cdd33 Privacy Policy

cdd33 ("we", "us", "our") operates the online sports betting and casino platform available at cdd33.io. As part of delivering a safe, personalised, and legally compliant service to players across Bangladesh, cdd33 collects and processes certain personal data relating to our registered players and website visitors.

This Privacy Policy sets out in clear, plain English what personal data cdd33 collects, the lawful basis on which it is processed, how it is stored and protected, with whom it may be shared, and the rights you hold over your own information. This policy forms part of the cdd33 Terms & Conditions and should be read alongside that document.

cdd33 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We recognise that our players in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and across Bangladesh place a great deal of trust in us when they share their information, and we take that responsibility seriously.

The governing language of this Privacy Policy is English. In the event of any conflict between an English version and any translation, the English version shall prevail.

cdd33 collects the following categories of personal data from players and website visitors:

cdd33 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly required for identity verification purposes (e.g., a photograph on a government-issued ID).

cdd33 collects personal data through the following methods:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.
• Automated technologies: When you visit or use the cdd33 Platform, technical and usage data is collected automatically via cookies, server logs, pixel tags, and similar tracking technologies. See Section 7 for full details of our cookie usage.
• Payment providers: When you deposit or withdraw via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, or BRAC Bank, our payment processing partners share transaction confirmation data with cdd33 to credit or debit your Account Balance.
• Identity verification providers: Where cdd33 uses a third-party KYC verification service to confirm your identity and age, that provider will share the result of the verification check (pass/fail and the data you submitted) with cdd33.
• Fraud prevention services: cdd33 may receive data about you from fraud detection and anti-money-laundering screening services where we are required to carry out such checks in connection with your account activity.

cdd33 uses your personal data only for the specific, defined purposes set out below. We do not use your data for any purpose that is incompatible with the purpose for which it was originally collected.

• Account management: To create, maintain, and administer your cdd33 account, including login authentication and account security.
• Transaction processing: To process deposits and withdrawals in Bangladeshi Taka (৳ BDT) via your chosen payment method and to maintain accurate financial records.
• Identity and age verification (KYC): To confirm that you are at least 21 years of age and to verify your identity as required to prevent fraud and comply with applicable regulations.
• Customer support: To respond to your enquiries, complaints, and requests and to maintain records of support interactions for quality assurance and dispute resolution.
• Platform improvement: To analyse usage patterns, game performance, and Platform behaviour in order to improve the user experience, fix bugs, and develop new features.
• Responsible gaming: To monitor betting and gaming activity for signs of problem gambling behaviour and to apply responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion in accordance with player requests.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent, illegal, or abusive activity on the Platform, including money laundering, account takeover, and multi-accounting.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS, where you have opted in to receive such communications. You may opt out at any time by contacting [email protected].
• Legal compliance: To comply with any legal obligation applicable to cdd33's operation, including responding to lawful requests from authorities.

cdd33 processes your personal data on the following lawful bases:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary to perform the contract between you and cdd33 — namely, to provide you with a functioning betting and casino account and to process your transactions.
• Legal obligation: Certain processing activities — including KYC identity verification, age verification, and financial record-keeping — are required by applicable law. cdd33 cannot provide services to you without completing these checks.
• Legitimate interests: cdd33 processes technical and usage data on the basis of legitimate interests in operating, improving, and securing the Platform. This includes fraud detection, abuse prevention, and analytics. We apply a balancing test to ensure these interests do not override your privacy rights.
• Consent: Where cdd33 sends you marketing communications by email or SMS, this is done on the basis of your explicit consent given at the time of registration or through your account settings. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

cdd33 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the following limited and controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank receive the minimum data required to process your deposits and withdrawals. These providers operate under their own privacy policies and data security standards.
• Identity verification providers: Where an independent KYC provider is used to verify your identity and age, we share the documents and information you submit for that purpose. The provider is contractually bound to use that data only for verification on cdd33's behalf.
• Game software providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive a player identifier and session token to enable you to play their games. They do not receive your full name, contact details, or financial data.
• Fraud and security services: We may share account and transaction data with fraud prevention and anti-money-laundering screening services where necessary to protect cdd33 and its players from financial crime.
• Analytics providers: Aggregated, anonymised usage data may be shared with analytics service providers to help cdd33 understand Platform performance. No personally identifiable information is included in these data sets.
• Legal and regulatory authorities: cdd33 will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by law, court order, or legitimate legal process. We will notify you of any such disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data held by cdd33 may be transferred to the acquiring entity. Players will be notified by email before their data is transferred and before it becomes subject to a different privacy policy.

All third-party service providers who process personal data on cdd33's behalf are required to maintain appropriate technical and organisational security measures and to process your data only on cdd33's documented instructions.

cdd33 uses cookies and similar tracking technologies to enable the Platform to function, to keep you securely logged in, and to understand how players use the site. The following cookie categories are in use:

cdd33 does not place third-party advertising or retargeting cookies that track your activity across other websites. All cookies set by cdd33 are first-party or are placed by contracted service providers operating strictly on cdd33's behalf.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling essential cookies will prevent you from logging in and using the cdd33 Platform. Most modern browsers allow you to view, delete, and block cookies via the browser's Privacy or Security settings menu.

cdd33 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the full duration of your active account plus a minimum of 5 years following account closure. This is required to comply with applicable financial record-keeping and anti-money-laundering obligations.
• Transaction and financial records: Retained for a minimum of 5 years from the date of each transaction in accordance with financial compliance requirements.
• KYC documents (NID, passport, utility bill): Retained for 5 years following account closure or the completion of the relevant verification event, whichever is later.
• Customer support communications: Retained for 3 years from the date of the last communication in a thread, to support dispute resolution and service quality review.
• Marketing preference records: Retained for the duration of your account and for 2 years following account closure, to evidence consent and opt-out records.
• Technical and usage logs: Retained for up to 12 months in identifiable form, then anonymised or deleted.

