cd66 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") is issued by cd66 ("cd66", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "the User") who access, register on, or interact with the cd66 online gaming and sports betting platform available at cd66.bio and through the cd66 Android application (collectively, "the Platform").

cd66 is committed to protecting the privacy and personal data of all users of the Platform in accordance with internationally recognised data protection principles. This Policy explains what personal data we collect, the purposes for which it is processed, with whom it may be shared, how long it is retained, and the rights available to you as a data subject.

By registering an account on the cd66 Platform or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood the practices described herein. This Policy should be read alongside the cd66 Terms & Conditions, which govern your use of the Platform as a whole.

2. Data Controller Information

cd66 acts as the data controller in respect of personal data collected through the Platform. As data controller, cd66 determines the purposes and means of processing your personal data. If you have any questions about how your data is handled, or wish to exercise any of your data rights, please contact the cd66 Data Privacy team using the contact details provided in Section 14 of this Policy.

All privacy-related communications with cd66 must be submitted in writing (by email) to ensure a proper record is maintained and to allow cd66 to respond within the applicable timeframe.

3. Personal Data We Collect

cd66 collects personal data through several channels during your interaction with the Platform. The categories of personal data we collect are described in the table below:

Category	Examples of Data Collected	Collection Method
Identity Data	Full name, date of birth, gender, national identity card number, passport number	Registration form, KYC verification submission
Contact Data	Mobile phone number, email address, residential address	Registration form, account settings updates
Financial Data	bKash / Nagad / Rocket / Upay mobile number, bank account details, transaction history, deposit and withdrawal records	Payment processing, transaction logs
Technical Data	IP address, device type, browser type and version, operating system, session duration, pages visited	Automated collection via cookies and server logs
KYC Documentation	Scanned copies of government-issued ID, proof of address documents, selfie or liveness verification images	KYC verification process
Gameplay Data	Game history, bet amounts, win/loss records, session timestamps, responsible gaming tool settings	Platform activity logs
Communications Data	Live chat transcripts, support ticket content, email correspondence with cd66 support	Customer support interactions

3.1 Data You Provide Voluntarily

The majority of personal data cd66 holds about you is data that you have provided directly — for example, during account registration, during the KYC verification process, when contacting customer support, or when updating your account profile. Providing accurate data is a condition of using the Platform; see the cd66 Terms & Conditions for further detail.

3.2 Data Collected Automatically

When you access the cd66 Platform, certain technical data is collected automatically by our servers and through cookies placed on your device. This data is used to maintain your session, detect fraudulent access patterns, and analyse aggregate usage trends to improve the Platform. No individually identifying technical data is used for targeted advertising purposes.

4. How We Use Your Personal Data

cd66 processes your personal data for the following specific purposes:

• Account Creation and Management: To register your account, verify your identity, maintain your account profile, and enable you to access the full range of cd66 services.
• Payment Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and partner banks; to maintain an accurate transaction history; and to investigate payment disputes where they arise.
• KYC and Fraud Prevention: To verify your age, identity, and address in accordance with responsible gaming standards; to detect and prevent fraudulent activity, money laundering, and bonus abuse on the Platform.
• Customer Support: To respond to your enquiries, resolve account issues, and maintain a record of support interactions for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor your gameplay patterns for indicators of problem gambling behaviour; to enforce self-exclusion and deposit limit settings you have activated; and to reach out if our responsible gaming systems flag a concern.
• Platform Improvement: To analyse aggregate usage data, identify technical issues, optimise user experience, and develop new features and game offerings on the Platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates via SMS or email — but only where you have provided explicit consent to receive such communications. You may withdraw consent at any time by contacting cd66 support.
• Legal and Regulatory Compliance: To comply with applicable legal obligations, respond to lawful requests from authorities, and maintain records as required by law.

5. Legal Basis for Processing

cd66 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform the contract between cd66 and you (i.e., the Terms & Conditions) — for example, processing your deposits or verifying your account before a withdrawal is released.
• Legal Obligation: Processing is required for cd66 to comply with applicable laws — for example, retaining transaction records or conducting KYC checks.
• Legitimate Interests: Processing is necessary for cd66's legitimate business interests, provided those interests are not overridden by your rights — for example, fraud detection, platform security monitoring, and aggregate analytics.
• Consent: Where processing is based on your consent — for example, sending promotional SMS messages — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Sharing of Personal Data

cd66 does not sell, rent, or commercially trade your personal data. We may share your data with the following categories of third parties, strictly limited to the extent necessary to deliver the cd66 service or to comply with legal obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank — to process your deposits and withdrawals. These providers act as independent data controllers for the data they receive in connection with payment transactions.
• KYC and Identity Verification Partners: Third-party identity verification services used to validate your identity documents and perform liveness checks during the KYC process.
• Game Content Providers: Certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised session identifiers necessary to operate games within the Platform. These providers do not receive your full personal profile.
• IT Infrastructure and Hosting Providers: Cloud hosting and data centre partners who store Platform data on behalf of cd66 under strict data processing agreements that prohibit any independent use of your data.
• Legal and Regulatory Authorities: cd66 will disclose personal data to law enforcement, courts, or regulatory bodies where required to do so by a lawful order, legal process, or regulatory requirement. cd66 will notify you of such a disclosure where it is legally permitted to do so.
• Anti-Fraud and Security Services: Third-party fraud detection providers that analyse transaction patterns and access logs to identify suspicious activity. Data shared with these providers is subject to confidentiality obligations.

