Your Privacy Matters at cd678

Introduction

cd678 ("the Platform", "we", "us", "our") operates the online casino and sports betting platform accessible at cd678.io, providing services to players primarily located in Bangladesh. We take the privacy and security of your personal information with the utmost seriousness, and this Privacy Policy is designed to give you a clear, comprehensive, and honest account of how we handle that information from the moment you visit our platform to the point at which you choose to close your account.

This Privacy Policy applies to all data processing activities carried out by cd678 in connection with the operation of the platform, including data collected through the website, any associated mobile-optimised interfaces, customer support interactions, payment processing channels, and marketing communications. It should be read alongside our Terms & Conditions and our Responsible Gaming Policy, all of which together form the full agreement governing your relationship with cd678.

We recognise that players in Bangladesh place a significant degree of trust in cd678 when they share their personal and financial information with us. Our commitment is to honour that trust by maintaining rigorous data protection standards, applying data minimisation principles at every stage of our operations, and never using your personal data in ways that you would not reasonably expect or that fall outside the scope of the purposes described in this policy.

Data We Collect

cd678 collects personal data through a number of different channels and at different points during the player lifecycle. The categories of personal data we collect, and the contexts in which they are collected, are set out below.

In addition to data you provide directly, cd678 may receive information about you from third-party sources where this is lawfully permitted. Such sources include payment service providers (such as bKash, Nagad, and Rocket) who confirm transaction status, identity verification service providers engaged to assist with our KYC process, and fraud prevention agencies whose databases we consult as part of our anti-money laundering compliance obligations.

How We Use Your Data

cd678 processes your personal data for a defined and limited set of purposes. We do not process personal data for any purpose that is incompatible with the purposes for which it was originally collected. The primary purposes for which we use your personal data are as follows:

• Account creation and management: To register your account, verify your identity, maintain your player profile, and administer your relationship with the cd678 platform throughout the account lifecycle.
• Service delivery: To provide you with access to the games, sports betting markets, live dealer tables, and other features available on the cd678 platform in accordance with the Terms & Conditions.
• Payment processing: To process BDT deposits and withdrawals through your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer), to verify that payment instruments are registered in your name, and to maintain accurate financial records of all transactions.
• Identity verification and fraud prevention: To carry out Know Your Customer (KYC) checks as required by our anti-money laundering obligations, to verify the authenticity of documents submitted, and to detect and prevent fraudulent activity, bonus abuse, and multi-account creation.
• Responsible gaming: To monitor player activity for signs of problem gambling behaviour, to apply the deposit limits, cooling-off periods, and self-exclusion measures that you request, and to fulfil our duty of care obligations towards players in accordance with responsible gaming best practice.
• Customer support: To respond to your queries, complaints, and feedback through the live chat and email channels, to maintain records of support interactions for quality assurance purposes, and to resolve disputes relating to your account or transactions.
• Legal and regulatory compliance: To comply with applicable laws and regulations, to respond to lawful requests from law enforcement or regulatory authorities, and to establish, exercise, or defend legal claims.
• Platform improvement: To analyse aggregated and anonymised usage data in order to improve the platform's functionality, game selection, user interface, and overall player experience.
• Marketing communications (where consented): To send you promotional offers, bonus notifications, tournament announcements, and seasonal promotions relevant to your interests — but only where you have provided your express consent to receive such communications at registration or through your account settings.

Legal Basis for Processing

Every processing activity carried out by cd678 in relation to your personal data is grounded in one or more recognised legal bases. The applicable legal bases for the main categories of processing are described below:

• Contractual necessity: The majority of our data processing — including account registration, payment processing, game access, and customer support — is necessary for the performance of the contract between you and cd678 as set out in our Terms & Conditions. Without this processing, we would be unable to provide the services you have requested.
• Legal obligation: Certain processing activities, including KYC identity verification, AML transaction monitoring, and the retention of financial records, are carried out to comply with legal obligations that apply to cd678 as an operator in the online gaming sector.
• Legitimate interests: We process certain technical and usage data on the basis of our legitimate interests in operating a secure, fraud-resistant, and well-functioning platform. This includes fraud detection, platform security, and the analysis of aggregated player behaviour data for product improvement purposes.
• Consent: Where we process your data for marketing communications or for the use of non-essential cookies, we do so solely on the basis of your freely given, specific, and informed consent. You may withdraw your consent for marketing communications at any time by updating your account preferences or contacting our support team.

