Privacy Policy for 33cd — How We Collect, Use & Protect Your Personal Data

1 Introduction and Scope

1.1 33cd ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy sets out, in clear and accessible terms, the categories of personal data we collect, the purposes for which it is processed, the legal basis on which we rely, and the rights available to you as a data subject.

1.2 This policy applies to all players, prospective players, and visitors to the 33cd platform regardless of the device or method used to access it. It covers data collected through the website, any mobile-optimised version, and all associated communication channels including email and live support chat.

1.3 This Privacy Policy should be read alongside 33cd's Terms & Conditions, which govern the overall legal relationship between the player and the platform. In the event of any conflict between these two documents on a privacy matter, this Privacy Policy shall take precedence.

2 Data Controller Information

2.1 For the purposes of applicable data protection law, 33cd acts as the data controller in respect of all personal data collected through the platform. As data controller, 33cd determines the purposes and means by which your personal data is processed.

2.2 All data protection inquiries, access requests, erasure requests, and formal complaints should be directed to the 33cd Data Protection team via the contact details provided in Section 15 of this policy. We aim to respond to all formal data protection requests within 10 business days (Bangladesh Standard Time, UTC+6).

3 Personal Data We Collect

3.1 The table below summarises the categories of personal data that 33cd collects and processes in the ordinary course of operating the platform.

3.2 33cd does not intentionally collect sensitive personal data such as biometric data, health data, religious beliefs, or political opinions. If you voluntarily include such information in a support message or communication, it will be treated with the highest level of confidentiality and will not be retained beyond the resolution of the relevant matter.

4 How We Collect Your Data

4.1 Directly from you: The majority of personal data we hold is provided directly by you during the account registration process, during the KYC identity verification process, when making deposit or withdrawal requests, when contacting our support team, and when updating your account profile settings.

4.2 Automatically: When you access the 33cd platform, certain technical and usage data is collected automatically through server logs, session tracking, and first-party cookies. This data helps us maintain platform security, detect fraudulent activity, and improve the player experience. See Section 8 for full details on our cookie practices.

4.3 From payment service providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment provider may share transaction confirmation data with 33cd to allow us to credit your account or verify your withdrawal. 33cd does not receive or store full payment card numbers.

4.4 From fraud prevention and identity verification partners: 33cd may work with third-party KYC and fraud prevention services to verify the identity of players and to screen accounts for suspicious activity. These partners may provide us with identity confirmation signals based on documents you submit.

5 Purposes and Legal Basis for Processing

5.1 33cd processes your personal data only where we have a legitimate legal basis to do so. The primary bases we rely on are: (a) performance of a contract — to operate your account and provide the services you have signed up for; (b) legal obligation — to comply with applicable laws including anti-money laundering, counter-terrorism financing, and KYC requirements; (c) legitimate interests — to protect the platform from fraud, to improve our services, and to conduct responsible gaming monitoring; and (d) consent — for optional marketing communications, where you have expressly opted in.

5.2 The specific purposes for which we process your personal data include:

• Creating and managing your 33cd account.
• Processing deposits, withdrawals, and all financial transactions on the platform.
• Verifying your identity and age in compliance with our 21+ age policy and KYC obligations.
• Detecting, investigating, and preventing fraudulent transactions, multi-accounting, bonus abuse, and other prohibited conduct.
• Monitoring for anti-money laundering (AML) indicators and reporting to relevant authorities where legally required.
• Delivering responsible gaming tools and interventions, including deposit limit enforcements, self-exclusion processing, and problem gambling alerts.
• Responding to your support inquiries, complaints, and formal data subject requests.
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional communications and personalised offers, where you have opted in to receive them.
• Analysing aggregated, anonymised usage data to improve platform features, betting markets, and game offerings.

6 Data Sharing and Third-Party Disclosure

6.1 33cd does not sell your personal data. We share data only with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking partners): to execute deposits and withdrawals and to confirm payment status.
• Identity verification and KYC providers: to verify the identity and age of players during the account registration and verification process.
• Fraud prevention and AML screening services: to screen transactions and account activity for indicators of money laundering, fraud, and sanctions list matches.
• Game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others): game providers may receive a session token and player identifier to facilitate seamless game launches, but do not receive full identity data.
• Cloud infrastructure and hosting providers: personal data may be stored on servers operated by reputable cloud providers. All such providers are contractually required to implement equivalent data security standards.
• Law enforcement and regulatory authorities: 33cd will disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies in Bangladesh where legally required to do so, including in response to lawful court orders or regulatory instructions.

