Privacy Policy — 663but

1. Introduction

This Privacy Policy ("Policy") describes how 663but, accessible at 663but.cam ("Platform", "we", "us", "our"), collects, uses, stores, shares and protects personal information relating to users who access or interact with the Platform ("you", "your", "User").

663but operates as an English-language online betting and live casino information platform. The Platform provides informational and entertainment content about sports betting, live casino games, odds, bonuses, responsible gambling tools and related topics, targeting users in Pakistan — including those in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan and Peshawar — and internationally.

We are committed to protecting your privacy and handling your personal data with care, transparency and respect. By using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform.

2. Definitions

• "Personal Data" means any information that identifies or can identify a natural person, directly or indirectly — including name, email address, date of birth, IP address and financial identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, the Operator of the 663but Platform.
• "Data Processor" means a third party that Processes Personal Data on behalf of the Data Controller under a written agreement.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, analytics and preference storage.
• "KYC" (Know Your Customer) means the identity and documentation verification process required by anti-money laundering regulations before certain account transactions are processed.
• "Special Category Data" means sensitive Personal Data such as health information, which the Platform does not intentionally collect unless required by the responsible-gambling self-exclusion process.

3. Data Controller

The Data Controller for Personal Data collected through the Platform is the operator of 663but.cam. Contact details for data-related enquiries are provided in Section 15 of this Policy. Where third-party Data Processors handle Personal Data on our behalf — such as payment service providers, identity verification services and analytics platforms — they do so under data processing agreements that require them to protect your data to at least the same standard as this Policy.

4. Personal Data We Collect

4.1 Data You Provide Directly

When you register an Account or interact with the Platform, we may collect the following categories of Personal Data:

• Identity Data: Full legal name, date of birth, gender (where relevant to account verification).
• Contact Data: Email address, phone number (where provided), residential address.
• Identity Verification (KYC) Data: Copies of government-issued identification (such as a CNIC — Computerised National Identity Card — or passport), proof of address documents, and payment-method verification documents.
• Financial Data: Payment method details sufficient to process deposits and withdrawals (e.g., Easypaisa account reference, JazzCash number, bank account details from HBL, UBL, Meezan Bank or Bank Alfalah, or card details). We do not store full card numbers on our servers; card data is handled by PCI-DSS compliant payment processors.
• Account Preferences: Language preference, notification settings, responsible-gambling limit configurations.
• Communications Data: Content of messages sent to support via Live Chat or email.

4.2 Data Collected Automatically

When you use the Platform, certain data is collected automatically by our servers and analytics systems:

• Device & Technical Data: IP address, browser type and version, operating system, device type and screen resolution.
• Usage Data: Pages visited, time spent on pages, links clicked, search queries within the Platform, betting and gaming activity patterns.
• Location Data: Country and city-level location inferred from IP address. The Platform does not access GPS or precise device location.
• Session Data: Login timestamps, session duration, logout events.
• Cookie and Tracking Data: As described in Section 7.

5. Lawful Basis for Processing

We process your Personal Data on one or more of the following lawful bases:

6. How We Use Your Personal Data

663but uses collected Personal Data for the following purposes:

• Account Management: Creating, maintaining and administering your account, verifying your identity, managing your login credentials and account settings.
• Transaction Processing: Processing deposits, withdrawals, bonus credits, cashback payments and any other financial transactions associated with your account. Payment method references (Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank, Bank Alfalah) are used solely for payment processing and KYC purposes.
• Platform Delivery: Providing access to sports betting markets, live casino content, instant games, and all other Platform features and content.
• Regulatory Compliance: Fulfilling KYC, AML and other legal obligations applicable to the operator's license jurisdiction.
• Customer Support: Responding to enquiries, resolving disputes and providing technical assistance through Live Chat and email support.
• Responsible Gambling: Administering deposit limits, loss limits, session timers, cooling-off periods and self-exclusion requests. Where applicable, sharing self-exclusion data with industry-wide exclusion registers as required by license conditions.
• Security & Fraud Prevention: Detecting, investigating and preventing fraudulent activity, abuse of promotions, money laundering, multi-accounting and other prohibited conduct.
• Platform Improvement: Analysing aggregate and anonymised usage data to improve content, navigation, performance and user experience.
• Marketing Communications: Sending promotional emails or in-Platform notifications about bonuses, new features and events — only where you have provided consent or where permitted under legitimate interests, and with an easy opt-out on every communication.

7. Cookies & Tracking Technologies

The Platform uses cookies and similar technologies (local storage, session storage, pixel tags) to provide core functionality, remember your preferences and understand how users interact with the Platform. The following cookie categories are used:

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies and browse in private/incognito mode. Disabling certain cookies may impair Platform functionality. The Platform does not currently respond to browser Do Not Track (DNT) signals.