Data Sharing and Disclosure

cd678 does not sell or commercially transfer your personal data to third parties. However, in order to operate the platform and fulfil our legal obligations, we share certain categories of personal data with the following categories of recipients on a strictly need-to-know basis:

• Payment service providers: We share relevant transaction and identity data with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank as necessary to process your deposits and withdrawals. These providers act as independent data controllers in respect of the data they process on their own platforms and are subject to their own privacy policies.
• Identity verification providers: We engage specialist KYC and AML compliance service providers to assist with the verification of identity documents. These providers process your identity data under strict contractual data processing agreements and are not permitted to use your data for any purpose other than the specific verification service they provide to cd678.
• Game content providers: The game studios whose titles are hosted on the cd678 platform — including providers such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and Microgaming — may receive anonymised or pseudonymised session data for the purpose of game performance monitoring and RNG certification. These providers do not receive personally identifiable information about individual players.
• Technology and infrastructure partners: We work with third-party cloud hosting, cybersecurity, and platform technology providers who may process personal data as data processors acting on our behalf. All such providers are bound by contractual data processing agreements that restrict their use of personal data to the specific services they provide.
• Law enforcement and regulatory authorities: cd678 will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where required to do so by applicable law, in response to a lawful court order, or where disclosure is necessary to prevent or investigate fraud, money laundering, or other serious criminal activity.

Cookies and Tracking Technologies

cd678 uses cookies and similar tracking technologies on its platform for a limited set of operational and analytical purposes. A cookie is a small text file that is stored on your device when you visit a website. We do not use cookies to build advertising profiles, to track your browsing activity across other websites, or to deliver targeted third-party advertisements.

The categories of cookies used on the cd678 platform are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function correctly. They enable core features such as maintaining your login session, preserving your account preferences, and ensuring that the cashier and game client operate as expected. These cookies cannot be disabled without severely impairing your ability to use the platform.
• Analytics cookies: We use first-party analytics tools to collect anonymised data about how players navigate the cd678 platform — including which pages are visited, how long sessions last, and which features are most frequently used. This data is used exclusively to improve the platform and is not linked to your personal identity. No third-party analytics services that engage in cross-site tracking are used.
• Security cookies: Certain cookies are used to support the platform's fraud detection and security monitoring systems. These cookies help us identify unusual account activity, detect automated access attempts, and maintain the integrity of the platform's authentication mechanisms.

Most web browsers allow you to control cookie settings through the browser's privacy or settings menu. You may choose to disable non-essential cookies through your browser settings at any time. Please note that disabling cookies may affect the functionality of certain features of the cd678 platform, including the ability to maintain a persistent login session.

Data Security

cd678 maintains a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security safeguards include:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and the cd678 platform is encrypted using industry-standard 256-bit SSL/TLS technology. This ensures that any data intercepted in transit cannot be read or tampered with by unauthorised parties.
• Encrypted data storage: Sensitive personal data — including identity verification documents and financial account references — is encrypted at rest in our secure database infrastructure. Passwords are stored exclusively as salted cryptographic hashes and are never stored in recoverable plain text form.
• Access controls: Access to personal data held by cd678 is restricted to personnel who require it for their specific role. All staff with access to personal data are subject to confidentiality obligations and receive regular training on data protection responsibilities.
• Intrusion detection and monitoring: Our platform infrastructure is subject to continuous security monitoring, including automated intrusion detection systems, regular vulnerability scanning, and periodic penetration testing by qualified security professionals.
• Incident response: cd678 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant individuals as promptly as practicable and take all necessary steps to contain and remediate the breach.

