cg66 Privacy Policy — How We Protect Your Data

1 Introduction

This Privacy Policy (the "Policy") describes how cg66 (the "Company", "we", "us", or "our"), operator of the online gaming and sports betting platform at cg66.io (the "Platform"), collects, uses, stores, shares, and protects personal data belonging to users of the Platform ("Players", "you", or "your").

By registering an account on the cg66 Platform or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and may request closure of your account by contacting [email protected].

This Policy forms part of cg66's Terms & Conditions and should be read alongside that document. This Policy was last updated in January 2026. We recommend reviewing this page periodically to stay informed of any updates.

2 Data We Collect

cg66 collects personal data through several channels. The categories of personal data we may collect about you are set out below.

2.1 Account Registration Data

When you register an account on cg66, we collect the information you provide during the registration form, which typically includes: full legal name, date of birth, email address, mobile telephone number, residential address (including city, district, and postcode), and preferred currency (Bangladeshi Taka, ৳ BDT).

2.2 Identity Verification (KYC) Data

To comply with our age verification and anti-fraud obligations, cg66 may collect copies of government-issued photo identification documents (such as a National Identity Card, passport, or driving licence), proof of address documentation (such as a utility bill or bank statement), and proof of payment method ownership. This data is collected only when KYC verification is triggered and is handled with heightened security controls.

2.3 Financial and Transaction Data

We collect records of all deposits and withdrawals made through your cg66 account, including the payment method used (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard, or other approved methods), transaction reference numbers, transaction timestamps in Bangladesh Standard Time (BST, UTC+6), and transaction amounts in BDT.

2.4 Gaming Activity Data

We maintain records of your gaming and betting activity on the Platform, including bets placed, games played, wager amounts, win and loss records, bonus credits received and wagered, and session duration. This data is used to operate your account, resolve disputes, monitor for responsible gaming concerns, and fulfil our obligations under applicable gaming regulations.

2.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical data including your IP address, browser type and version, operating system, device type and identifiers, screen resolution, referring URL, and timestamps of access events. This data is used for security monitoring, fraud prevention, and Platform performance analysis.

2.6 Communication Data

If you contact our support team via live chat, email, or any other channel, we retain records of that communication including the content of messages, timestamps, and any attachments or evidence shared. This allows us to provide consistent support and maintain an accurate record of dispute resolution outcomes.

3 How We Use Your Data

cg66 uses the personal data we collect for the following purposes:

cg66 does not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

4 Legal Basis for Processing

cg66 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform our contract with you — that is, to operate your cg66 account, process your bets, handle deposits and withdrawals, and provide customer support.
• Legitimate Interests: Processing that is necessary for cg66's legitimate business interests, including fraud prevention, security monitoring, and improving the Platform, provided those interests are not overridden by your data protection rights.
• Legal Obligation: Processing that is required to comply with applicable legal obligations, including anti-money laundering checks, age verification requirements, and data retention obligations.
• Consent: Where cg66 relies on your consent as the legal basis for processing — in particular for direct marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal. Consent withdrawal requests can be sent to [email protected].

5 Sharing Your Data

cg66 does not sell, rent, or trade your personal data. We may share your personal data with third parties only in the limited circumstances described below.

5.1 Payment Processors

To facilitate deposits and withdrawals, we share necessary financial data with our Approved Payment Method partners, including bKash, Nagad, Rocket, Upay, and banking partners such as Dutch-Bangla Bank, City Bank, and BRAC Bank. These partners receive only the data required to process the specific transaction and are bound by their own privacy and data security obligations.

5.2 Game Providers

cg66 integrates games provided by third-party studios including Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, Microgaming, and Play'n GO. These providers may receive anonymised session identifiers and game-specific data necessary to deliver their games through the Platform. They do not receive your full name, address, or payment information.

5.3 Identity Verification Services

Where KYC verification is required, cg66 may share identity document data with specialist third-party KYC and age verification service providers. All such providers are contractually required to process your data solely for the purpose of verification and to maintain appropriate data security standards.

5.4 Legal and Regulatory Authorities

cg66 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a court order, or a binding regulatory demand. cg66 will, where legally permissible, notify you of such a disclosure request before complying.

5.5 Business Transfers

In the event that cg66 undergoes a merger, acquisition, corporate restructuring, or sale of all or part of its assets, your personal data may be transferred to the relevant successor entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Policy that result from it.

6 Data Storage & Security

6.1 Where Your Data Is Stored

cg66's primary data infrastructure is hosted on secure servers managed by enterprise-grade cloud service providers. Servers processing data for Bangladesh-based players are operated in data centres that maintain ISO/IEC 27001 or equivalent information security management standards. Your data may be processed in multiple jurisdictions as part of cg66's global infrastructure, but all transfers are subject to appropriate contractual safeguards.

6.2 Security Measures

cg66 applies a layered security approach to protect your personal data. Key measures include:

• Encryption in transit: All data transmitted between your device and our servers is protected by TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive personal data, including KYC documents and payment details, is stored in encrypted form using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo security training and are bound by confidentiality obligations.
• Intrusion detection: Our systems are monitored 24/7 for unauthorised access attempts, anomalous activity, and potential data breaches.
• Two-factor authentication: Internal administrative access to systems containing personal data requires multi-factor authentication.

6.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cg66 will notify affected Players without undue delay via the email address registered to their account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures cg66 has taken or proposes to take to address the breach.

7 Data Retention

cg66 retains personal data for the following periods:

Upon expiry of the applicable retention period, personal data is securely and permanently deleted from cg66's systems and from all third-party processors to whom it was shared, unless a longer retention period is required by a specific legal obligation applicable at that time.

