Your Privacy Matters to Us

1 Information We Collect

When you register for a cf66 account, use our platform, or contact our support team, we collect personal data in the following categories. All data collection is based on one or more of the lawful bases described in Section 2 of this Privacy Policy.

Identity and registration data: When you create a cf66 account, we collect your full legal name, date of birth, chosen username, and email address. If you proceed through our Know Your Customer (KYC) verification process — which is required before your first withdrawal — we additionally collect a copy of your government-issued identity document (such as a national identity card or passport) and proof of residential address (such as a recent utility bill or bank statement).

Contact and communication data: We collect the email address you provide at registration and any messages you send to our support team via email or live chat. Support communications are logged and retained for quality assurance and dispute resolution purposes.

Financial and transaction data: We collect records of all deposits, withdrawals, bonus credits, wagers, and winnings associated with your account. For payment processing purposes, we collect the payment method identifiers necessary to route transactions (for example, the mobile wallet number associated with your bKash, Nagad, Rocket, or Upay account). We do not store full payment card numbers on cf66 servers; card transactions are processed via PCI-DSS-compliant payment partners.

Technical and device data: When you access the cf66 platform, our servers automatically collect your IP address, browser type and version, operating system, device identifiers, screen resolution, referring URL, and timestamps of your visits and sessions. This data is used for security monitoring, fraud detection, and platform performance optimisation.

Behavioural and gameplay data: We collect data about how you interact with the platform, including which games you play, session duration, wager amounts, game preferences, and responsible gaming tool usage (for example, whether you have set deposit limits or requested a cool-off period). This data is used to personalise your experience and to fulfil our responsible gaming obligations.

Data we do not collect: cf66 does not collect biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data except where you voluntarily disclose health-related information in the context of a responsible gaming self-exclusion request, in which case it is treated with the highest level of confidentiality.

2 How We Use Your Data

cf66 processes your personal data for the following specific purposes, each underpinned by a defined lawful basis:

• Account creation and authentication: We use your registration data to create and manage your cf66 account, verify your identity at login, and ensure the security of your account. Lawful basis: performance of a contract.
• Age and identity verification: We process identity documents to confirm that you meet the minimum age requirement of 18 years and to fulfil our Know Your Customer obligations. Lawful basis: legal obligation.
• Payment processing: We use financial data to process deposits and withdrawals through your selected payment method (bKash, Nagad, Rocket, Upay, Visa, or Mastercard) and to maintain accurate transaction records. Lawful basis: performance of a contract.
• Fraud detection and security: We analyse technical and behavioural data to detect and prevent fraudulent activity, multi-accounting, money laundering, and unauthorised access. Lawful basis: legitimate interests / legal obligation.
• Responsible gaming compliance: We monitor gameplay patterns to identify indicators of problem gambling and to enforce self-exclusion, deposit limits, and cool-off periods. Lawful basis: legal obligation / legitimate interests.
• Customer support: We use your contact data and account history to respond to support enquiries, resolve disputes, and investigate complaints. Lawful basis: performance of a contract.
• Marketing communications: Where you have given explicit consent, we may send you promotional emails about cf66 bonuses, new game launches, and seasonal offers. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting support. Lawful basis: consent.
• Platform improvement and analytics: We use anonymised or aggregated behavioural and technical data to understand how players use the platform and to improve game selection, user interface design, and performance. Lawful basis: legitimate interests.
• Legal and regulatory compliance: We process and retain data as required by applicable anti-money-laundering regulations, tax reporting obligations, and any lawful requests from competent authorities. Lawful basis: legal obligation.

cf66 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you, except in limited circumstances such as automated fraud screening, where human review is available upon request.

3 Data Sharing & Third Parties

cf66 does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment service providers: We share financial data with payment processors including bKash, Nagad, Rocket, Upay, Visa, and Mastercard to facilitate deposits and withdrawals. These providers operate under their own privacy policies and are bound by applicable payment industry data security standards (PCI-DSS).
• Identity verification providers: We may share identity document data with third-party KYC service providers for the purpose of verifying your identity and age. These providers are contractually prohibited from using your data for any purpose other than the verification service.
• Game software providers: Game providers including Pragmatic Play, Evolution Gaming, PG Soft, JILI, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session and gameplay data necessary to deliver the game experience and to resolve technical disputes. They do not receive your full identity or financial data.
• Customer support platforms: Our support team may use third-party helpdesk software to manage support tickets. Any data shared with such platforms is subject to data processing agreements that restrict its use to support operations only.
• Analytics and performance tools: We may use server-side analytics tools that process anonymised technical data. These tools are configured to minimise personal data exposure and do not receive data that directly identifies you.
• Law enforcement and regulatory authorities: cf66 will disclose personal data to competent law enforcement, regulatory, or governmental authorities when required to do so by law, court order, or in connection with an investigation into suspected criminal activity such as fraud or money laundering. We will notify affected players of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of cf66's business assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments. You will be notified of any such transfer in advance.

All third-party service providers who process personal data on behalf of cf66 are required to enter into data processing agreements that impose obligations consistent with this Privacy Policy and with applicable data protection law.

4 Cookies & Tracking Technologies

cf66 uses cookies and similar client-side technologies (including local storage and session storage) to ensure the platform functions correctly and to improve your experience. The following table describes the categories of cookies we use:

cf66 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. We do not share cookie data with advertising networks.

