663but Privacy Policy

1 Introduction

663but ("663but", "we", "us", "our") operates the online casino and sports betting platform accessible at 663but.net (the "Platform"). We are committed to protecting the privacy of all individuals who interact with the Platform, including registered users ("Users", "you", "your"), visitors browsing without an account, and individuals who contact our support team.

This Privacy Policy ("Policy") sets out what personal data we collect from you, for what purpose, on what legal basis, how long we retain it, and your rights in relation to that data. This Policy should be read together with the 663but Terms & Conditions, which govern your use of the Platform more broadly.

If you are a Pakistani user — whether based in Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad or elsewhere in Pakistan — this Policy applies to you in full. By registering a 663but account or continuing to use the Platform after this Policy has been updated, you acknowledge and consent to the data practices described herein.

2 Data We Collect

663but collects personal data that falls into the following categories:

663but does not intentionally collect special category data (e.g., racial or ethnic origin, health data, religious beliefs) and asks that you do not submit such information through any Platform channel.

3 How We Collect Data

663but collects personal data through the following means:

• Direct submission: When you register an account, complete KYC verification, make a deposit, request a withdrawal or contact the support team, you provide data directly to 663but.
• Automated collection: As you use the Platform, technical and usage data is collected automatically through server logs, session tokens and first-party analytics tools. This data is collected without identifying you personally unless you are logged in to your 663but account.
• Payment processors: When you deposit or withdraw via JazzCash, Easypaisa or a bank transfer, the relevant payment provider shares transaction confirmation data with 663but for reconciliation purposes. The payment provider's own privacy policy governs how they handle your data on their side.
• Identity verification providers: Where 663but uses a third-party KYC provider to verify CNIC documents or other identity materials, that provider processes the document data and returns a verification result to 663but. The raw document data is handled according to the KYC provider's data processing agreement with 663but.

4 Purpose of Processing

663but processes your personal data for the following specific purposes:

• To create and manage your 663but account, including authentication and account security.
• To process deposits and withdrawals through JazzCash, Easypaisa, bank transfer and USDT TRC20, and to maintain accurate financial records.
• To verify your identity in compliance with applicable anti-money laundering and know-your-customer obligations.
• To settle bets, resolve disputes and maintain accurate records of all betting and gaming activity conducted through your account.
• To provide customer support, respond to queries and investigate complaints.
• To send account-related notifications, such as deposit confirmations, withdrawal approvals and security alerts. Where you have opted in, to send promotional communications about 663but offers and bonuses.
• To improve the Platform through anonymised usage analytics.
• To detect and prevent fraud, account abuse, money laundering and other prohibited activities.
• To comply with applicable legal and regulatory obligations.

5 Legal Basis for Processing

663but processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil the contract with you when you register an account and use the Platform — including account management, payment processing and bet settlement.
• Legal obligation: Processing required to comply with applicable anti-money laundering laws, KYC obligations and any lawful regulatory requests.
• Legitimate interests: Processing carried out to protect the security and integrity of the Platform, prevent fraud and improve the user experience through anonymised analytics.
• Consent: Where you have provided explicit consent — for example, to receive promotional emails or SMS notifications about 663but bonuses and offers. You may withdraw this consent at any time by contacting support.

6 Data Sharing

663but does not sell, rent or otherwise transfer your personal data to third parties for their own commercial purposes. Data may be shared in the following limited circumstances:

• Payment processors: Transaction data is shared with JazzCash, Easypaisa, banking partners and USDT processing infrastructure as necessary to execute your deposit and withdrawal instructions.
• Identity verification providers: Identity document data is shared with certified KYC providers for the purpose of verifying your account in compliance with applicable obligations.
• Game content providers: Your in-session gameplay data (e.g., bet amounts, game round IDs) may be transmitted to the licensed game studios whose titles you play, for the purpose of game functionality and RNG certification compliance.
• Regulatory and legal authorities: Where required by applicable law, court order or regulatory directive, 663but will disclose personal data to the relevant authority. We will notify you where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition or sale of assets involving 663but, your personal data may form part of the transferred assets. You will be notified of any such change via the Platform or your registered contact details.

