cd66b Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how cd66b ("cd66b", "we", "us", "our") collects, uses, stores, shares and protects personal information relating to individuals ("Player", "User", "you", "your") who access or use the cd66b platform at https://cd66b.io and any associated mobile or web-based services (collectively, the "Platform").

cd66b is committed to responsible data stewardship. We recognise that the personal data you share with us is provided in trust, and we take our obligation to handle that data with care, transparency and professionalism extremely seriously. This Policy has been drafted in plain, formal English to ensure that every player — regardless of technical background — can understand precisely how their data is handled.

By registering an account on the cd66b platform or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read, understood and agreed to the data practices described herein. If you do not agree with any part of this Policy, you must cease using the Platform and may close your account by contacting our support team.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming page, both of which form part of the agreement between you and cd66b.

2 Data Controller

For the purposes of this Privacy Policy, the data controller responsible for your personal data is cd66b, operating the Platform at https://cd66b.io. The data controller determines the purposes for which, and the means by which, your personal data is processed.

If you have any questions regarding data control arrangements, or wish to exercise any of the rights described in Section 11 of this Policy, you may contact our dedicated data protection team at:

3 Data We Collect

cd66b collects the minimum personal data necessary to provide a safe, compliant and personalised betting and gaming experience. The categories of personal data we collect are as follows:

cd66b does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning sexual orientation. If any such data is inadvertently provided by a Player, it will be deleted promptly upon discovery.

4 How We Collect Your Data

cd66b collects personal data through the following means:

• Direct submission: Data you provide when completing the account registration form, KYC verification upload, deposit or withdrawal request, support ticket, or any other form on the Platform.
• Automated collection: Data gathered automatically as you interact with the Platform, including via server logs, cookies, pixel tags, and session tracking technologies. See Section 8 for full details on cookies.
• Payment processors: Transaction confirmation data returned by bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Visa and Mastercard following deposit or withdrawal processing.
• Identity verification providers: Results of automated age and identity checks performed by our third-party KYC partners when you submit verification documents.
• Anti-fraud and AML screening: Data received from third-party risk scoring and anti-money laundering screening services used to detect and prevent fraudulent activity on the Platform.
• Game providers: Session and outcome data returned by third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi, which power the games available on the cd66b platform.

5 How We Use Your Data

cd66b processes your personal data for the following specific purposes. We do not use your data for any purpose incompatible with those stated below without first obtaining your explicit consent.

• Account management: To create, authenticate, maintain and close your cd66b player account, and to enable you to access all Platform features.
• Service delivery: To process bets and wagers, settle winnings, process deposits and withdrawals via bKash, Nagad, Rocket and other approved payment methods, and to manage your account wallet balance in BDT.
• Identity and age verification: To verify that you are at least 21 years of age and to confirm the authenticity of identity documents submitted during KYC in compliance with our responsible gaming obligations.
• Fraud prevention and AML compliance: To detect, investigate and prevent fraudulent activity, money laundering, match-fixing, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming: To monitor gambling behaviour patterns that may indicate problematic gambling, to enforce self-exclusion requests, deposit limits and cooling-off periods, and to proactively reach out to players exhibiting at-risk behaviour.
• Customer support: To respond to your queries, complaints and support requests submitted via email or live chat, and to maintain a record of communications for quality assurance purposes.
• Legal and regulatory compliance: To comply with applicable legal obligations, including record-keeping requirements, document retention, and responding to lawful requests from competent authorities.
• Platform improvement: To analyse usage patterns, diagnose technical issues, test new features, and improve the overall quality and performance of the cd66b platform.
• Personalisation: To tailor your on-platform experience, including displaying relevant game recommendations, cricket betting markets and promotional offers based on your activity history — with your consent where required.
• Marketing communications: To send you promotional emails and notifications about bonuses, new games, cricket season offers (IPL, BPL, T20 World Cup), and Eid or seasonal promotions — only where you have given explicit consent and have not subsequently opted out.

6 Legal Basis for Processing

cd66b processes personal data only where a valid legal basis exists. The primary legal bases upon which we rely are as follows:

• Contractual necessity: Processing required to perform the contract between you and cd66b — i.e., to operate your account, accept bets, process payments and deliver winnings.
• Legal obligation: Processing required to comply with applicable legal requirements, including anti-money laundering laws, identity verification mandates, and data retention obligations.
• Legitimate interests: Processing carried out to pursue the legitimate interests of cd66b, including fraud detection, platform security, responsible gaming monitoring, and business analytics — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where you have given freely given, specific, informed and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

cd66b does not sell, rent or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate contractual data protection safeguards:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Visa and Mastercard — for the purpose of processing your deposit and withdrawal transactions.
• KYC and identity verification partners: Third-party providers engaged to verify the authenticity of identity documents and confirm player age in compliance with our 21+ policy.
• AML and fraud screening services: Risk management platforms used to screen transactions and player behaviour for signs of money laundering, fraud, or match-fixing activity.
• Game technology providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi receive technical session data necessary to power the games you play on the cd66b platform.
• IT infrastructure and cloud hosting providers: Secure cloud service providers that host the cd66b platform infrastructure and store encrypted player data on our behalf, under strict data processing agreements.
• Customer support platforms: Third-party live chat and ticketing software providers used to power the cd66b customer support system. Only the minimum data necessary to handle your query is accessible to these providers.
• Legal and regulatory authorities: Where cd66b is required by law, court order or legitimate regulatory request to disclose personal data, we will do so. We will notify you of such disclosure where legally permitted.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the cd66b business, player data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection commitments.

