Data We Collect
When you create an account, make deposits, place bets, or otherwise interact with the cm666 platform, we collect personal data that is necessary to provide our services, verify your identity, process transactions, and meet our regulatory obligations. Below is a detailed breakdown of the categories of personal data we collect and the circumstances in which each category arises.
Registration & Identity Data
When you register a cm666 account, we collect your full legal name, date of birth, email address, mobile phone number, and the country and city of your residence (e.g., Dhaka, Chittagong, Sylhet, Khulna). This data is used to create and authenticate your account, verify your age eligibility (18+), and communicate with you about account activity.
KYC Verification Documents
As part of our Know Your Customer (KYC) and anti-money laundering (AML) obligations, we may request and retain copies of:
- Government-issued photo identification (National ID Card, Passport, or Driving Licence)
- Proof of address documents (utility bills, bank statements dated within 90 days)
- Proof of payment method ownership (bKash, Nagad, or Rocket account screenshots)
These documents are stored in encrypted form and are accessed only by authorised compliance staff. They are not shared with third parties except as required by law or our payment processing partners for identity verification purposes.
Financial Transaction Data
Every deposit and withdrawal transaction processed on cm666 generates a transaction record. We retain transaction amounts (in BDT ৳), timestamps, payment method identifiers (e.g., bKash wallet number last 4 digits, Nagad account reference), transaction status, and any associated bonus activity. Full payment credentials such as complete mobile wallet numbers are never stored on cm666 servers in unmasked form.
Gaming & Betting Activity Data
We log all betting and gaming activity associated with your account, including game selections, wager amounts, bet outcomes, session durations, and bonus redemptions. This data supports fair-play monitoring, responsible gaming tool functionality, and the personalisation of your platform experience.
Technical & Device Data
When you access cm666, our servers automatically collect technical data including your IP address, browser type and version, device type (mobile/desktop), operating system, referring URL, pages visited, and session duration. This data is used for security monitoring, fraud detection, and platform performance analytics.
Sensitive Data: cm666 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is required for identity document verification. If you believe sensitive data has been collected in error, contact our support team immediately at [email protected].
How We Use Your Data
cm666 processes personal data only for specific, documented purposes. We do not sell your personal data to third parties, and we do not use it for purposes beyond those described in this Privacy Policy without first obtaining your consent. The primary purposes for which we process personal data are as follows:
| Purpose | Data Categories Used |
|---|---|
| Account creation & authentication | Name, email, phone number, date of birth, password (hashed) |
| Age & identity verification (KYC) | ID documents, proof of address, payment method proof |
| Payment processing | Transaction data, masked payment identifiers, BDT amounts |
| Fraud & AML monitoring | IP address, device data, transaction patterns, gaming activity |
| Responsible gaming tools | Gaming activity, session data, deposit history, self-exclusion status |
| Customer support | Account data, transaction history, correspondence records |
| Personalisation & promotions | Gaming preferences, activity history, opted-in marketing preferences |
| Legal & regulatory compliance | All categories as required by applicable law or authority instruction |
Marketing Communications
If you have opted in to receive marketing communications during registration or via your account settings, cm666 may send you promotional emails or messages relating to bonuses, new games, seasonal offers (e.g., Eid promotions, BPL cricket season offers, Pohela Boishakh specials), and VIP programme updates. You may withdraw your marketing consent at any time by updating your account preferences or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.
Legal Basis for Processing
cm666 processes personal data on one or more of the following legal bases, depending on the specific processing activity and its purpose:
- Contractual Necessity: Processing is necessary to perform the contract between you and cm666 — i.e., to provide the gaming and betting services you have registered for, process your deposits and withdrawals, and manage your account.
- Legal Obligation: Processing is necessary to comply with applicable legal obligations, including KYC and AML requirements, age verification, the retention of financial records, and cooperation with lawful requests from relevant authorities.
- Legitimate Interests: Processing is necessary for the legitimate interests of cm666, where those interests are not overridden by your privacy rights. Legitimate interests include fraud prevention, platform security, responsible gaming monitoring, and internal analytics for service improvement.