Data Retention

cd678 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal or regulatory obligations. The principal retention periods applicable to different categories of personal data are outlined below:

• Active account data: Personal data associated with an active player account is retained for the duration of the account's existence and for a period of five years following the date on which the account is permanently closed. This retention period reflects our obligations under applicable AML and financial record-keeping requirements.
• Transaction records: All records of financial transactions — including deposit and withdrawal history, payment method details, and associated KYC documentation — are retained for a minimum of five years following the date of the transaction, in accordance with standard financial record-keeping practice.
• Customer support records: Records of customer support interactions, including live chat transcripts and email correspondence, are retained for a period of three years from the date of the interaction. Records relating to formal complaints or dispute resolution proceedings may be retained for longer where necessary to establish, exercise, or defend a legal claim.
• Marketing preference data: Records of your marketing consent and communication preferences are retained for the duration of your account and for a period of two years following account closure or the withdrawal of consent, to enable us to demonstrate compliance with applicable data protection requirements.
• Technical and analytics data: Anonymised or pseudonymised technical and analytics data is retained for up to two years and is used solely for the purpose of platform performance analysis and improvement.

Upon the expiry of the applicable retention period, personal data is either securely deleted from our systems or, where deletion is technically impracticable within a specific retention window, anonymised in a manner that makes re-identification impossible.

Your Rights

As a user of the cd678 platform, you hold a number of rights in relation to the personal data we process about you. These rights are described below, along with the process for exercising them:

• Right of access: You have the right to request a copy of the personal data that cd678 holds about you, along with information about the purposes for which it is processed, the categories of data held, and the recipients with whom it has been shared. We will respond to all access requests within 30 calendar days of receipt.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay. You may update basic account details directly through your account profile; for corrections to identity or verification documents, please contact our support team.
• Right to erasure: You may request that cd678 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been unlawfully processed. Please note that this right is subject to our obligations to retain certain data under applicable legal and regulatory requirements.
• Right to restriction: You have the right to request that we restrict our processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data, or where you have objected to processing and we are assessing whether our legitimate interests override your rights.
• Right to object: Where we process your personal data on the basis of our legitimate interests, you have the right to object to that processing at any time. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to withdraw consent: Where our processing of your personal data is based on your consent — including for marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact our support team via live chat on the platform or by email at the address provided in Section 12. We will acknowledge your request within 48 hours and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 60 days where necessary, in which case we will notify you of the extension and the reasons for it.

Children's Privacy

The cd678 platform is strictly intended for adults aged 21 and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Our registration process includes an age declaration step, and we conduct age verification checks as part of our standard KYC process to ensure that minors are not able to access the platform.

If we become aware at any point that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and to close the associated account. If you believe that a person under the age of 21 has registered an account on the cd678 platform, we ask that you notify our support team immediately so that we can investigate and take appropriate action.

Changes to This Privacy Policy

cd678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulation, or changes in the features and functionality of the platform. We are committed to ensuring that this policy remains accurate, up to date, and transparent at all times.

When we make material changes to this Privacy Policy, we will notify registered users by posting a prominent notice on the cd678 platform and, where appropriate, by sending a notification to the email address associated with your account. The updated policy will take effect from the date on which it is published on the platform, as indicated by the "Last Updated" date at the top of this document.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Your continued use of the cd678 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes and your agreement to be bound by the revised terms.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which cd678 handles your personal data, please do not hesitate to get in touch with our support team. We are available 24 hours a day, 7 days a week, and are committed to responding to all privacy-related enquiries promptly and professionally.

You may contact us through the following channels:

• Live chat: Available directly on the cd678 platform at all times. This is the fastest way to reach our support team for urgent enquiries.
• Email: [email protected] — please include "Privacy Enquiry" in the subject line so that your message is directed to the appropriate team. We aim to respond to all email enquiries within 48 hours.

When submitting a data rights request — such as a request for access, rectification, or erasure — please include sufficient information to allow us to verify your identity and locate your account. This typically means providing your registered username, the email address associated with your account, and a brief description of the nature of your request. We may ask for additional verification in order to process your request securely.