Managing cookies: You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, accept only first-party cookies, or be notified before a cookie is set. Please refer to your browser's help documentation for specific instructions. Note that disabling strictly necessary or security cookies will prevent you from logging in or using the platform correctly.

Do Not Track: cf66 respects browser-level Do Not Track (DNT) signals where technically feasible. When a DNT signal is detected, non-essential analytics cookies are not set for that session.

5 Data Security Measures

cf66 implements a layered approach to data security designed to protect your personal information against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• TLS/SSL encryption in transit: All data exchanged between your device and cf66 servers is encrypted using Transport Layer Security (TLS 1.2 or higher). You can verify this by confirming the padlock icon and "https://" prefix in your browser's address bar.
• AES-256 encryption at rest: Sensitive stored data — including identity documents, KYC records, and account credentials — is encrypted at rest using AES-256, an industry-standard symmetric encryption algorithm.
• Hashed passwords: Account passwords are never stored in plain text. They are processed using a strong, salted cryptographic hashing algorithm so that even cf66 personnel cannot read your password.
• Access controls: Access to systems containing personal data is restricted to authorised cf66 personnel on a strict need-to-know basis. All internal access is logged and subject to periodic audit.
• Two-factor authentication: cf66 offers two-factor authentication (2FA) to all registered players. We strongly recommend enabling 2FA on your account for an additional layer of login security.
• Intrusion detection and monitoring: Our infrastructure is monitored around the clock for anomalous activity. Intrusion detection systems generate real-time alerts that are reviewed by our security team operating on Bangladesh Standard Time (BST, UTC+6).
• Regular security testing: cf66 conducts periodic vulnerability assessments and penetration testing of its platform to identify and remediate security weaknesses before they can be exploited.

While cf66 takes reasonable and industry-appropriate measures to protect your data, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, cf66 will notify affected players without undue delay, providing details of the nature of the breach, the data involved, and the steps being taken to mitigate its impact.

If you suspect that your cf66 account has been compromised or that you have been the victim of a phishing attempt targeting cf66, please contact our support team immediately at [email protected]. Our security team will investigate and act promptly.

6 Data Retention Policy

cf66 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal or regulatory obligations. The table below sets out our standard retention periods by data category:

When personal data reaches the end of its applicable retention period, it is securely deleted or anonymised in a manner that prevents reconstruction of the original personal data. Where deletion is temporarily prevented by a legal hold (for example, in connection with active litigation or a regulatory investigation), the data will be deleted as soon as the hold is lifted.

If you request deletion of your personal data (see Section 7 — Your Privacy Rights), cf66 will action that request within 30 calendar days, subject to any overriding legal obligation to retain the data for a specified period. Where a legal obligation prevents immediate deletion, we will inform you of the applicable retention period and the reason for it.

7 Your Privacy Rights

As a cf66 player, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact our support team in English at [email protected]. We will acknowledge your request within 5 business days and complete it within 30 calendar days.

• Right of access: You have the right to request a copy of the personal data cf66 holds about you, along with information about how it is used, where it came from, and with whom it has been shared. We will provide this in a clear, structured English-language document.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You can update basic account information (such as your email address) directly from your account settings. For identity document corrections, please contact support.
• Right to erasure ("right to be forgotten"): You may request that we delete all personal data we hold about you. We will comply with this request unless we are required by law to retain the data for a specified period (see Section 6). Erasure requests will result in your cf66 account being permanently closed.
• Right to restrict processing: In certain circumstances — for example, where you contest the accuracy of your data or where processing is unlawful but you prefer restriction to deletion — you may request that we restrict how we process your data while the issue is resolved.
• Right to data portability: You may request an export of the personal data you provided to cf66 in a structured, machine-readable format (CSV or JSON). This covers registration data, transaction history, and gameplay history associated with your account.
• Right to object to processing: You may object to processing based on legitimate interests at any time. You may also withdraw consent for marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting support.
• Right not to be subject to automated decisions: You may request human review of any automated decision that has produced a significant effect on your account (for example, an automated fraud flag that has triggered an account restriction).

cf66 does not charge a fee for processing data subject requests. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or to decline the request, in which case we will explain the reason for our decision in writing.

cf66 is committed to resolving all privacy concerns internally. If you are not satisfied with our response to a request or complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction.

8 Updates to This Policy

cf66 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new legal or regulatory requirements, or improvements to our platform. The effective date at the top of this document will be revised whenever a material change is made.

Notification of material changes: Where an update materially affects your rights or the way we handle your personal data, cf66 will notify registered players via the email address on file at least 14 days before the updated policy comes into effect. We recommend keeping your registered email address current and actively monitored.

For non-material changes — such as grammatical corrections, clarifications that do not alter the substance of the policy, or updates to contact details — cf66 will update the policy without issuing individual notifications, though the effective date will still be revised.

Your continued use of the cf66 platform after a revised Privacy Policy comes into effect constitutes your acceptance of the updated terms. If you do not agree with a revised policy, you must discontinue use of the platform and may request voluntary account closure as described in the Terms & Conditions.

All previous versions of the cf66 Privacy Policy are archived internally and are available upon request. If you would like to review a prior version, contact our support team at [email protected] with the effective date of the version you wish to review.

For any questions, concerns, or requests related to this Privacy Policy, please contact us in English at [email protected]. Our support team is available 24 hours a day, 7 days a week, operating on Bangladesh Standard Time (BST, UTC+6).