cd66 Privacy Policy — Your Data, Your Rights

This Privacy Policy ("Policy") is issued by cd66 ("cd66", "we", "us", "our") and describes how we collect, process, store, share and protect personal data relating to individuals ("you", "your", "User", "Player") who access or use the cd66 website at cd66.im and any associated services, including online casino games, sports betting markets, promotional programmes and customer support channels (collectively, the "Platform").

This Policy applies to all personal data processed in connection with your use of the cd66 Platform, regardless of whether you are a registered account holder, a visitor browsing the Platform without an account, or a person who contacts our support team. By accessing the Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside the cd66 Terms & Conditions, which govern the overall contractual relationship between you and cd66. In the event of any conflict between this Policy and the Terms & Conditions on matters of data privacy, this Policy shall take precedence.

cd66 collects personal data through several channels: directly from you when you register an account or contact support, automatically when you use the Platform, and from trusted third parties such as identity verification services and payment providers. The categories of data we collect are set out below.

cd66 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data or biometric data, except where identity document photographs are submitted as part of mandatory KYC verification. Such photographs are used solely for identity verification purposes and are not retained beyond the period required by applicable law.

cd66 uses the personal data we collect for the following purposes. Each purpose is linked to a legal basis described in Section 4 of this Policy.

• Account creation and management: Processing your registration, verifying your identity, maintaining your account, and providing you with access to the Platform's full functionality.
• Service delivery: Enabling deposits and withdrawals via bKash, Nagad, Rocket and Upay; processing bets and game participation; crediting winnings; and applying bonuses and promotions to your account.
• Identity and age verification (KYC): Confirming that you meet the minimum age requirement of 21 years and that the identity details you have provided are accurate and genuine.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, money laundering, account takeovers and other suspicious behaviours that could harm you or cd66.
• Responsible gaming: Monitoring your gaming activity to identify potential problem gambling patterns and to apply account restrictions such as deposit limits, cooling-off periods and self-exclusion measures at your request or where required.
• Customer support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions.
• Marketing communications: Sending you promotional offers, bonus notifications and relevant platform updates by email or in-platform notification, where you have provided consent or where we have a legitimate interest to do so. You may opt out of marketing communications at any time.
• Platform improvement: Analysing aggregated usage data to improve the performance, features and user experience of the cd66 Platform.
• Legal compliance: Meeting our obligations under applicable law, including financial crime legislation, and cooperating with lawful requests from competent authorities.

cd66 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you, except where required by fraud prevention or KYC verification processes. Where automated processing is used, you have the right to request human review of the decision.

cd66 processes your personal data only where we have a valid legal basis to do so. The legal bases we rely on are as follows:

• Performance of a contract: Processing that is necessary to provide you with the services you have requested when registering an account and using the Platform — including account management, payment processing, game access and bonus fulfilment.
• Legal obligation: Processing that is required to comply with applicable legal and regulatory requirements, including KYC verification, anti-money laundering checks, and cooperation with lawful requests from government authorities.
• Legitimate interests: Processing carried out for purposes that are in the legitimate interests of cd66 or our users, provided those interests are not overridden by your data protection rights. This includes fraud prevention, platform security, responsible gaming monitoring, and internal analytics for service improvement.
• Consent: Processing based on your freely given, informed consent — primarily for direct marketing communications by email. You may withdraw your consent at any time by contacting support or using the unsubscribe option in marketing emails, without affecting the lawfulness of processing carried out before withdrawal.

cd66 does not sell, rent or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following circumstances and only with parties who are contractually bound to process it in accordance with this Policy:

• Payment service providers: bKash, Nagad, Rocket and Upay process financial transactions on our behalf. These providers receive only the data necessary to execute and verify each transaction.
• Identity verification services: Third-party KYC and anti-money laundering service providers assist us in verifying your identity and age. These providers process identity documents and biographic data under strict data processing agreements.
• Game providers: Certified game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe and Ezugi may receive limited technical data (such as session tokens and game result records) necessary to deliver their games to you via the Platform.
• IT and infrastructure providers: Cloud hosting, cybersecurity and platform maintenance providers who support the technical operation of the cd66 Platform, acting solely on our instructions.
• Legal and regulatory authorities: Where required by law, court order or a lawful request from a competent regulatory or law enforcement authority, cd66 will disclose personal data to the relevant body. We will notify you of such a disclosure where we are legally permitted to do so.

