect of your account.

All financial transactions on the mm666 platform are denominated in Pakistani Rupees (PKR) and processed through Pakistan-based payment infrastructure. This is a deliberate and important part of how mm666 handles player data — keeping payment processing local significantly reduces the complexity of cross-border data flows and keeps your financial information within the regulatory environment you're familiar with.

When you make a deposit via Easypaisa or JazzCash, the transaction is initiated through the respective mobile wallet provider's own API. Your full wallet credentials (PIN, full account number) are never transmitted to or stored on mm666's servers. mm666 receives a transaction confirmation token from the payment provider, which is recorded in your account ledger as evidence of the deposit. The token contains a transaction reference and amount but no sensitive credential data.

Visa and Mastercard debit card transactions are processed by a PCI-DSS Level 1 certified payment processor. Full card numbers are never stored by mm666. The processor returns a payment token to mm666 for each transaction, which is used for refund processing if required. Card details entered during a payment are transmitted directly to the processor's secure environment, never passing through mm666's own servers.

mm666 does not sell, rent or provide your personal data to any third party for marketing or commercial purposes. Data sharing occurs only in the following specific, controlled circumstances:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, our IBFT banking partner and our card processing provider receive the minimum data necessary to process each specific transaction. All payment partners are certified under the relevant data security standards.
• Identity verification partners: Where full identity verification is required (for high-value withdrawals or where our KYC process requires it), data is shared with our certified verification partner under a data processing agreement that restricts use of the data to the verification purpose only.
• Game software providers: Live casino game providers (Evolution Gaming, Pragmatic Play Live, Ezugi) receive your username and session token to authenticate your access to their game streams. They do not receive your payment data, contact details or identity documents.
• Regulatory and law enforcement authorities: Where mm666 is legally required to disclose information to a competent authority — for example in response to a court order, regulatory investigation or legal process — we will comply with that requirement. We will notify you of such disclosure where we are legally permitted to do so.
• Professional advisers: Legal, accounting and auditing professionals who are bound by confidentiality obligations may access account data on a need-to-know basis in the context of their professional engagement with mm666.

mm666 uses cookies and similar technologies to operate the platform, keep you logged in, prevent fraud, and understand how players use the site. The table below sets out the categories of cookies in use on the mm666 platform and whether they are essential or optional.

mm666 does not use third-party advertising cookies and does not allow any external advertising network to place cookies on the platform. You can manage your cookie preferences in your browser settings. Note that disabling strictly necessary or fraud prevention cookies will affect the platform's ability to function correctly and maintain account security.

The security of your personal and financial data is a fundamental responsibility at mm666, not a feature we built after the fact. The platform was designed from the start with data security as a core architectural requirement. The key security measures in place are as follows:

• Transport security: All data in transit between your device and mm666 is encrypted using TLS 1.3, the current industry standard for transport layer security. Older, less secure protocol versions are not supported.
• Storage encryption: All sensitive data stored on mm666's infrastructure — including identity documents, payment references and personal information — is encrypted using AES-256 encryption with key management procedures that prevent unauthorised access even in the event of physical access to storage media.
• Access controls: mm666 staff access to player data is governed by a strict role-based access control system. Only staff members whose role requires access to specific data categories can view that data, and all access is logged and audited.
• Two-factor authentication: 2FA is available for all mm666 player accounts and is strongly recommended. Staff accounts with access to player data require mandatory 2FA.
• Fraud monitoring: mm666's fraud detection system monitors for unusual login patterns, suspicious transaction activity and multi-accounting. Where a threat to an account is detected, the account is proactively secured pending player verification.
• Penetration testing: The mm666 platform undergoes regular security assessments including penetration testing to identify and remediate vulnerabilities before they can be exploited.

mm666 retains personal data for only as long as necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The primary data retention periods at mm666 are as follows:

• Account and identity data: Retained for the duration of your active account relationship plus 5 years following account closure, as required by our AML and KYC regulatory obligations.
• Transaction records: Financial transaction records including deposits, withdrawals and bet history are retained for 7 years following the date of each transaction, as required for financial compliance purposes.
• Support communications: Customer support transcripts are retained for 2 years from the date of the interaction for quality assurance and dispute resolution purposes.
• Responsible gaming records: Self-exclusion records, limit settings and responsible gaming interaction logs are retained indefinitely to allow mm666 to enforce exclusions and protect players who have used these tools.
• Marketing preferences: Retained until you withdraw consent or request deletion. Withdrawal of marketing consent does not trigger deletion of other data categories.
• Technical and behavioural data: Session logs and behavioural analytics data are retained in aggregated, anonymised form for platform improvement purposes indefinitely. Identifiable session data is deleted after 90 days.

When retention periods expire, data is securely deleted or anonymised in a way that prevents re-identification. You may request early deletion of data that is not subject to a regulatory retention requirement — see Section 10 for your rights in this regard.

As a player at mm666, you have the following rights in relation to your personal data. All requests should be submitted to support@mm666.run and will be acknowledged within 2 business days and fulfilled within 30 calendar days.

mm666 does not knowingly collect personal data from any person under 18 years of age. The platform is strictly 18+ and all reasonable measures are taken to prevent underage access, including age verification on withdrawal requests.

If mm666 discovers that personal data has been collected from a person under 18, that data will be deleted immediately, the account will be closed, and any deposits made will be refunded to the original payment source. If you believe a person under 18 has created an mm666 account, please notify us immediately at support@mm666.run.

mm666 may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or the services we offer. When changes are material — meaning they affect how your data is used in a way that is meaningfully different from what was previously described — we will notify you via your registered email address or via a notification displayed when you next log in.

Minor clarifications and non-material updates will be reflected in the "Last Updated" date at the top of this page. We recommend reviewing this page periodically. Continued use of the mm666 platform after any update constitutes acceptance of the revised policy.

If you have any question about this Privacy Policy, want to exercise any of your data rights, have a concern about how mm666 has handled your personal data, or want to report a potential data security issue, please contact us via the following channels. All privacy enquiries are handled by our dedicated data team and will receive a substantive response within 5 business days.