cd33 Privacy Policy — Your Data, Protected

cd33 is Bangladesh's premier online casino and sports betting platform, serving players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and beyond. We take the privacy and security of our users' personal data with the utmost seriousness. This Policy has been drafted in plain, accessible English so that every player can understand exactly how their information is handled.

Privacy at cd33 is not simply a regulatory obligation — it is a core operational principle. We collect only what is necessary, retain it only for as long as required, and share it only where strictly needed to deliver our services or comply with applicable law. We never monetise user data through advertising networks or data-broker channels.

If you have any questions about this Policy or about how cd33 handles your data at any time, please contact us at [email protected]. Our data team aims to respond to all privacy-related enquiries within five (5) business days.

cd33 collects personal data through several distinct channels. The following table summarises the categories of data we collect, the source of that data, and the reason for collection:

cd33 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information, except where health-related information is voluntarily disclosed by a player in the context of a responsible gaming self-exclusion request, in which case it is handled with strict confidentiality.

cd33 uses the personal data we collect for the following defined purposes:

• Account Management: Creating, maintaining, and administering your cd33 player account, including processing your registration, verifying your identity, and managing account settings and preferences.
• Service Delivery: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; crediting winnings; applying bonuses; and settling sports bets in accordance with our rules.
• Security & Fraud Prevention: Detecting and preventing unauthorised account access, multi-accounting, bonus abuse, money laundering, and other prohibited activities described in our Terms & Conditions.
• Legal & Regulatory Compliance: Meeting our obligations under applicable anti-money-laundering (AML) regulations, Know Your Customer (KYC) requirements, and any lawful orders from relevant authorities.
• Responsible Gaming: Monitoring gaming patterns to identify potential signs of problem gambling and, where appropriate, proactively applying account protections in accordance with our Responsible Gaming Policy.
• Customer Support: Responding to your queries, complaints, and support requests via live chat and email.
• Platform Improvement: Analysing aggregated, anonymised usage data to identify performance issues, improve game loading speeds, optimise the user interface, and develop new features for Bangladeshi players.
• Promotional Communications: Sending you information about cd33 promotions, bonuses, and seasonal offers (such as Eid specials or BPL tournament promotions) — but only where you have opted in to receive such communications. You may opt out at any time.

cd33 will not use your personal data for any purpose not listed above without first seeking your explicit consent or being required to do so by applicable law.

cd33 processes personal data under the following legal bases:

• Contractual Necessity: Processing that is required to fulfil our obligations to you under the cd33 Terms & Conditions, including operating your account, processing payments, and delivering gaming services.
• Consent: Processing activities where you have given us your explicit, informed consent — such as receiving promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Legitimate Interests: Processing that is necessary for cd33's legitimate business interests, such as fraud prevention, security monitoring, and platform analytics, provided those interests are not overridden by your privacy rights.
• Legal Obligation: Processing that is required to comply with applicable laws and regulatory requirements, including AML/KYC obligations and lawful authority requests.

cd33 does not sell or rent your personal data to any third party. We share personal data only in the following tightly controlled circumstances:

• Payment Processors: Transaction data is shared with payment service providers (including bKash, Nagad, Rocket, Upay, and card-processing networks) solely to process deposits and withdrawals on your behalf. These providers are contractually bound to handle your data securely and use it for no purpose other than transaction processing.
• KYC Verification Partners: Where identity verification is conducted with the assistance of a third-party KYC service provider, your submitted identity documents are shared with that provider exclusively for the purpose of verifying your identity. Verification providers are vetted for security and data protection standards prior to engagement.
• Technology & Infrastructure Providers: cd33 uses trusted cloud hosting and infrastructure partners to operate the platform. These providers may have access to technical data (such as server logs) but are prohibited from using it for any independent purpose.
• Legal & Regulatory Authorities: cd33 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a valid court order, or a lawful request from a government authority. cd33 will notify affected users of such disclosures where permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of cd33 assets, user data may be transferred to the acquiring entity. Users will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

In all cases of third-party data sharing, cd33 applies contractual safeguards requiring that recipient parties process shared data only for the stated purpose, maintain adequate security controls, and do not further disclose the data without authorisation.

cd33 uses cookies and similar tracking technologies to operate the platform effectively. Cookies are small text files placed on your device by your browser when you visit a website. The following types of cookies are used by cd33:

• Essential Cookies: Required for core platform functionality, including maintaining your login session, remembering your language preferences, and securing your account against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without impairing your use of the platform.
• Analytics Cookies: Used to collect anonymised data about how users navigate and interact with the cd33 platform — for example, which game categories are most visited and where users encounter loading delays. This data is used solely to improve the platform and is never linked back to individual user identities.
• Security Cookies: Used to detect suspicious login patterns, unusual geographic access, and other security anomalies that may indicate an account compromise attempt.

