vg66 Privacy Policy — How We Protect Your Personal Data

1 Introduction

vg66 ("we", "us", "our") is committed to protecting the privacy and personal data of every player who registers on the vg66 platform. This Privacy Policy sets out in clear, formal terms what personal data vg66 collects, why we collect it, how it is stored and protected, with whom it may be shared, how long we retain it, and what rights you hold in relation to your own data.

This policy applies to all personal data collected through the vg66 website at vg66.io, through any mobile-optimised interface, through our customer support channels, and through the identity verification processes conducted in connection with player accounts. It applies to all registered players and prospective players located in Bangladesh and elsewhere.

This Privacy Policy should be read alongside the vg66 Terms & Conditions and the Responsible Gaming policy, both of which are published on this site. Where a conflict exists between this policy and the Terms & Conditions on a data-privacy matter, this Privacy Policy shall take precedence.

2 Data Controller

For the purposes of applicable data protection law, vg66 is the data controller in respect of the personal data of Bangladesh players registered on the platform. As data controller, vg66 determines the purposes for which and the means by which personal data is processed. vg66 takes its responsibilities as data controller seriously and has implemented organisational and technical measures to ensure data is processed lawfully, fairly, and transparently.

All data-related enquiries, access requests, correction requests, and deletion requests should be directed to the vg66 data support team at [email protected]. We aim to respond to all formally submitted data requests within 30 calendar days of receipt.

3 Personal Data We Collect

vg66 collects the following categories of personal data from players and prospective players:

vg66 does not collect special categories of sensitive personal data (such as health data, biometric data for identification, political opinions, or religious beliefs) except where a selfie or identity photograph is submitted as part of the KYC process — in which case the photograph is used solely for identity verification purposes and is not processed for facial-recognition profiling.

4 How We Collect Personal Data

vg66 collects personal data through the following channels:

• Direct submission by the player — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact support, or fill in any other form on the platform.
• Automated technical collection — through cookies, session tracking, server logs, and device-fingerprinting technologies that operate automatically when you access the vg66 website. See Section 8 (Cookies and Tracking) for details.
• Payment providers — when you initiate a deposit or withdrawal, your payment provider (bKash, Nagad, Rocket, Upay, Visa, Mastercard) shares transaction confirmation data with vg66 to allow us to credit or debit your BDT Wallet accurately.
• KYC verification partners — if vg66 uses a third-party identity verification service to assist with document authentication, that partner shares the verification result (pass/fail) and associated identity data with vg66 as part of the verification workflow.
• Game studio providers — third-party game providers such as Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi share game-session data (round IDs, bet amounts, outcomes) with vg66 for the purposes of account crediting, dispute resolution, and responsible gaming monitoring.

5 Purpose and Legal Basis for Processing

vg66 processes personal data only where a lawful basis for processing exists. The following table sets out the primary purposes for which we process your data and the corresponding legal basis:

6 Payment Data

When you make a deposit or withdrawal on vg66, financial transaction data is exchanged between vg66 and your chosen payment provider. vg66 stores a transaction record — including the payment method type, the partial account identifier (e.g., last four digits of a card or the registered mobile number of a bKash/Nagad account), the transaction amount in BDT ৳, the transaction date and time in Bangladesh Standard Time (BST, UTC+6), and the transaction status — in your account transaction history.

vg66 does not store full card numbers, CVV codes, or complete mobile-money account credentials on its own servers. Full payment credentials are transmitted directly to and processed by the relevant payment provider through their own secure systems. vg66 receives only a tokenised or partial identifier to associate the transaction with your account.

Payment data is retained as part of your account transaction history for a minimum of five years from account closure, in accordance with financial record-keeping obligations applicable to platforms of this type.

7 KYC and Identity Documents

Identity documents and photographs submitted as part of the KYC verification process are treated as a distinct and especially sensitive category of personal data. vg66 applies the following specific safeguards to KYC data:

• KYC documents are stored in an access-restricted document vault, separate from general account data, with access limited to authorised compliance personnel only.
• Documents are encrypted at rest using AES-256 encryption.
• KYC documents are used exclusively for the purpose of identity and age verification in connection with your vg66 account. They are not used for marketing, profiling, or any other secondary purpose.
• KYC documents submitted to a third-party verification partner (if applicable) are shared only under a data processing agreement that prohibits the partner from using the documents for any purpose other than completing the verification check on vg66's behalf.
• KYC documents are retained for a minimum of five years from account closure to satisfy applicable record-keeping obligations. At the end of the retention period, documents are securely and irreversibly destroyed.

