Nibbit Hotel — Privacy Policy

Last updated: January 6, 2026

This Privacy Policy explains how 66 Entertainment (Netherlands) (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you use Nibbit Hotel (the “Service”).

1. Who We Are (Controller)

Controller: 66 Entertainment (Netherlands)
Service name: Nibbit Hotel
Primary domain: nibbit.ws
Contact email: [email protected]

2. Data We Collect

Depending on how you use the Service, we may collect the following categories of personal data:

• Account data: email address, username, account identifiers, authentication data (hashed passwords).
• Technical data: IP address, device and browser information, timestamps, approximate location inferred from IP.
• Usage data: gameplay actions, in-game activity, room interactions, event participation.
• Logs and communications: chat logs, moderation logs, reports, support communications.
• Transaction-related data: purchase history and product identifiers (we do not intentionally store full payment card data if processed by third-party payment providers).

3. Why We Use Your Data (Purposes)

• Provide the Service: account creation, login, gameplay, virtual economy, community features.
• Safety and moderation: preventing abuse, enforcing rules, investigating reports, handling bans and appeals.
• Security: fraud prevention, detecting hacking/exploits, DDoS mitigation, access control.
• Support: responding to inquiries and resolving issues.
• Service improvement: debugging, analytics, performance monitoring, feature improvements.
• Legal compliance: meeting legal obligations and responding to lawful requests.

4. Legal Bases (GDPR)

Where the GDPR applies, we process personal data under one or more of the following legal bases:

• Contract: to provide the Service you request (account, gameplay, in-game features).
• Legitimate interests: security, moderation, preventing fraud/abuse, and improving the Service.
• Legal obligation: where required by law or lawful authority.
• Consent: only where we explicitly ask for it (and you may withdraw it at any time).

5. Sharing Your Data

We do not sell your personal data. We may share data only as necessary:

• Service providers: hosting, infrastructure, security, analytics, and support tooling providers that process data on our behalf under appropriate agreements.
• Legal and safety reasons: if required by law, court order, or lawful government request; or to protect users, our rights, and the integrity of the Service.

6. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, including:

• Account data: while your account remains active and as needed for security and compliance.
• Logs (including chat/moderation logs): retained for a period appropriate to moderation, safety, and legal needs.
• Support communications: retained as needed to resolve issues and for record-keeping.

We may retain certain data longer where required by law or where necessary to establish, exercise, or defend legal claims.

7. Security

We implement reasonable technical and organizational measures to protect personal data, including access controls, logging, and security monitoring. However, no online service can guarantee absolute security. You are responsible for keeping your account credentials confidential.

8. Children’s Privacy

The Service is intended for users aged 13+. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, contact us at [email protected] and we will take appropriate steps.

9. Your Rights (GDPR)

Depending on your location, you may have rights over your personal data, including:

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Deletion (“right to be forgotten”), in certain circumstances.
• Restriction of processing, in certain circumstances.
• Objection to processing based on legitimate interests.
• Data portability, where applicable.
• Withdraw consent, where processing is based on consent.

To exercise these rights, contact us at [email protected]. We may need to verify your identity before fulfilling requests.

10. Complaints

If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

11. Cookies and Similar Technologies

We may use cookies or similar technologies for essential functionality (such as sessions/login), security, and basic analytics. You can control cookies through your browser settings. Disabling cookies may affect functionality of the Service.

12. International Transfers

If we transfer personal data outside your country/region, we will take steps to ensure appropriate safeguards are in place as required by applicable law (for example, under GDPR transfer mechanisms where applicable).

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates when changes take effect. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact

For privacy questions or requests, contact us at [email protected].