The cd66 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to improve your experience and to help us understand how the Platform is used. A cookie is a small text file placed on your device by your web browser when you visit the Platform.

cd66 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as account login sessions, security features and page navigation. You cannot opt out of strictly necessary cookies without disabling the Platform entirely.
• Performance and Analytics Cookies: These cookies collect aggregated, anonymised information about how visitors use the Platform — such as which pages are visited most frequently and whether any error messages appear. This data helps us improve the Platform over time.
• Functional Cookies: These cookies remember your preferences (such as language settings) to provide a more personalised experience during your visit.
• Marketing Cookies: With your consent, these cookies track your activity across the Platform to help us deliver relevant promotional content and offers that match your interests.

You can manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of the Platform. For detailed guidance on managing cookies in your specific browser, consult your browser's help documentation.

cd66 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in accordance with applicable financial crime and anti-money laundering requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by financial record-keeping obligations.
• KYC verification documents: Retained for the duration of the account plus five (5) years following account closure. Identity document photographs are deleted as soon as the verification process is complete, with only the verification outcome retained.
• Customer support communications: Retained for two (2) years from the date of the last communication in a support case, unless a longer period is required by an ongoing dispute or legal proceeding.
• Technical and behavioural data (logs): Retained for up to twelve (12) months, after which log data is either deleted or irreversibly anonymised.
• Marketing consent records: Retained for the period during which you are opted in to marketing communications, plus one (1) year following opt-out, to demonstrate compliance with consent requirements.

When personal data reaches the end of its applicable retention period, cd66 will securely delete or anonymise it so that it can no longer be associated with you. Anonymised data may be retained indefinitely for statistical and analytical purposes.

As a user of the cd66 Platform, you have the following rights in relation to your personal data. cd66 will respond to all valid requests within thirty (30) calendar days of receipt. In cases of complex or multiple requests, we may extend this period by a further thirty (30) days, with notification to you.

• Right of Access: You have the right to request a copy of all personal data that cd66 holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You may also update certain account details directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing and there is no overriding legitimate ground. This right is subject to legal retention obligations that may require cd66 to retain certain data.
• Right to Restriction: You have the right to request that cd66 restricts processing of your data in certain circumstances, for example while a dispute about accuracy is resolved.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit that data to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where cd66 relies on legitimate interests as the legal basis. You also have an absolute right to object to processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, please contact the cd66 data team at [email protected] or via live chat. Please include your registered account username and a clear description of your request. cd66 may ask for proof of identity before processing requests that could affect account security.

The cd66 Platform is strictly intended for adults aged 21 years and above. cd66 does not knowingly collect, process or store personal data from any person under the age of 21. Age verification is a mandatory part of the account registration process and cd66 reserves the right to request documentary proof of age at any time.

If cd66 becomes aware that personal data has been collected from a person under the age of 21 without verified parental or guardian consent, we will take immediate steps to delete that data and to close the associated account. If you have reason to believe that a minor has registered an account on the cd66 Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

cd66 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration or disclosure. These measures include but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the cd66 Platform is encrypted using 256-bit SSL/TLS encryption, preventing interception by third parties.
• Secure server infrastructure: cd66 servers are hosted in secure data centres with physical access controls, environmental monitoring and redundant power systems.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training.
• Data pseudonymisation: Where feasible, personal data is pseudonymised in internal analytics and testing environments so that it cannot be directly attributed to an individual without additional information.
• Incident response: cd66 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights, we will notify affected users promptly and take immediate remedial action.
• Regular security assessments: cd66 conducts periodic reviews of our security practices and infrastructure to identify and address vulnerabilities proactively.

While cd66 takes all reasonable steps to secure your personal data, no internet-based platform can guarantee absolute security. You are also responsible for keeping your account credentials secure and for notifying cd66 immediately if you suspect any unauthorised access to your account.

cd66 reviews this Privacy Policy periodically and may update it to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When material changes are made to this Policy, cd66 will:

• Update the "Effective Date" displayed at the top of this page and in the hero section above.
• Send a notification to your registered email address summarising the key changes at least seven (7) days before the updated Policy takes effect.
• Display a prominent notice on the Platform for a period of at least 30 days following the update.

Your continued use of the cd66 Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should stop using the Platform and contact our support team to request account closure and data deletion.

Minor updates that do not affect the substance of how your data is processed (such as formatting corrections or clarifications that do not change the meaning) may be made without prior notice.

If you have any questions, concerns or requests relating to this Privacy Policy or to the way cd66 processes your personal data, please contact us using the details below. All data-related enquiries are handled by our dedicated data protection team.

• Email: [email protected] — please use the subject line "Privacy Request" to ensure your message is routed to the correct team.
• Live Chat: Available 24 hours a day, 7 days a week inside the cd66 Platform for registered users.
• Response Time: cd66 will acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within 30 calendar days.
• Support Hours: Bangladesh Standard Time (BST, UTC+6), 24 hours a day, 7 days a week.