8. Data Sharing & Third Parties

663but shares your Personal Data with third parties only where necessary and under appropriate safeguards. Categories of third-party recipients include:

• Payment Service Providers: To process your deposits and withdrawals. Payment data shared with PSPs is limited to what is necessary for transaction execution and fraud screening.
• Identity Verification (KYC) Providers: To verify your identity documents and conduct AML screening as required by applicable license obligations.
• Technology & Infrastructure Providers: Cloud hosting providers, content delivery networks and database services that store and process Platform data under strict contractual data protection obligations.
• Analytics Providers: Aggregate and anonymised usage data may be processed by analytics platforms to help us improve the Platform. No personally identifiable information is shared for analytics purposes where avoidable.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order or regulatory instruction, we may disclose Personal Data to competent authorities. We will notify you of such disclosures where legally permitted to do so.
• Responsible Gambling Registers: Where required by license conditions, self-exclusion data may be shared with multi-operator exclusion schemes.

9. Data Retention

663but retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention principles include:

• Active Accounts: Personal Data is retained for the duration of your active account relationship with the Platform.
• Closed Accounts: Following account closure, Personal Data required for AML compliance, tax reporting and dispute resolution is retained for a minimum of five (5) years from the date of account closure, or longer if required by applicable law.
• KYC Documents: Identity verification documents are retained for at least five (5) years following the end of the business relationship or the completion of the relevant transaction, in accordance with standard AML record-keeping obligations.
• Marketing Data: Where retained for marketing purposes based on consent, data is held until you withdraw consent or opt out, at which point it is promptly deleted from marketing lists.
• Log and Technical Data: Server logs and technical access records are typically retained for twelve (12) months for security and fraud-prevention purposes, after which they are anonymised or deleted.

10. Security Measures

663but implements technical and organisational measures designed to protect your Personal Data against unauthorised access, alteration, disclosure or destruction. These measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your device and the Platform.
• Encryption at rest for stored sensitive Personal Data including KYC documents and financial records.
• Role-based access controls limiting internal access to Personal Data to personnel with a legitimate need.
• Regular security assessments and vulnerability testing of Platform infrastructure.
• Two-factor authentication options for user accounts.
• Incident response procedures for detecting, containing and reporting data security events.

11. User Rights

Subject to applicable law and certain legal exceptions, you hold the following rights in respect of your Personal Data processed by 663but:

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data held about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where there is no longer a legitimate or legal basis for us to retain it. Note that legal retention obligations (e.g., AML record-keeping) may prevent immediate erasure of certain data.
• Right to Restriction of Processing: You may request that we restrict Processing of your Personal Data in certain circumstances, for example while a rectification request is being resolved.
• Right to Data Portability: Where Processing is based on consent or contract and carried out by automated means, you may request that your Personal Data be provided to you in a structured, machine-readable format.
• Right to Object: You may object to Processing based on legitimate interests, including profiling, and to Processing for direct marketing purposes. Marketing opt-outs take immediate effect.
• Right to Withdraw Consent: Where Processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior Processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to the Operator's license.

To exercise any of the above rights, please contact us using the details in Section 15. We will respond to verified requests within a reasonable timeframe and in no event later than as required by applicable law. We may need to verify your identity before processing a data rights request.

12. Minors

The Platform is strictly for use by adults aged 18 years or older — or the higher minimum age required by the operator or applicable license jurisdiction. 663but does not knowingly collect, process or store Personal Data relating to minors. If we become aware that Personal Data has been submitted by or on behalf of a person under the minimum age, the associated account will be immediately closed and all data deleted, subject to any legal retention obligations.

If you believe that a minor has submitted Personal Data to the Platform, please notify us immediately via the contact details in Section 15.

13. International Data Transfers

The Platform may be operated from, or use service providers based in, jurisdictions outside Pakistan. Where Personal Data is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place — such as data processing agreements incorporating standard contractual clauses or equivalent transfer mechanisms — to protect your data to a standard comparable to the protections described in this Policy.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries other than your country of residence, which may have different data protection laws.

14. Changes to This Policy

663but reserves the right to update or modify this Privacy Policy at any time. Where changes are material, we will notify registered users by email or via a prominent in-Platform notice prior to the changes taking effect. The "Last reviewed" date at the top of this page will be updated accordingly.

Continued use of the Platform following the effective date of a revised Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you should cease using the Platform and may request account closure in accordance with the Terms and Conditions.

15. Contact Us

For any data protection or privacy-related enquiry, request or complaint, please contact the 663but privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line. Responses are provided within 24 hours for general enquiries and within the applicable legal timeframe for formal data rights requests.
• Live Chat: Available 24/7 via the in-Platform Live Chat widget. For complex data rights requests, our team will escalate your query to the appropriate internal team and issue a written response by email.
• Help Centre: For formal complaints and Subject Access Requests, submitting a ticket through the Help Centre ensures your request receives a tracked case reference number and a documented resolution.

Support is provided in English. Urdu-language assistance is available on request during staffed hours. Pakistan Standard Time coverage is maintained during peak cricket match days and high-activity periods.