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised. Anonymised data (which can no longer be linked to you as an individual) may be retained indefinitely for statistical and Platform improvement purposes.

cdd33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all pages and API connections, ensuring that data in transit between your device and cdd33 servers cannot be intercepted in readable form.
• Encryption at rest for sensitive data fields including financial data, identity document images, and authentication credentials stored in cdd33 databases.
• Role-based access control (RBAC) ensuring that cdd33 staff can only access the categories of player data necessary for their specific job function. Access logs are maintained and reviewed regularly.
• Two-factor authentication (2FA) for all cdd33 staff accounts that have access to player data systems.
• Regular penetration testing and security audits by independent security professionals to identify and remediate vulnerabilities in the Platform infrastructure.
• Intrusion detection systems that monitor network traffic and server activity for signs of unauthorised access or anomalous behaviour in real time.
• Data backup and disaster recovery procedures ensuring that player account data can be restored promptly in the event of a system failure.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cdd33 will notify affected players without undue delay and will take immediate steps to contain and assess the breach. cdd33 will also report the breach to any applicable regulatory authority where required by law.

As a cdd33 player, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected]. cdd33 will acknowledge your request within 5 Bangladesh business days and provide a full response within 30 days.

• Right of access: You may request a copy of all personal data that cdd33 holds about you, along with information on how it is being used and with whom it has been shared.
• Right to rectification: If any personal data held by cdd33 is inaccurate or incomplete, you may request that it be corrected. Updates to your name, address, or contact details may require supporting documentation for verification.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected. Note that this right is subject to cdd33's legal obligations to retain certain data for a minimum period (see Section 8). Where deletion cannot be fulfilled in full, cdd33 will explain which data must be retained and why.
• Right to restriction of processing: You may request that cdd33 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing based on legitimate interests.
• Right to data portability: You may request that cdd33 provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider.
• Right to object: You may object to the processing of your personal data where cdd33 relies on legitimate interests as the legal basis. You may also object at any time to the use of your data for direct marketing purposes, with immediate effect.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing already carried out.

cdd33 will not charge a fee for responding to rights requests unless the request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may be applied. cdd33 may request proof of identity before processing a rights request to protect against unauthorised disclosure of another person's data.

cdd33 is an adults-only platform. Access to and use of the cdd33 Platform is strictly prohibited for any person under the age of 21. cdd33 does not knowingly collect personal data from minors.

If cdd33 discovers or is notified that a person under the age of 21 has registered an account or provided personal data, we will immediately suspend that account, delete the associated personal data, and reverse any transactions made from that account. Any funds deposited by a minor will be handled in accordance with cdd33's Terms & Conditions and applicable law.

If you are a parent or guardian and believe that your child may have registered a cdd33 account without your knowledge, please contact [email protected] immediately. We take these reports seriously and will investigate and respond within 2 Bangladesh business days.

The cdd33 Platform may from time to time display informational references to third-party organisations such as game software providers, payment partners, or sports governing bodies. This Privacy Policy applies solely to data collected and processed by cdd33 through the cdd33 Platform.

cdd33 is not responsible for the privacy practices or data handling of any third-party organisation. If you access a third-party service in connection with your use of cdd33 (for example, logging in to your bKash account to make a deposit), your use of that third-party service is governed by that organisation's own privacy policy. We encourage you to review the privacy policies of any third-party service you interact with.

cdd33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in the services we offer, or changes in applicable law. The effective date shown at the top of this page and in the hero section will always reflect the most recent version.

Where a change to this Privacy Policy is material — meaning it significantly affects how we use your personal data or your rights in relation to that data — cdd33 will notify all registered players by email to their registered address at least 7 days before the change takes effect. The updated policy will also be published on this page.

For minor or non-material updates (such as corrections to wording, clarifications, or formatting changes), cdd33 will update the effective date on this page without prior notification by email. Players are encouraged to review this page periodically.

Continued use of the cdd33 Platform after a revised Privacy Policy has been published and (where applicable) notified constitutes your acknowledgement of the updated policy.

If you have any questions, concerns, or requests in relation to this Privacy Policy or cdd33's data processing practices, please contact our Data Privacy team using the details below. All privacy-related enquiries must be submitted in writing.

Email: [email protected]

Subject line for privacy requests: Please use "Privacy Request — [Your Request Type]" (e.g., "Privacy Request — Data Access" or "Privacy Request — Data Deletion") to ensure your message is routed directly to the correct team.

Response times: Acknowledgement within 5 Bangladesh business days; full response within 30 days. Complex requests involving large volumes of data or third-party coordination may take up to 45 days; if this applies, we will notify you within the initial 30-day window.

Support hours: 24 hours a day, 7 days a week, including Bangladesh public holidays.