m66com Privacy Policy —
Your Data, Your Rights

Definitions & Scope

In this Privacy Policy, the following terms carry the meanings set out below unless the context requires otherwise:

• "m66com", "we", "us", "our" — the operator of the m66com Platform accessible at m66com.net, together with its affiliated entities involved in the provision of Platform services.
• "Platform" — the m66com website, all sub-pages, account management interfaces, gaming environments, sports betting systems, and all related digital services accessible at m66com.net.
• "Personal Data" — any information that directly or indirectly identifies a natural person, including but not limited to name, CNIC number, mobile number, date of birth, IP address, device identifiers, and financial transaction records.
• "User", "you", "your" — any natural person who registers an Account on, accesses, or otherwise interacts with the m66com Platform.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transfer, restriction, erasure, or destruction.
• "KYC" — Know Your Customer verification procedures, including identity verification via Pakistani CNIC, proof of address, and payment method ownership verification.

This Privacy Policy applies to all Personal Data collected by m66com in connection with the operation of the Platform, including data collected during Account registration, during real-money gaming and wagering sessions, through payment transactions, via customer support interactions, and through automated technical data collection methods such as cookies and server logs.

This Policy applies to all registered Users of the m66com Platform globally, with specific reference to players located in Pakistan accessing the Platform in Pakistani Rupees (PKR) via domestic payment methods including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and SadaPay.

Data Controller

m66com is the data controller in respect of all Personal Data collected from Users of the Platform. As data controller, m66com determines the purposes and means of processing your Personal Data and bears primary responsibility for ensuring that such processing is carried out lawfully, fairly, and transparently.

m66com's data protection obligations are derived from and governed by the terms of our international gaming licence, which includes specific requirements for the handling of player data, data security standards, data retention periods, and player rights in respect of their personal information.

Categories of Personal Data We Collect

m66com collects Personal Data from Users through several channels: directly from you during Account registration and KYC processes; automatically during your use of the Platform through technical data collection mechanisms; and from third-party service providers involved in identity verification and payment processing.

• Full legal name as it appears on your Pakistani CNIC;
• CNIC number;
• Date of birth;
• Pakistani mobile number (used as primary account identifier and for 2FA);
• Email address (if provided);
• Residential address (province, city);
• Profile photograph (if submitted for KYC);
• CNIC photocopy (front and back, submitted for KYC verification).

• PKR deposit amounts, dates, and payment method identifiers;
• Withdrawal requests, amounts, and processing status;
• JazzCash and EasyPaisa account numbers (masked);
• Bank account details for HBL, UBL, and Meezan Bank transfers (IBAN, masked);
• USDT TRC20 wallet addresses (where used);
• Transaction reference numbers and timestamps;
• Bonus credits awarded, wagering requirements completed, and promotional participation history.

• Game sessions played, including game type, start/end time, and duration;
• Wager amounts, game outcomes, and win/loss records;
• Sports betting selections, odds, and settlement outcomes;
• Responsible gaming limit settings and self-exclusion history;
• Account balance history and wagering pattern data.

• IP address at the time of each login and transaction;
• Device type, operating system, and browser version;
• Mobile network operator (Jazz, Zong, Telenor, Ufone, Warid);
• Session duration and navigation patterns within the Platform;
• Cookie identifiers and session tokens;
• Geolocation data (country/city level, derived from IP address).

• Records of all customer support interactions including live chat transcripts;
• Nature and resolution of support requests and complaints;
• Any additional identity or account information voluntarily provided during support interactions.

How We Use Your Personal Data

m66com uses the Personal Data collected from Users strictly for the following purposes. We do not use your data for any purpose that is incompatible with those set out in this Policy without obtaining your prior consent:

m66com does not use your Personal Data for automated decision-making that produces legal or similarly significant effects, other than standard fraud and AML screening systems which flag accounts for human review — not automated final decisions.