7. International Data Transfers

cd66 operates primarily within Bangladesh and processes the majority of personal data using infrastructure located in the Asia-Pacific region. Where personal data is transferred to a third-party service provider located outside Bangladesh, cd66 takes steps to ensure that appropriate safeguards are in place to protect that data, including contractual data processing agreements that impose data protection obligations equivalent to those applied by cd66 itself.

By using the cd66 Platform, you acknowledge that your data may be transferred to and processed in countries outside Bangladesh where the laws governing data protection may differ from those in Bangladesh. In all cases, cd66 applies a consistent standard of data protection regardless of where processing takes place.

8. Data Retention

cd66 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or audit obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction and Financial Data: Retained for a minimum of five years from the date of the relevant transaction, in accordance with financial record-keeping obligations.
• KYC Documentation: Retained for a minimum of five years from the date of submission, or longer if required by applicable law.
• Support Communications: Retained for three years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and Log Data: Retained for up to 12 months from collection, unless a longer period is required for an active security investigation.
• Marketing Consent Records: Retained for the duration of your account and for one year following withdrawal of consent, to demonstrate compliance with consent obligations.

When personal data is no longer required for any legitimate purpose, cd66 will securely delete or anonymise it in accordance with our internal data disposal procedures.

9. Cookies and Tracking Technologies

The cd66 Platform uses cookies — small text files placed on your device — and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies maintain your login session, remember your language and regional settings, and protect the Platform against cross-site request forgery. These cookies cannot be disabled without affecting the functionality of the Platform.
• Performance and Analytics Cookies: Used to collect anonymised information about how visitors use the Platform — for example, which pages are visited most frequently and where errors are encountered. This data is used solely in aggregate form to improve Platform performance.
• Preference Cookies: Used to remember choices you have made on the Platform, such as your preferred game category or display settings, so that you do not need to re-enter those preferences on each visit.

cd66 does not use advertising cookies, cross-site tracking cookies, or any technology that tracks your activity on websites or applications outside of the cd66 Platform. You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling cookies may affect the functionality of certain Platform features.

10. Security Measures

cd66 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the cd66 Platform;
• AES-256 encryption for sensitive data stored in cd66 databases, including financial records and identity documents;
• Role-based access controls that limit employee access to personal data to those with a legitimate operational need;
• Two-factor authentication (2FA) requirements for cd66 staff accessing production systems and administrative interfaces;
• Regular security audits, vulnerability assessments, and penetration testing conducted by qualified third-party security professionals;
• Automated monitoring and alerting systems that detect anomalous access patterns and trigger incident response procedures.

While cd66 takes all reasonable steps to protect your personal data, no system of data transmission or storage can be guaranteed to be 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cd66 will notify you without undue delay through the contact details registered on your account.

11. Your Data Rights

As a data subject, you hold the following rights in respect of the personal data that cd66 processes about you. To exercise any of these rights, please contact the cd66 Data Privacy team using the details in Section 14. cd66 will respond to all verified data rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data cd66 holds about you, along with information about how it is being used.
• Right to Rectification: You have the right to request that cd66 corrects any inaccurate or incomplete personal data held about you.
• Right to Erasure: You have the right to request that cd66 deletes your personal data where it is no longer necessary for the purpose for which it was collected, subject to cd66's legal record-keeping obligations.
• Right to Restriction of Processing: You have the right to request that cd66 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to Data Portability: You have the right to receive a copy of personal data you have provided to cd66 in a structured, commonly used, and machine-readable format, and to transmit that data to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on cd66's legitimate interests. cd66 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Please note that certain rights are subject to limitations under applicable law — for example, cd66 cannot delete transaction records that must be retained for anti-money laundering compliance purposes, even upon a valid erasure request.

12. Children's Privacy

The cd66 Platform is strictly intended for individuals who are 18 years of age or older. cd66 does not knowingly collect or process personal data from persons under the age of 18. If cd66 becomes aware that personal data has been collected from a person under 18, that data will be deleted immediately and the associated account will be closed.

If you are a parent or guardian and believe that your child has registered an account on the cd66 Platform, please contact the cd66 support team immediately at the contact details provided in Section 14 so that the matter can be investigated and resolved promptly.

13. Changes to This Privacy Policy

cd66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. Where changes are material, cd66 will provide notice to registered users via the email address or mobile number associated with their account, or by displaying a prominent notice on the Platform, prior to the changes taking effect.

The revised Policy will clearly state the date on which it becomes effective. Your continued use of the cd66 Platform following the effective date of any revised Policy constitutes your acceptance of those changes. We encourage you to review this Policy periodically to stay informed about how cd66 protects your personal data.

14. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about the way in which cd66 has handled your personal data, please contact the cd66 Data Privacy team. All privacy communications must be submitted by email. The cd66 support and data privacy email address is displayed below as plain text and is not a clickable link:

Data Privacy Contact: [email protected]

cd66 will acknowledge all written privacy enquiries within five business days and will aim to provide a substantive response within 30 calendar days. Where a request is complex or where a high volume of requests has been received, cd66 may extend the response period by a further 60 days, with notification provided to you within the initial 30-day window.

If you are not satisfied with cd66's response to your privacy complaint, you have the right to escalate the matter to the relevant data protection authority or regulatory body in your jurisdiction.