8 Cookies & Tracking Technologies

cd66b uses cookies and similar tracking technologies to operate the Platform, maintain your session, remember your preferences, and analyse Platform usage. A cookie is a small text file placed on your device when you visit a website. The cookies used on the cd66b platform fall into the following categories:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication tokens, security cookies and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, responsible gaming limits you have set, and your last-used payment method. Disabling these may affect your experience.
• Analytics cookies: Used to collect anonymised or pseudonymised data about how players navigate the Platform — which pages are visited most frequently, how long sessions last, and where players encounter errors. This data is used exclusively to improve the Platform.
• Marketing cookies: Used, with your consent, to present relevant promotional content and to measure the effectiveness of marketing campaigns. These are only activated where you have opted in to marketing communications.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will impair the functionality of the cd66b platform and may prevent you from accessing your account.

9 Data Retention

cd66b retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active status and for a period of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure or the last transaction, whichever is later.
• Financial transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the last communication, unless the correspondence relates to an ongoing dispute.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of the consent history.
• Analytics and usage data: Retained in anonymised or aggregated form for up to three (3) years for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with cd66b's internal data deletion procedures. Where data cannot be immediately deleted due to technical constraints, it will be isolated from active processing until deletion is completed.

10 Data Security

cd66b implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the cd66b platform.
• Encryption at rest for all stored personal data, including financial records and identity documents.
• Role-based access controls ensuring that only authorised cd66b personnel with a legitimate business need may access personal data.
• Regular independent security audits, vulnerability assessments and penetration testing of the Platform's infrastructure.
• Multi-factor authentication for internal administrative systems handling player data.
• Strict data minimisation principles — staff access only the minimum data required to perform their specific role.
• Incident response procedures enabling cd66b to detect, assess and respond to data breaches within 72 hours, and to notify affected players where required.

While cd66b employs industry-standard security practices, no online platform can guarantee absolute security. Players are encouraged to maintain strong, unique passwords for their cd66b account and to contact support immediately if they suspect any unauthorised access.

11 Your Data Rights

cd66b respects your rights over your personal data. Depending on your jurisdiction and the legal basis for processing, you may be entitled to exercise the following rights:

• Right of access: You may request a copy of the personal data that cd66b holds about you, along with information about how it is being used.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected without undue delay.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where there is no overriding legitimate basis for continued processing. Note that this right is subject to our legal obligation to retain certain records for a minimum of five years.
• Right to restrict processing: You may request that we limit the processing of your data while a dispute about accuracy or the lawfulness of processing is resolved.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request a structured, machine-readable copy of your data for transfer to another service provider.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. Objections to direct marketing will always be honoured immediately.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact cd66b at [email protected] with "Privacy Request" in the subject line. We will respond within 30 days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reasons for it.

12 Children's Privacy

The cd66b platform is strictly intended for adults aged 21 and above. cd66b does not knowingly collect, store or process personal data belonging to individuals under the age of 21. If cd66b becomes aware that personal data has been submitted by a person under 21, the associated account will be immediately closed, all data will be securely deleted, and any deposited funds will be returned to the payment method used for deposit.

Parents and guardians who have reason to believe that a minor has registered an account with cd66b or submitted personal data to the Platform are urged to contact us immediately at [email protected] so that appropriate action can be taken without delay. cd66b is committed to the protection of minors and takes all such reports with the utmost seriousness.

13 Third-Party Links

The cd66b platform may contain references to third-party game providers, payment processors or other service partners. These third-party services operate under their own privacy policies, over which cd66b has no control and for which cd66b accepts no responsibility. Players should review the privacy policies of any third-party services they interact with independently of the cd66b platform.

cd66b does not endorse or make any representations about the data practices of third-party providers. Any personal data you submit directly to a third-party service provider (for example, completing a bKash transaction) is governed by that provider's own privacy policy.

14 International Data Transfers

cd66b operates as an international online gaming platform. As a result, your personal data may be processed or stored on servers located outside of Bangladesh, including in countries whose data protection laws may differ from those applicable in your jurisdiction. Where such transfers occur, cd66b ensures that appropriate contractual safeguards are in place — including standard contractual clauses or equivalent mechanisms — to protect your data to a standard consistent with this Policy.

By using the cd66b platform, you consent to the transfer of your personal data to international servers for the purpose of service delivery, provided that such transfers are subject to the protections described above. If you have concerns about international data transfers relating to your account, please contact our data protection team at [email protected].

15 Amendments to This Policy

cd66b reserves the right to update, amend or replace this Privacy Policy at any time. Where changes are material — for example, a change in the categories of data collected, a new third-party data sharing arrangement, or a change in retention periods — cd66b will notify registered players via email or an in-platform notification at least seven (7) days before the updated Policy takes effect.

Continued use of the cd66b platform after the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. The most current version of this Privacy Policy will always be available at https://cd66b.io/privacy-policy, along with the date on which the current version became effective.

Players who do not accept the revised Policy must discontinue use of the cd66b platform and may request account closure by contacting our customer support team.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or cd66b's data handling practices, please contact our data protection team using the details below. We are available to assist you 24 hours a day, 7 days a week, 365 days a year.

• Email: [email protected] — please include "Privacy Request" in the subject line for all data-related enquiries.
• Live Chat: Available through the cd66b platform when you are logged in to your account.
• Response Time: Privacy requests are acknowledged within 48 hours and responded to in full within 30 calendar days.
• Postal: Written data requests may be submitted by post; please contact us by email first to obtain the current postal address for our data protection team.