8 Cookies & Tracking

8.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. cg66 uses cookies and similar tracking technologies (including local storage and session storage) to operate the Platform, improve your user experience, and monitor Platform security.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without rendering the Platform non-functional.
• Performance Cookies: Used to collect anonymised data about how players use the Platform — for example, which pages are visited most frequently and where error messages are encountered. This data helps us improve Platform performance and navigation.
• Functional Cookies: Used to remember your preferences, such as your selected language, currency display setting, and responsible gaming tool configurations.
• Analytics Cookies: cg66 may use first-party analytics tools to understand aggregate player behaviour on the Platform. Any analytics data used is anonymised and aggregated before analysis.

8.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to refuse new cookies, delete existing cookies, and be notified when new cookies are set. Please note that disabling certain cookies may affect the functionality of the cg66 Platform, including your ability to stay logged in or access certain features. For detailed guidance on managing cookies in your browser, refer to your browser's help documentation.

9 Your Rights

Subject to applicable law, you have the following rights in respect of your personal data held by cg66. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving a verified request.

• Right of Access: You have the right to request a copy of the personal data cg66 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. For basic account data such as your email address or phone number, you may update this directly from within your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing has no legitimate basis. This right is subject to our legal retention obligations — certain data must be retained for a minimum period as described in Section 7.
• Right to Restriction of Processing: You have the right to request that cg66 restricts its processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to cg66 in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another data controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where cg66 relies on legitimate interests as its legal basis, and to object at any time to processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10 Children & Minors

The cg66 Platform is strictly for adults aged 21 years and above. cg66 does not knowingly collect or process personal data belonging to any person under the age of 21. If you are under 21 years of age, you must not register an account, use the Platform, or submit any personal data to cg66.

If cg66 discovers or is notified that it has inadvertently collected personal data from a person under the age of 21, we will immediately close the relevant account, delete all associated personal data (other than records required to prevent future under-age registration), and return any deposited funds to the payment method used for the original deposit.

If you are the parent or guardian of a minor and believe that your child has registered on the cg66 Platform, please contact us immediately at [email protected]. We will treat all such reports as a high priority and act swiftly to close the account and remove the minor's data.

11 Third-Party Services

The cg66 Platform integrates third-party services to deliver certain features. These third-party services operate under their own privacy policies, and cg66 is not responsible for the data practices of these providers beyond the contractual obligations we impose upon them. Key third-party integrations include:

• Game Studio Software: Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, Microgaming, and Play'n GO provide game software integrated within the Platform. These providers may receive anonymised session data required to run their games.
• Payment Infrastructure: bKash, Nagad, Rocket, Upay, and banking partners process payment transactions. They receive transaction data necessary to complete your deposit or withdrawal.
• KYC Verification Providers: Specialist identity verification services receive identity document data to complete KYC checks as described in Section 2.2.
• Cloud Infrastructure Providers: cg66's servers and databases are hosted on enterprise cloud infrastructure. These providers have access to encrypted data at a physical infrastructure level and are bound by data processing agreements.

All third-party providers engaged by cg66 are required to enter into data processing agreements that restrict their use of your personal data to the specific purposes for which it was shared, require them to maintain appropriate security standards, and prohibit them from sharing your data with any further parties without cg66's prior written consent.

12 Marketing Communications

With your consent, cg66 may send you promotional communications about new games, seasonal bonuses (for example during Eid, Pohela Boishakh, or the BPL cricket season), special deposit offers, and platform updates. Marketing communications are sent via email to the address registered on your account.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link included in any marketing email from cg66;
• Updating your communication preferences from within your account settings on the Platform; or
• Sending a written opt-out request to [email protected].

Opting out of marketing communications will not affect transactional communications that are necessary to operate your account, such as deposit confirmation messages, withdrawal status updates, security alerts, or KYC verification requests. These operational communications are sent regardless of your marketing preference settings.

13 Changes to This Policy

cg66 reserves the right to update or amend this Privacy Policy at any time. Changes may be necessary to reflect updates to the Platform, new legal or regulatory requirements, changes in data processing practices, or improvements to how we communicate our data practices to players.

When we make material changes to this Policy, we will notify active Players via the email address registered to their account at least 14 days before the changes take effect. The updated Policy will also be published on this page with a revised "Last Updated" date at the top of the document. For minor or clarificatory changes that do not materially affect your rights, we may update the Policy without prior individual notification.

Your continued use of the cg66 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must stop using the Platform and may request closure of your account by contacting [email protected].

14 Contact & Data Requests

14.1 General Privacy Enquiries

If you have any questions, concerns, or feedback regarding this Privacy Policy or cg66's data practices, please contact our support team in the first instance:

• Email: [email protected]
• Live Chat: Available 24/7 via the Platform (Bangladesh Standard Time, UTC+6)
• Response Time: Email responses within 4 hours during standard operating hours; live chat average under 2 minutes during peak hours (18:00–00:00 BST)

14.2 Responsible Gaming & Data Concerns

For privacy matters specifically related to responsible gaming data — including requests to delete self-exclusion records after the applicable cooling-off period or queries about how your gaming activity data is used in responsible gaming monitoring — please contact our dedicated Responsible Gaming team:

• Email: [email protected]

14.3 Formal Data Rights Requests

To exercise any of the data subject rights described in Section 9 of this Policy — including access, rectification, erasure, restriction, portability, or objection — please submit a formal written request to [email protected] with the subject line "Data Rights Request". To protect your privacy and prevent unauthorised access to your data, we will need to verify your identity before processing any data rights request. Please include your registered account username and the email address associated with your account in your request.

cg66 will acknowledge your data rights request within 72 hours of receipt and will provide a full response within 30 calendar days, subject to identity verification being completed. We do not charge a fee for data rights requests unless they are manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or to decline to act on the request.