8 Cookies and Tracking Technologies

vg66 uses cookies and similar tracking technologies on the vg66 website to ensure the platform functions correctly, to maintain your login session, to detect fraudulent activity, and to analyse aggregated usage patterns for the purposes of improving platform performance and user experience.

The categories of cookies used by vg66 are as follows:

• Essential / Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your login state, security tokens, and cookies that manage your language and currency preferences. These cookies cannot be disabled without rendering the platform non-functional.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the vg66 platform — which pages are visited most frequently, how long sessions last, and which game categories attract the most engagement. This data helps vg66 improve the platform experience. Analytics cookies do not identify you personally.
• Fraud-Detection Cookies: Used to detect and prevent multi-account creation, automated bot activity, and other forms of prohibited conduct described in the vg66 Terms & Conditions. These cookies collect device and browser fingerprint data to identify patterns associated with fraudulent behaviour.
• Preference Cookies: Used to remember your platform preferences such as your preferred game category, deposit method, and display settings, so that returning to the platform feels personalised without requiring you to reconfigure settings on each visit.

By continuing to use the vg66 platform after being presented with the cookie notice, you consent to the use of non-essential cookies as described above. You may adjust your cookie preferences or withdraw consent for non-essential cookies at any time via the cookie settings panel accessible from the platform footer. Withdrawing cookie consent does not affect essential cookies required for the platform to function.

9 Third-Party Sharing

vg66 shares personal data with third parties only in the limited circumstances described below. vg66 does not sell, rent, or trade personal data to any third party for commercial purposes.

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data necessary to process your deposits and withdrawals. Each payment provider operates under its own privacy policy and processes your data as an independent data controller for payment purposes.
• KYC Verification Partners: Where vg66 uses a third-party identity verification service, that partner receives your identity documents and verification data solely for the purpose of completing the KYC check. The partner is contractually prohibited from using your data for any other purpose.
• Game Studio Providers: Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, Ezugi, and other licensed game studios receive a player session token and bet data necessary to operate their games within the vg66 platform. These studios do not receive your full identity or contact data.
• Platform Technology and Security Providers: Third-party providers of hosting infrastructure, fraud detection, cybersecurity monitoring, and platform analytics may process technical data (such as IP addresses and session data) in the course of providing their services to vg66. All such providers are engaged under data processing agreements with appropriate confidentiality and security obligations.
• Legal and Regulatory Authorities: vg66 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent public authorities where required to do so by applicable law, court order, or regulatory direction. vg66 will, where legally permitted, notify the affected player of such a disclosure request before complying.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of vg66's business, player personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained by the successor entity.

10 International Data Transfers

vg66 operates its core platform infrastructure with a primary focus on serving Bangladesh-based players in Bangladesh Standard Time (BST, UTC+6). However, as a digital platform relying on globally distributed technology partners — including game studios, payment networks, and cloud infrastructure providers — some personal data may be processed on servers or systems located outside Bangladesh.

Where personal data is transferred outside Bangladesh, vg66 ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections provided in Bangladesh. These safeguards include contractual data processing agreements with receiving parties that incorporate standard data protection clauses and impose security and confidentiality obligations on the recipient.

By using the vg66 platform, you acknowledge that your data may be processed in jurisdictions outside Bangladesh as described above, and you consent to such transfers to the extent that consent is required by applicable law.

11 Data Retention

vg66 retains personal data for the periods set out below. Data that is no longer required for any lawful purpose is securely and irreversibly deleted or anonymised:

• Account and Identity Data: Retained for the life of the account and for a minimum of five years following permanent account closure. This retention period reflects anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five years from account closure, then securely destroyed.
• Transaction and Financial Records: Retained for a minimum of five years from the date of the transaction.
• Gaming Activity Logs: Retained for a minimum of three years from account closure for the purposes of dispute resolution and responsible gaming monitoring.
• Support Communications: Retained for a minimum of two years from the date of the communication, or for the duration of any open dispute, whichever is longer.
• Technical and Analytics Data: Aggregated and anonymised after 12 months. Raw session logs containing IP addresses are retained for a maximum of 12 months for fraud-detection purposes.
• Marketing Consent Records: Retained for the period of consent plus two years following withdrawal, to demonstrate that communications sent during the consent period were lawfully authorised.