- Consent: Where processing is not covered by the above bases — particularly for optional marketing communications and non-essential cookies — cm666 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
No Automated Decision-Making: cm666 does not make significant decisions about your account — including account suspension, bonus eligibility changes, or withdrawal holds — solely through automated processing without human review. Where automated systems flag an account for review, a qualified compliance team member will assess the case before any material action is taken.
Data Sharing & Disclosure
cm666 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following controlled circumstances, and only to the extent necessary for the specific purpose:
Payment Service Providers
To process deposits and withdrawals, cm666 shares relevant transaction data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. Each of these providers operates under their own privacy and data protection policies and is subject to applicable financial regulations. cm666 shares only the minimum data necessary to authenticate and complete each transaction.
Game Content Providers
Game studios whose content is featured on the cm666 platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive anonymised or pseudonymised gameplay data (e.g., session tokens, game round IDs) to support game delivery, RNG certification audits, and technical issue resolution. These providers do not receive your name, contact details, or payment information through this channel.
Legal & Regulatory Disclosure
cm666 may disclose personal data to relevant authorities, law enforcement bodies, or regulatory agencies where required to do so by law, court order, or regulatory instruction. This includes disclosures required under AML and counter-terrorism financing obligations. cm666 will notify affected players of such disclosures where it is legally permissible to do so.
Service Providers & Processors
cm666 engages a limited number of third-party service providers who process personal data on our behalf as data processors. These include cloud hosting providers, cybersecurity services, and customer support infrastructure providers. All data processors are contractually bound to process personal data only on cm666's documented instructions, to implement appropriate security measures, and not to engage sub-processors without cm666's prior written consent.
International Transfers: Some of cm666's technical and operational service providers are based outside Bangladesh. Where personal data is transferred internationally, cm666 ensures that appropriate safeguards are in place — such as standard contractual clauses or equivalent data protection mechanisms — to maintain the level of protection afforded by this Privacy Policy.
Cookies & Tracking
The cm666 website uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to analyse usage patterns. A cookie is a small text file placed on your device by a website server. Cookies cannot execute programs or deliver viruses to your device.
Types of Cookies Used
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Session management, authentication, security, load balancing. Without these, the platform cannot function. | No (essential) |
| Functional | Remembering language preference, display settings, last-visited game category, and responsible gaming tool configurations. | No (legitimate interest) |
| Analytical | Aggregated, anonymised data on how players navigate the site — used to improve UX, page load times, and game category layouts. | Yes (opt-in) |
| Marketing | Tracking of promotional campaign effectiveness and personalisation of bonus offers. Used only for opted-in players. | Yes (opt-in) |
Managing Cookies
You may control and manage cookie settings through your browser's privacy or settings panel. Most browsers allow you to refuse all cookies, accept all cookies, or receive a notification when a cookie is set. Please note that disabling strictly necessary or functional cookies may impair the performance of the cm666 platform or prevent certain features from functioning correctly.
For analytical and marketing cookies, you may also withdraw your consent at any time via your cm666 account settings panel. Changes take effect within 24 hours.
Data Retention
cm666 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:
- Account Registration Data: Retained for the lifetime of the account, plus a minimum of 5 years following permanent account closure, to satisfy AML and financial record-keeping requirements.
- KYC Documents: Retained for a minimum of 5 years from the date of verification, or for 5 years following account closure, whichever is longer. This period aligns with standard AML regulatory requirements.
- Transaction Records: All deposit and withdrawal records are retained for a minimum of 5 years from the date of each transaction.
- Gaming & Betting Logs: Retained for 2 years from the date of each gaming session, after which they are anonymised or deleted unless required for an active dispute, investigation, or regulatory inquiry.
- Customer Support Correspondence: Retained for 2 years from the date of the last communication, unless the correspondence relates to an ongoing dispute or legal matter.
- Marketing Preference Records: Retained for the duration of account activity, plus 1 year following account closure, to evidence consent status.
Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, it may be retained indefinitely for aggregate statistical or analytical purposes, as it no longer constitutes personal data once anonymised.
