ithaca 66 Privacy Policy — Your Data, Handled With Care

1 Personal Data We Collect

ithaca 66 collects personal data in the following categories when you register, transact, or interact with the platform:

ithaca 66 does not collect special-category data (such as health information or biometric data) unless expressly required for responsible gaming interventions under applicable regulatory guidance, and only with your explicit consent in those circumstances.

2 How ithaca 66 Uses Your Personal Data

Personal data collected by ithaca 66 is used for the following purposes:

• Account Management: Creating, maintaining, and administering your ithaca 66 player account, including processing your ithaca 66 Login credentials securely.
• Identity Verification (KYC): Confirming your age (18+), identity, and payment method ownership as required by our operating licence and anti-money-laundering obligations.
• Transaction Processing: Processing PKR deposits and withdrawals via Easypaisa, JazzCash, SadaPay, and other accepted methods; applying bonuses and settling game outcomes.
• Platform Security: Detecting and preventing fraud, duplicate accounts, bonus abuse, and unauthorised access to ithaca 66 accounts.
• Responsible Gaming: Monitoring account activity to identify patterns consistent with problem gambling and applying player-protection measures where necessary, including deposit limit enforcement and self-exclusion management.
• Customer Support: Responding to queries, complaints, and requests submitted to ithaca 66 support by players in Pakistan.
• Legal and Regulatory Compliance: Retaining records as required by our operating licence, applicable anti-money-laundering legislation, and regulatory bodies.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the ithaca 66 platform, game selection, and user experience.
• Marketing Communications: Sending promotional communications about ithaca 66 offers and new features to players who have opted in to receive them. You may opt out at any time through account settings.

3 Legal Basis for Processing Your Data

ithaca 66 processes personal data under one or more of the following legal bases:

• Contractual Necessity: Processing required to fulfil the ithaca 66 player account agreement — including identity verification, transaction processing, and account management.
• Legal Obligation: Processing required to comply with applicable anti-money-laundering law, licensing conditions, and other regulatory requirements under which ithaca 66 operates.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your data protection rights.
• Consent: Processing for optional marketing communications, where you have provided clear, freely given consent at registration or through account settings. You may withdraw consent at any time.

4 Sharing Your Personal Data

ithaca 66 does not sell your personal data. We may share data with the following categories of third parties only where necessary and proportionate:

• Payment Processors: Easypaisa, JazzCash, SadaPay, and other payment providers require transaction data to process PKR deposits and withdrawals on your behalf.
• Identity Verification Providers: Third-party KYC services used to verify player age and identity as required by ithaca 66's operating licence.
• Game Providers: Certified game studios whose products are offered on the ithaca 66 platform may receive session identifiers to enable game play; they do not receive full player identity data.
• Cloud and Infrastructure Providers: Hosting and data infrastructure providers who process data under strict contractual data-protection obligations and are not permitted to use it for their own purposes.
• Regulatory and Law Enforcement Authorities: Where ithaca 66 is legally required to disclose information to a competent authority, regulator, or law enforcement body, including in connection with anti-money-laundering investigations.
• Professional Advisers: Legal, audit, and compliance advisers bound by professional confidentiality obligations.

Any third party that processes personal data on behalf of ithaca 66 is required to do so under a written data-processing agreement that restricts use to the specified purpose and requires appropriate security measures.

5 Cookies and Tracking Technologies

The ithaca 66 website uses cookies and similar tracking technologies to operate the platform, maintain your session, and analyse usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the ithaca 66 platform to function — including maintaining your login session and remembering security settings. These cannot be disabled without affecting core functionality.
• Analytical Cookies: Used to collect anonymised data about how players navigate the ithaca 66 platform, helping us identify and fix usability issues and improve the gaming experience.
• Preference Cookies: Store non-essential preferences such as language and display settings to personalise your ithaca 66 experience.
• Marketing Cookies: Used where you have consented to receive relevant ithaca 66 promotional content. These cookies are not set without your prior consent.

You can manage or withdraw cookie consent at any time through your browser settings or via the cookie preference centre accessible from the ithaca 66 website footer. Disabling analytical or marketing cookies will not affect your ability to use the platform.