Legal Basis for Processing Personal Data

m66com relies on one or more of the following legal bases when processing your Personal Data, depending on the specific purpose of each processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the m66com Terms & Conditions — including Account management, payment processing, and game provision;
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC verification under anti-money laundering regulations, age verification requirements under our gaming licence, and data disclosure obligations to regulatory authorities;
• Legitimate Interests: Processing necessary for m66com's legitimate interests in operating a safe, secure, and legally compliant gaming platform, including fraud prevention, Platform security, responsible gaming monitoring, and improving Platform services — provided such interests are not overridden by your fundamental rights;
• Consent: Processing for purposes where your explicit, informed, and freely given consent has been obtained — such as the sending of promotional communications or marketing messages to your registered mobile number or email address. You may withdraw consent at any time by contacting customer support.

Data Sharing & Third-Party Disclosure

m66com does not sell, rent, or trade your Personal Data to third parties for commercial or marketing purposes. Your data may be shared with the following categories of third-party recipients solely to the extent necessary for the stated purposes:

m66com engages third-party service providers to assist in the operation of the Platform. These providers act as data processors on behalf of m66com and are contractually bound to process your data only on our instructions and in compliance with applicable data protection requirements. Categories include:

• KYC and Identity Verification Partners — process CNIC data and identity verification requests;
• Payment Processors — facilitate PKR transactions via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 infrastructure;
• Gaming Software Suppliers — receive anonymised session data necessary to operate certified slot, table game, and live dealer systems;
• Customer Support Platforms — host live chat and support ticket systems used to manage your enquiries;
• Cybersecurity and Fraud Prevention Services — receive device and IP data to identify and mitigate fraudulent account activity.

m66com may disclose Personal Data to its gaming regulatory authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, regulation, court order, or legal process. Such disclosure will be limited to the minimum data required to satisfy the specific legal requirement.

Payment Data & PKR Transaction Privacy

m66com takes particular care in handling the financial data of Pakistani Users. All PKR payment transactions — whether via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, or USDT TRC20 — are processed through encrypted, secure payment channels. m66com does not store your full payment credentials on its own servers; payment method details are tokenised and processed exclusively by our licensed payment processing partners.

Transaction records are retained for a minimum of five (5) years from the date of the transaction as required by anti-money laundering regulations applicable to licensed gaming operators. These records are accessible to m66com's compliance team, its gaming regulator, and relevant financial intelligence authorities — and to you upon a valid subject access request.

m66com's payment processing partners handling Pakistani Rupee transactions are required to comply with applicable financial data security standards. No complete bank account numbers, full JazzCash account details, or IBAN numbers are stored in plain text in any m66com system.

Cookies & Tracking Technologies

The m66com Platform uses cookies and similar tracking technologies to deliver essential Platform functionality, remember your session preferences, analyse Platform usage patterns, and support fraud detection systems. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from accessing your m66com Account and using Platform services. For mobile browser users on Pakistani networks, cookie management is available through Chrome Settings → Site Settings → Cookies on Android.

Data Retention Periods

m66com retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, subject to minimum retention periods required by our gaming licence and applicable law. The following retention periods apply:

Following the expiry of applicable retention periods, Personal Data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual. Self-exclusion records are the sole exception — these are retained permanently to prevent re-registration of a formerly self-excluded User in violation of their protection request.

Your Data Rights

As a User of the m66com Platform, you have the following rights in respect of your Personal Data. To exercise any of these rights, please contact m66com customer support via the live chat function:

Security Measures

m66com implements comprehensive technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, and destruction. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption — all data transmitted between your device and the m66com Platform is encrypted using industry-standard TLS protocol, equivalent to the security standards used by major Pakistani commercial banks for online banking;
• Encrypted Password Storage — m66com login passwords are stored using one-way cryptographic hashing with salting. m66com staff cannot read your password — only reset it through verified authentication processes;
• Two-Factor Authentication (2FA) — available for all Accounts via SMS OTP to your registered Pakistani mobile number, providing a second layer of m66com login security;
• Access Controls — Personal Data is accessible only to m66com personnel who require it for their specific job function, subject to role-based access restrictions and audit logging;
• Automated Intrusion Detection — server infrastructure is monitored continuously for anomalous access patterns, brute-force login attempts, and data exfiltration indicators;
• Regular Security Testing — the Platform undergoes periodic penetration testing and vulnerability assessments by qualified independent security professionals.