Account Closure & Data: If you close your cm666 account, we will delete or anonymise your personal data in line with the retention periods above. We cannot delete data that we are legally required to retain. You will be informed of any data retained post-closure and the legal basis for retaining it upon request.
Your Privacy Rights
As a player on the cm666 platform, you hold the following privacy rights with respect to your personal data. cm666 is committed to honouring these rights and will respond to all valid requests within a reasonable timeframe (generally within 30 days of receipt).
- Right of Access: You have the right to request a copy of all personal data cm666 holds about you, along with information about how that data is being processed. This is commonly known as a Subject Access Request (SAR).
- Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For name, date of birth, or address corrections, we may require supporting documentation.
- Right to Erasure: You may request that cm666 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing on legitimate interests grounds. This right is subject to our legal retention obligations — data we are required by law to retain cannot be erased on request.
- Right to Restriction: You may request that cm666 restrict the processing of your personal data in certain circumstances, such as while a dispute about the accuracy of data is being resolved.
- Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format so that you may transfer it to another service provider.
- Right to Object: You have the right to object to processing of your personal data where that processing is based on cm666's legitimate interests. You may also object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
To exercise any of the above rights, please contact the cm666 Data Protection team via Live Chat or in writing at . Please include your registered account email address and a description of your request so that we can process it efficiently. We may request proof of identity before fulfilling a Subject Access Request or an erasure request.
No Fees: cm666 does not charge a fee for handling standard privacy rights requests. In exceptional circumstances — where a request is manifestly unfounded or excessive — we reserve the right to charge a reasonable administrative fee or to decline the request, and we will explain our reasons for doing so in writing.
Data Security
cm666 takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following controls:
- SSL/TLS Encryption: All data transmitted between your browser or device and the cm666 platform is encrypted using 256-bit SSL/TLS technology. Look for the padlock icon in your browser address bar as confirmation that a secure connection is active.
- Encryption at Rest: Sensitive personal data — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption on cm666 servers.
- Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff who handle personal data are subject to confidentiality obligations, security training, and role-based access controls. No employee can access the full set of your data without documented authorisation.
- Password Security: cm666 does not store your password in plain text. Passwords are hashed using a modern, salted hashing algorithm. cm666 staff can never view your password and will never ask for it.
- Fraud & Intrusion Detection: cm666 employs automated systems to monitor for unusual account activity, login anomalies, and potential intrusion attempts in real time. Suspicious activity triggers immediate alerts and human review.
- Data Breach Response: In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, cm666 will notify affected players without undue delay and take immediate remedial action. A breach summary and mitigation steps will be communicated via the email address on your account.
While cm666 implements robust security measures, no online platform can guarantee absolute security against all possible threats. You play an important role in keeping your account secure by using a strong, unique password, not sharing your login credentials, and logging out from shared devices after each session. If you suspect unauthorised access to your account, contact cm666 support immediately.
Policy Updates & Contact
Updates to This Privacy Policy
cm666 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. The effective date at the top of this page will be updated whenever a revision is made. Where changes are material — such as the introduction of a new category of data sharing or a change in retention periods — cm666 will notify registered players via their account email address at least 7 days before the changes take effect.
Your continued use of the cm666 platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised policy. We encourage you to review this page periodically to stay informed about how we protect your data.
Contact & Data Enquiries
If you have any questions, concerns, or requests relating to this Privacy Policy or to cm666's handling of your personal data, please contact our support team through any of the following channels:
- Live Chat: Available 24/7 via the cm666 platform (Bangladesh Standard Time, UTC+6). Our support agents are trained to handle data and privacy enquiries in English.
- Email: — please include "Privacy Enquiry" in the subject line so that your message is routed to the appropriate team.
cm666 aims to respond to all privacy-related enquiries within 5 business days. For formal Subject Access Requests or erasure requests, the response window is up to 30 days from receipt of a valid, verified request.
Your Trust Matters: cm666 is built on the trust of its players across Bangladesh. We do not monetise your personal data. We do not share your information beyond what is necessary. And we will always be transparent with you about how your data is used. If at any point you feel we have not met that standard, tell us — we take every privacy concern seriously and will investigate promptly.