Privacy Policy

This Privacy Policy ("Policy") describes how 666fa ("the Platform", "we", "us", "our"), accessible at https://666fa.cam, collects, processes, stores, and discloses the personal information of individuals ("Player", "User", "you") who register for, access, or otherwise interact with our services.

This Policy applies to all personal data collected through the 666fa website, mobile platform, customer support communications, and any other channel through which you interact with us. It should be read alongside our Terms & Conditions and Responsible Gaming Policy, all of which collectively govern your relationship with 666fa.

By creating a 666fa Account or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please do not use the Platform.

1. Definitions

For the purposes of this Privacy Policy, the following terms are defined as follows:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means 666fa, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of 666fa under a contractual arrangement.
• "KYC Data" means identity verification documents and information submitted by Players, including government-issued ID (KTP), passport copies, selfies, and proof of address.
• "Transaction Data" means records of deposits, withdrawals, wagers, winnings, and associated payment instrument details.
• "Technical Data" means device identifiers, IP addresses, browser type, operating system, session logs, and similar automatically collected information.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.

2. Data We Collect

666fa collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:

2.1 Registration and Account Data

• Full legal name (as it appears on your Indonesian KTP or passport)
• Date of birth
• Residential address (including city, province, and postal code)
• Email address
• Mobile phone number (Indonesian mobile number)
• Username and encrypted password
• Security questions and answers (where applicable)

2.2 Identity Verification (KYC) Data

• Copy of National Identity Card (KTP) or Indonesian passport
• Proof of address document (e.g., utility bill, bank statement dated within 3 months)
• Selfie photograph holding the identity document
• Additional documents requested during enhanced due diligence reviews

2.3 Financial and Transaction Data

• Bank account details (account name, account number, bank name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal history
• Wagering history, game session records, and bet outcomes
• Currency and amounts in Indonesian Rupiah (IDR / Rp)

2.4 Technical and Usage Data

• IP address and geolocation data (country and city level)
• Device type, operating system, and browser version
• Session timestamps, login history, and platform activity logs
• Cookies and similar tracking technologies (see Section 9)
• Referring URL and navigation path within the Platform

2.5 Communications Data

• Customer support chat transcripts, emails, and call recordings
• Survey responses and feedback submissions
• Complaint records and dispute correspondence

2.6 Responsible Gaming Data

• Self-exclusion requests and status
• Deposit, loss, and session limits set by the Player
• Responsible gaming self-assessment responses

3. How We Collect Your Data

We collect Personal Data through the following means:

• Directly from you — when you register an Account, complete KYC, make a deposit or withdrawal, contact customer support, or respond to a survey.
• Automatically — through cookies, server logs, and analytics tools when you access and interact with the Platform.
• From third-party payment providers — our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay) may provide confirmation data related to your transactions.
• From identity verification services — third-party KYC providers used to verify the authenticity of identity documents.
• From fraud prevention and AML screening services — automated systems that screen your data against watchlists and risk databases to detect financial crime.

4. Purposes of Processing

666fa processes your Personal Data for the following specific purposes:

5. Legal Bases for Processing

We process your Personal Data under the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions — including operating your Account, processing payments, and delivering gaming services.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and identity verification regulations — specifically, KYC procedures before processing withdrawals.
• Legitimate interests: Processing conducted in the legitimate interests of 666fa or its players, where those interests are not overridden by your fundamental rights — including fraud prevention, platform security, and responsible gaming enforcement.
• Consent: Processing for optional purposes such as marketing communications, where you have provided explicit and freely given consent. You may withdraw consent at any time by contacting our support team.

6. Sharing Your Personal Data

666fa does not sell your Personal Data. We share it only in the limited circumstances described below, and always subject to appropriate data protection safeguards:

6.1 Payment Processors and Banking Partners

We share your name, bank account details, and transaction information with our Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposits and withdrawals. These partners are bound by their own regulatory obligations and may not use your data for any other purpose.

6.2 Identity Verification Providers

Your KYC documents and registration data are shared with accredited third-party identity verification services that assist us in authenticating your identity and screening against AML and sanctions watchlists. These providers operate as Data Processors under contractual agreements that restrict their use of your data to verification purposes only.

6.3 Game Software Providers

Our third-party game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive limited technical session data (such as Player ID, session token, and bet amounts) necessary to deliver their games within the Platform. These providers do not receive your full identity or financial details.

6.4 Fraud Prevention and Security Services

We share Technical Data and Transaction Data with specialist fraud detection and cybersecurity providers to identify suspicious activity, prevent unauthorised access, and protect the integrity of the Platform.

6.5 Legal and Regulatory Authorities

We may disclose your Personal Data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where we are required to do so by applicable law, a valid court order, or in connection with the investigation of suspected financial crime.

6.6 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will provide advance notice of any such transfer and ensure that the acquiring entity is bound by equivalent data protection obligations.

7. Data Retention

666fa retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The following indicative retention periods apply:

Upon expiry of the applicable retention period, your data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes.