cd33 does not use advertising cookies, retargeting cookies, social media tracking pixels, or any cross-site tracking technologies. You may manage or disable non-essential cookies through your browser settings. Please note that disabling essential cookies will affect your ability to log in and use the platform normally.

cd33 retains personal data for as long as necessary to fulfil the purposes for which it was collected and to meet our legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of your active account relationship with cd33 and for five (5) years following account closure, in accordance with standard AML record-keeping requirements.
• KYC Documents: Retained for five (5) years from the date of submission or from the date of account closure, whichever is later.
• Transaction Records: Retained for five (5) years from the date of the transaction.
• Support Communications: Retained for two (2) years from the date of the most recent communication in a support thread.
• Technical / Server Logs: Retained for ninety (90) days from the date of generation, after which they are automatically deleted unless flagged for security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data that has been anonymised beyond the possibility of re-identification may be retained indefinitely for statistical and analytical purposes.

As a cd33 user, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of Access: You may request a complete copy of all personal data that cd33 holds about you. We will provide this in a readable electronic format within fourteen (14) business days.
• Right to Rectification: If any personal data held by cd33 is inaccurate or incomplete, you have the right to request that it be corrected. Corrections to core account data (such as name or date of birth) may require re-submission of supporting identity documents.
• Right to Erasure: You may request deletion of your personal data. Note that cd33 may be legally required to retain certain data (such as transaction records and KYC documents) for a defined period even after account closure. In such cases, we will delete all data that is not subject to a legal retention obligation.
• Right to Restriction: You may request that cd33 temporarily restrict the processing of your data while a dispute or correction request is being resolved.
• Right to Withdraw Consent: Where cd33 processes your data on the basis of consent (e.g., for promotional communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Object: You may object to the processing of your personal data where cd33 relies on legitimate interests as the legal basis, subject to cd33's right to demonstrate compelling legitimate grounds that override your interests.

cd33 will not charge any fee for processing a data rights request. We aim to resolve all requests within fourteen (14) business days. In complex cases we may extend this period by a further fourteen (14) days with notice.

The cd33 platform is strictly for adults aged 18 years and above. cd33 does not knowingly collect, store, or process personal data belonging to any person under the age of 18. Account registration requires confirmation of age eligibility, and identity verification (KYC) is used to enforce this restriction.

If cd33 becomes aware that personal data has been collected from a person under 18 — whether through a fraudulent registration or any other means — that account will be immediately closed, all associated balances will be forfeited, and all personal data linked to the underage user will be deleted as swiftly as legally permissible.

If you are a parent or guardian and believe that a person under your care has registered a cd33 account, please contact us immediately at [email protected].

cd33 implements a layered security architecture to protect your personal data from unauthorised access, loss, destruction, or alteration. Our security measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the cd33 servers is encrypted using TLS 1.2 or higher, preventing interception during transit.
• Access Controls: Access to personal data stored on cd33's systems is restricted to authorised personnel only, governed by role-based access control (RBAC) policies. Access events are logged and subject to regular audit review.
• Intrusion Detection: cd33 employs real-time intrusion detection and anomaly-monitoring systems that alert the security team to unusual access patterns, potential data breaches, or system compromise attempts.
• Password Security: User account passwords are stored using one-way cryptographic hashing. cd33 staff cannot retrieve your password; only a password reset is possible.
• Regular Security Reviews: cd33 conducts periodic security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

While cd33 maintains robust technical safeguards, no digital system can guarantee absolute security. Users are encouraged to protect their own accounts by choosing strong, unique passwords and by contacting support immediately if they suspect their account has been accessed without authorisation.

The cd33 website does not contain links to external third-party websites as a general matter of policy. However, in the event that any third-party link appears on the platform in a specific context (such as a licensed game provider's regulatory information), cd33 is not responsible for the privacy practices or data handling policies of those external sites.

This Privacy Policy applies solely to data collected and processed by cd33 via the https://cd33.cam platform. If you choose to visit any third-party website linked from the cd33 platform, we encourage you to review that site's own privacy policy before submitting any personal information.

cd33 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, the updated Policy will be published on this page with a revised effective date, and registered users will be notified via on-site notification or email.

Your continued use of the cd33 platform following publication of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with a revised Policy, you should contact support to close your account and request deletion of your data prior to the effective date of the change.

We recommend bookmarking this page and reviewing it periodically to stay informed of how cd33 manages your personal information.

For any questions, concerns, or formal requests relating to this Privacy Policy or your personal data, please reach out to the cd33 data team through the following channels:

• Email: [email protected] — use the subject line "Privacy Request" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 from within the cd33 platform after logging in — for general privacy enquiries, our support agents can escalate to the data team
• Response Time: Privacy-related emails are handled within five (5) business days; formal data rights requests within fourteen (14) business days

For matters related to responsible gaming data (such as self-exclusion records), please visit our Responsible Gaming page for dedicated tools and guidance.