7 Payment Data

663but does not store full payment credentials on its own servers. JazzCash wallet numbers, Easypaisa account identifiers and bank account details are tokenised or handled entirely by the respective payment processor infrastructure. 663but retains only transaction reference data (amounts, timestamps, transaction IDs) necessary for reconciliation, dispute resolution and regulatory reporting.

USDT TRC20 wallet addresses used for deposits are retained in transaction records as part of standard financial record-keeping. These are blockchain-public addresses and do not on their own constitute sensitive personal data.

If you believe any payment information held by 663but is inaccurate, contact support and the relevant record will be reviewed and corrected where appropriate.

8 Cookies

663but uses the following categories of cookies on the Platform:

• Essential cookies: Required for core Platform functionality, including session management after login, bet slip persistence and security tokens. These cannot be disabled without breaking basic Platform features.
• Analytics cookies: First-party anonymised analytics cookies used to understand aggregated usage patterns — which sections of the Platform are visited most, average session durations and device types. No personally identifiable data is included in these analytics.
• Preference cookies: Used to remember display preferences such as language settings where applicable.

663but does not place third-party advertising or behavioural tracking cookies without your explicit consent. You may manage cookie preferences through your browser settings. Note that disabling essential cookies may prevent you from accessing your 663but account.

9 Data Retention

663but retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data and KYC documents are retained for a minimum of five years from account closure, in compliance with applicable anti-money laundering record-keeping obligations.
• Financial transaction records (deposits, withdrawals, bet history) are retained for a minimum of five years for regulatory and dispute resolution purposes.
• Support communications are retained for two years following resolution of the relevant query.
• Technical and usage logs are retained for up to 12 months for security and fraud detection purposes, after which they are anonymised or deleted.

After the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to a specific individual.

10 Data Security

663but implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration or disclosure. Specific measures include:

• TLS/SSL encryption on all data transmitted between your device and the 663but Platform.
• Access controls ensuring that only authorised personnel can access personal data, on a need-to-know basis.
• Encrypted storage for sensitive account data.
• Regular security assessments and vulnerability testing.
• SMS verification for new device logins and account recovery flows.

Despite these measures, no system is entirely immune to security incidents. In the event of a data breach that poses a risk to your rights and interests, 663but will notify affected users via their registered contact details in a timely manner.

11 Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by 663but:

• Access: You may request a copy of the personal data 663but holds about you.
• Correction: You may request correction of inaccurate or incomplete personal data.
• Deletion: You may request deletion of your personal data, subject to retention obligations that prevent immediate deletion (e.g., regulatory record-keeping requirements).
• Restriction: You may request that 663but restricts processing of your data in certain circumstances, for example while a dispute about accuracy is being resolved.
• Withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Objection: You may object to processing carried out on the basis of legitimate interests, subject to 663but's ability to demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, contact the 663but support team. We will respond within five business days for standard requests and within one month for complex or multiple requests. We will not charge a fee for reasonable requests.

12 Children's Data

The 663but Platform is strictly for individuals aged 18 and above. 663but does not knowingly collect personal data from any individual below the age of 18. If 663but becomes aware that personal data has been submitted by a minor, that data will be deleted and the associated account will be suspended immediately.

If you believe a minor has registered a 663but account, please contact support immediately so the account can be investigated and closed without delay.

13 Third-Party Links

The 663but Platform may contain links to third-party services such as payment providers or game content portals. These third-party services operate under their own privacy policies, which are separate from and not covered by this Policy. 663but is not responsible for the data practices of third-party services you interact with via the Platform.

We encourage you to review the privacy policy of any third-party service before submitting personal data to it.

14 Changes to This Policy

663but reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered users via the Platform or by notification to the registered mobile number or email address. The updated Policy will display a revised "Last updated" date at the top of this page.

Continued use of the 663but Platform following publication of an updated Policy constitutes acceptance of the revised terms. If you do not accept the revised Policy, you should discontinue use of the Platform and contact support to close your account.

15 Contact Us

For any questions, concerns or requests relating to this Privacy Policy or the personal data 663but holds about you, please contact the support team via live chat — available 24 hours a day, 7 days a week, in English with Urdu-friendly assistance available on request.

Written correspondence may be submitted to: [email protected]

663but will acknowledge privacy-related requests within 24 hours and provide a substantive response within five business days for straightforward matters, or within one calendar month for complex requests involving significant data access or deletion.