Where a legal obligation, regulatory requirement, or ongoing legal dispute requires data to be retained beyond the standard periods above, vg66 will retain the relevant data for the duration of that obligation or dispute and then delete it promptly on resolution.

12 Your Data Rights

As a vg66 player, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered account username and the specific right you wish to exercise:

• Right of Access: You have the right to request a copy of all personal data vg66 holds about you, together with information about how it is processed. vg66 will provide this data in a structured, commonly used format within 30 calendar days of receiving a verified request.
• Right to Rectification: If any personal data vg66 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Changes to name, date of birth, or identity data may require re-submission of KYC documents to verify the corrected information.
• Right to Erasure (Right to be Forgotten): In certain circumstances, you have the right to request that vg66 delete your personal data. This right is not absolute — vg66 may be legally required to retain certain data (such as financial transaction records and KYC documents) for the minimum periods described in Section 11, and an erasure request will not override those legal obligations.
• Right to Restriction of Processing: You have the right to request that vg66 restrict the processing of your personal data in specific circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Object: Where vg66 processes your data on the basis of legitimate interests, you have the right to object to that processing. vg66 will cease processing on that basis unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: Where processing is based on contract or consent and is carried out by automated means, you have the right to receive your personal data in a machine-readable format so that it may be transferred to another service provider if you choose.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

13 Children and Minors

The vg66 platform is strictly for adults aged 21 years and above. vg66 does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and accounts found to belong to individuals under 21 will be permanently closed with all associated data flagged and handled in accordance with applicable legal requirements.

If a parent or guardian believes that a minor has registered an account on vg66 or has submitted personal data to the platform in any form, please contact the support team immediately at [email protected]. vg66 will investigate promptly and, where confirmed, will delete the minor's data and close the account without delay.

14 Security Measures

vg66 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, and destruction. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the vg66 platform.
• AES-256 encryption at rest for all personal data, KYC documents, and financial records stored on vg66 servers.
• Two-factor authentication (2FA) available and recommended for all player accounts. Players are strongly encouraged to enable 2FA in their account security settings.
• Role-based access controls limiting access to personal data to vg66 staff and authorised personnel with a demonstrated need to access that data in connection with their role.
• Automated fraud-detection systems monitoring for anomalous account activity, unusual login patterns, and multi-account indicators on a continuous basis.
• Regular security reviews and penetration testing conducted by qualified security professionals to identify and remediate vulnerabilities in the platform infrastructure.
• Incident response procedures for identifying, containing, and notifying affected players of any personal data breach, in accordance with applicable notification requirements.

While vg66 applies rigorous security measures, no online platform can guarantee absolute security against all possible threats. Players are responsible for maintaining the security of their own account credentials. If you suspect your account has been compromised, contact vg66 support immediately at [email protected].

15 Amendments to This Policy

vg66 reserves the right to update or amend this Privacy Policy at any time. Material changes — those that meaningfully alter how we collect, use, or share personal data, or that reduce player rights — will be communicated to registered players via the mobile number or email address registered on their account at least 14 days before the change takes effect, except where an immediate change is required for legal, regulatory, or security reasons.

The current version of this Privacy Policy, with the "Last Updated" date displayed at the top of the policy body, is the version that governs the processing of your personal data. The most recent version of this policy is always available at vg66.io/privacy-policy. Continuing to use the vg66 platform after a published amendment constitutes acceptance of the revised Privacy Policy.

If a proposed amendment materially reduces your privacy rights and you do not wish to accept the revised policy, you may request account closure in accordance with the account closure procedure described in the vg66 Terms & Conditions before the amendment takes effect.

16 Contact Us — Privacy Enquiries

For any question, concern, or formal request relating to this Privacy Policy or the processing of your personal data by vg66, please contact the data support team through the following channel:

• Email: [email protected] — subject line: "Privacy Enquiry" or "Data Rights Request"
• Support Hours: 24 hours a day, 7 days a week, 365 days a year
• Languages: English and Bengali
• Response Target: Acknowledgement within 5 business days; substantive response within 30 calendar days (Bangladesh Standard Time, UTC+6)

When submitting a data rights request, please include your registered account username and a clear description of the specific request or concern. Where necessary to verify your identity before processing a request, we may ask you to confirm certain account details or provide a copy of an identity document. This is a security measure to protect your data from unauthorised disclosure.