8. Security Measures

666fa implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS/SSL Encryption: All data transmitted between your device and the 666fa Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Data Encryption at Rest: Sensitive data fields — including passwords, bank account numbers, and KYC document images — are encrypted using AES-256 encryption within our database infrastructure.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. All staff with access to sensitive data undergo background screening and mandatory privacy training.
• Multi-Factor Authentication (MFA): Administrative access to our core systems requires multi-factor authentication. Players are strongly encouraged to enable MFA on their own Accounts.
• Intrusion Detection Systems: Our infrastructure is monitored continuously by automated intrusion detection and prevention systems that flag and respond to anomalous activity in real time.
• Regular Security Audits: We engage independent cybersecurity specialists to conduct periodic penetration testing and vulnerability assessments of our Platform.
• Incident Response Plan: In the event of a confirmed data breach affecting your rights, we will notify affected Players and relevant authorities within the timeframes required by applicable law.

While we take every reasonable precaution to protect your data, no digital platform can guarantee absolute security. You are responsible for keeping your own Account credentials confidential and for using a secure, private internet connection when accessing the Platform.

9. Cookies and Tracking Technologies

666fa uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session continuity, and gather analytical data about Platform usage. The following categories of cookies are used:

9.1 Essential Cookies

These cookies are strictly necessary for the Platform to function correctly. They enable core features such as Account login session management, security tokens, and user preference storage. These cookies cannot be disabled without impairing Platform functionality.

9.2 Analytical and Performance Cookies

We use analytics tools to collect aggregated and anonymised data about how users navigate the Platform — including page views, session duration, and navigation paths. This data is used exclusively to improve Platform design and performance. It does not identify you personally.

9.3 Functional Cookies

Functional cookies remember your preferences — such as language selection, display settings, and last-visited game categories — to personalise your experience across sessions without requiring you to re-configure settings on each visit.

9.4 Fraud Prevention Cookies

Certain cookies assist our fraud detection systems in identifying suspicious patterns, such as multiple Account registrations from the same device or browser fingerprint anomalies. These are essential for Platform security and cannot be disabled.

9.5 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies via their privacy or settings menu. Please note that disabling certain cookies may limit your access to some features of the Platform. Instructions for managing cookies in popular browsers are available through each browser's official help documentation.

10. Your Privacy Rights

Subject to applicable law, you hold the following rights in relation to your Personal Data held by 666fa. To exercise any of these rights, please contact our data team using the details in Section 14:

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you may request that we correct or update it. For Account details, many fields can be updated directly through your Account dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our legal obligation to retain certain records (see Section 7).
• Right to Restriction: You may request that we restrict the processing of your Personal Data while a rectification request is pending, or where you contest the lawfulness of processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that we provide your Personal Data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You may object to the processing of your Personal Data where it is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw your consent at any time without affecting the lawfulness of prior processing.

We will respond to all verifiable requests within 30 calendar days of receipt. Complex requests may require an extension of up to a further 30 days, in which case we will notify you of the delay and the reason for it. Identity verification may be required before we can process your request to prevent unauthorised access to your data.

11. Minors and Age Restriction

666fa's services are strictly reserved for individuals aged 21 years or older. We do not knowingly collect Personal Data from anyone under the age of 21. If you are under 21, you must not register an Account or attempt to use the Platform in any capacity.

If we become aware that Personal Data has been collected from an individual under the age of 21 — whether through our own detection mechanisms or through a report by a parent or guardian — we will immediately suspend the associated Account, delete the data in question, and return any deposited Funds to the originating payment method where reasonably practicable.

Parents and guardians who have reason to believe that a minor has registered on the Platform or shared Personal Data with us are encouraged to contact our support team immediately at [email protected]. We will treat all such reports with the highest priority.

12. International Data Transfers

666fa primarily stores and processes Personal Data within server infrastructure located in secure data centres in Asia. However, some of our third-party service providers — including certain game studios, analytics platforms, and cybersecurity vendors — may process data outside of Indonesia.

Where Personal Data is transferred internationally, we ensure that appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities;
• Contractual obligations requiring the recipient to apply data protection standards equivalent to those we observe; and
• Verification that the recipient country or organisation provides an adequate level of data protection.

By using the Platform, you acknowledge and consent to your Personal Data being transferred to and processed in jurisdictions outside of Indonesia where such transfers are necessary to deliver our services.

13. Amendments to This Policy

666fa reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will notify registered Players by email to their registered address and by posting a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last updated" date at the top of this document will always reflect the date of the most recent revision. We encourage you to review this Policy periodically to remain informed about how we protect your information. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy.

If a proposed amendment materially reduces your privacy rights and you do not accept the revised Policy, you may close your Account before the effective date by contacting our customer support team. Any Personal Data that must be retained for legal or regulatory purposes will be handled in accordance with the retention schedule in Section 7.

14. Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 666fa handles your Personal Data, please reach out to our dedicated data privacy team through any of the channels below. We are committed to responding promptly and transparently to all privacy-related enquiries.

• Email: [email protected] — please include "Privacy Request" in the subject line so your message is routed directly to the appropriate team.
• Live Chat: Available 24/7 on the Platform homepage. Identify yourself as submitting a privacy-related request at the start of the conversation.
• WhatsApp: +62 812-3456-7890 — available during WIB business hours (09:00–21:00 WIB, UTC+7).

All privacy-related requests are handled in strict confidence. We may require you to verify your identity before processing requests relating to data access, rectification, or erasure, in order to protect your data from unauthorised disclosure.