6 Data Retention

ithaca 66 retains personal data for as long as your account is active and for a defined period thereafter, as required by applicable legal and regulatory obligations. Indicative retention periods are as follows:

• Account and Identity Data: Retained for the lifetime of your ithaca 66 account plus a minimum of five (5) years following account closure, as required for anti-money-laundering compliance.
• Transaction Records: PKR transaction records, including deposits and withdrawals via Easypaisa, JazzCash, and SadaPay, are retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Customer support records are retained for three (3) years from the date of the last interaction, unless the matter involves an ongoing complaint or legal proceedings.
• Marketing Consent Records: Records of your marketing preferences are retained for the lifetime of your account to demonstrate compliance with consent requirements.
• Technical and Usage Logs: Session and security logs are retained for up to twelve (12) months for fraud prevention and platform security purposes, then deleted or anonymised.

7 How ithaca 66 Protects Your Data

ithaca 66 implements a layered security architecture to protect personal data against unauthorised access, accidental loss, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your device and ithaca 66 is encrypted using industry-standard TLS protocols. Your ithaca 66 Login session is always conducted over an encrypted connection.
• Encryption at Rest: Sensitive personal data, including identity and financial records, is encrypted in storage using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to ithaca 66 personnel and authorised third parties with a documented operational need. Access is controlled by role-based permissions and subject to regular review.
• Monitoring and Incident Response: ithaca 66 operates continuous security monitoring and maintains a documented incident response procedure. In the event of a data breach affecting your personal data, we will notify you and the relevant authority within the timeframes required by applicable law.
• Third-Party Security Standards: Payment processors, game providers, and infrastructure partners are required to demonstrate equivalent or higher security standards as a condition of their engagement with ithaca 66.

8 Your Data Rights

As an ithaca 66 player, you hold the following rights over your personal data. To exercise any of these rights, contact ithaca 66 support with your verified account details:

• Right of Access: Request a copy of all personal data ithaca 66 holds about you. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: Request correction of inaccurate or incomplete personal data. Some corrections may require supporting documentation for verification purposes.
• Right to Erasure: Request deletion of your personal data where it is no longer necessary for its original purpose and ithaca 66 is not required by law to retain it.
• Right to Restriction: Request that ithaca 66 pauses processing of your data while an accuracy dispute or objection is being assessed.
• Right to Object: Object to processing based on legitimate interests, including direct marketing. Marketing-related objections take effect immediately.
• Right to Data Portability: Request a structured, machine-readable copy of data you provided to ithaca 66 for transfer to another controller where technically feasible.
• Right to Withdraw Consent: Withdraw previously given consent for optional processing (such as marketing) at any time through your account settings without affecting the lawfulness of prior processing.

ithaca 66 will not charge a fee for handling data rights requests in standard circumstances. We may request proof of identity before processing a request to protect against fraudulent data access attempts.

9 Children's Privacy — 18+ Platform

ithaca 66 is strictly an adult platform. We do not knowingly collect, process, or retain personal data from individuals under the age of 18. Age verification is applied during registration to enforce this requirement.

If ithaca 66 becomes aware that personal data of a person under 18 has been collected — whether through a misrepresentation at registration or any other means — that data will be deleted immediately, the associated account will be closed, and any PKR balance held will be reviewed in accordance with our Terms & Conditions.

10 International Data Transfers

ithaca 66 may transfer personal data to servers or service providers located outside Pakistan in the course of operating the platform, including for cloud hosting, identity verification, and game delivery services. Where such transfers occur, ithaca 66 ensures that appropriate safeguards are in place, including contractual protections that require the recipient to handle your data to a standard equivalent to that described in this Privacy Policy.

ithaca 66 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing supplementary safeguards as required by applicable law.

11 Changes to This Privacy Policy

ithaca 66 may update this Privacy Policy from time to time to reflect changes in our data-processing practices, legal obligations, or regulatory guidance. When changes are material — meaning they significantly affect how your data is used or what rights you hold — we will notify registered players via their account dashboard prior to the changes taking effect.

The effective date displayed at the top of this page is always the current operative version. We encourage you to review this page periodically to stay informed about how ithaca 66 handles your personal data. Your continued use of the ithaca 66 platform following notification of an updated Privacy Policy constitutes acceptance of the revised terms.

12 Contact Us and Raising a Privacy Complaint

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how ithaca 66 has handled your personal data, please contact us:

• Email: [email protected] (plain text — not a clickable link)
• Response Timeframe: ithaca 66 acknowledges privacy enquiries within 5 business days and aims to resolve them within 30 calendar days.
• Language: English — our support team operates in English and understands the Pakistan market context.

If you are not satisfied with ithaca 66's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection authority or to seek independent dispute resolution as described in the ithaca 66 Terms & Conditions.