Despite these measures, no internet-based platform can guarantee absolute security. You are strongly encouraged to use a strong, unique password for your m66com Account, enable 2FA, and access your Account only over trusted personal networks — not public Wi-Fi in cafés or other shared environments prevalent in Pakistani urban centres.

Children & Minors

The m66com Platform is strictly intended for adults aged 21 years and over. m66com does not knowingly collect Personal Data from, or provide gaming services to, any person under the age of 21. Age verification via Pakistani CNIC is a mandatory step in the KYC process before any withdrawal is processed.

If m66com determines that an Account has been registered by or on behalf of a person under the age of 21, the Account will be immediately and permanently closed, all associated Personal Data will be handled in accordance with applicable laws governing the processing of minors' data, and any balance in the Account will be forfeited in accordance with the m66com Terms & Conditions.

International Data Transfers

As a platform operating under an international gaming licence and serving users in Pakistan, m66com may transfer certain categories of Personal Data to countries outside of Pakistan for the purposes of KYC verification, payment processing, gaming system operation, and customer support infrastructure.

Where such international data transfers occur, m66com ensures that:

• The receiving country, organisation, or service provider offers an adequate level of data protection as assessed under applicable law;
• Appropriate safeguards are in place — such as standard contractual clauses, binding corporate rules, or certification schemes — to protect the transferred data to a standard equivalent to that applicable in the country of origin;
• Data transfers are limited to the minimum data necessary for the specific processing purpose;
• All international transfers are logged and subject to periodic review by m66com's compliance function.

Your Personal Data will never be transferred to a jurisdiction that does not offer adequate protections, as determined by our gaming regulator's transfer assessment framework.

Responsible Gaming Data

m66com treats responsible gaming data — including your self-imposed deposit limits, loss limits, session time settings, cooling-off periods, and self-exclusion records — with the highest level of sensitivity. This data is used exclusively to enforce the protections you have chosen to apply to your Account and to monitor gaming patterns that may indicate a need for responsible gaming intervention.

Responsible gaming data is never used for marketing profiling, game recommendation algorithms, or any commercial purpose. Your decision to set limits or self-exclude is treated as confidential and is not shared with any third party except where legally required.

Self-exclusion records are the only category of Personal Data that m66com is legally and ethically unable to delete upon request. This is because deletion of self-exclusion records would undermine the very protection you sought when activating the exclusion — potentially enabling re-registration in a state where you previously determined you needed to stop. These records are retained permanently and used solely to protect your welfare.

For full information about responsible gaming tools and how to use them, please visit our dedicated Responsible Gaming page.

Amendments to This Privacy Policy

m66com reserves the right to amend this Privacy Policy at any time. When material changes are made, notification will be provided via the mobile number or email address registered on your Account, or through a prominent notice on the Platform at m66com.net. Non-material clarifications may be published without individual notification.

The "Last Revised" date at the top of this Policy will always reflect the date of the most recent update. Continued use of the m66com Platform following the publication of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated Policy.

Contact Us — Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which m66com processes your Personal Data, please contact our customer support team through any of the following channels:

• Live Chat: Available directly on the m66com Platform, accessible after m66com login, until 2 AM PKT daily;
• Email: [email protected] — please include "Privacy Policy Enquiry" in your subject line;
• Subject Access Requests: Formal requests for copies of your Personal Data should be submitted via live chat or email, accompanied by verification of your identity (CNIC reference number and registered mobile number).

m66com aims to acknowledge all data protection enquiries within 3 business days and to provide a substantive response within 30 calendar days of receipt. Where a request is complex or numerous, we will notify you within the initial 30-day period and provide an estimate for completion.

This Privacy Policy was most recently updated on 1 January 2026. The current version of this Policy supersedes all previously published versions.