6.2 All third-party service providers engaged by 33cd are subject to contractual data processing agreements that prohibit them from using player data for their own commercial purposes and require them to maintain appropriate security standards.

7 Payment Data and Financial Information

7.1 Financial data, including mobile wallet numbers (bKash, Nagad, Rocket, Upay) and bank account details, is treated as a highly sensitive sub-category of personal data within the 33cd data protection framework. Access to financial records is restricted to a small number of authorised personnel within the finance and compliance functions.

7.2 33cd does not store full payment card numbers on its servers. Card payment data processed via Visa or Mastercard is handled directly by our PCI-DSS compliant payment gateway partners.

7.3 Transaction records, including deposit and withdrawal history, are retained for a minimum period of five years from the date of the transaction in compliance with applicable financial record-keeping obligations. This retention period may be extended where an account is subject to an ongoing investigation or legal proceeding.

8 Cookies and Tracking Technologies

8.1 33cd uses first-party cookies and similar browser-based tracking technologies to support the operation of the platform. We do not deploy third-party advertising cookies or behavioural tracking pixels for the benefit of external advertisers.

8.2 The following categories of cookies are used on the 33cd platform:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that maintain your logged-in state and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences such as your chosen language, display settings, and previously used payment method. These improve your experience but are not essential to the platform's core operation.
• Analytics cookies: Collect anonymised data about how players navigate the platform, which pages generate the most engagement, and where technical errors occur. This data is used solely to improve platform performance and is not shared with third-party advertisers.

8.3 You may manage cookie preferences through your browser settings. Disabling functional or analytics cookies will not prevent you from accessing the platform but may affect the quality of your experience. Disabling strictly necessary cookies may prevent you from logging in or using core platform features.

9 Data Retention

9.1 33cd retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or regulatory reporting requirements. The following retention guidelines apply:

• Active account data: Retained for the duration of the account's active status plus a minimum of five years following account closure.
• Transaction and financial records: Retained for a minimum of five years from the date of the relevant transaction.
• KYC and identity verification documents: Retained for five years from the date of verification or account closure, whichever is later.
• Support communications: Retained for two years from the date of the communication, unless related to an unresolved formal complaint or legal matter.
• Marketing preference data: Retained until you withdraw consent, at which point marketing records are updated within 5 business days and marketing activity ceases.

9.2 Upon the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for statistical and analytical purposes.

10 Data Security

10.1 33cd employs a layered, defence-in-depth approach to data security. Technical measures include 256-bit SSL/TLS encryption for all data in transit, AES-256 encryption for data at rest, firewalls, intrusion detection systems, and regular penetration testing by independent security professionals.

10.2 Access controls are enforced on a strict need-to-know basis. All 33cd personnel with access to personal data undergo data protection training and are subject to confidentiality obligations. Privileged access is logged and audited regularly.

10.3 In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, 33cd will notify the affected individuals promptly, providing clear information about the nature of the breach, the data affected, and the steps being taken to mitigate any harm.

11 Your Rights and How to Exercise Them

11.1 As described in the summary section above, you hold a range of rights over your personal data. To exercise any of these rights, please contact the 33cd Data Protection team at [email protected] with the subject line "Data Subject Request" and include your registered account email address and a description of the request you are making.

11.2 We will acknowledge your request within 3 business days and aim to provide a substantive response within 10 business days. In complex cases, we may require up to 30 calendar days, in which case we will notify you of the extension and the reasons for it.

11.3 We may need to verify your identity before fulfilling any data subject request. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it.

11.4 There is no charge for exercising your data subject rights. However, where requests are manifestly unfounded or excessive in nature, 33cd reserves the right to charge a reasonable administrative fee or decline to action the request, providing written reasons for that decision.

12 Marketing Communications

12.1 33cd sends promotional communications — including bonus offers, tournament announcements, seasonal promotions tied to events such as Eid, Pohela Boishakh, the BPL season, and IPL — only to players who have opted in to receive them at registration or through their account settings.

12.2 You may withdraw consent to receive marketing communications at any time by updating your preferences in your account settings or by contacting [email protected]. Marketing communications will cease within 5 business days of receiving your request. Withdrawal of marketing consent does not affect your ability to use the platform or receive transactional communications such as deposit and withdrawal confirmations.

12.3 33cd does not share player data with any external marketing networks, affiliate advertising platforms, or social media advertising systems for the purpose of targeting players with third-party advertisements.

13 Children and Underage Players

13.1 The 33cd platform is strictly for adults aged 21 and above. We do not knowingly collect or process personal data relating to individuals under the age of 21. If we become aware that personal data relating to an underage individual has been collected, we will take immediate steps to delete that data and close the associated account.

13.2 If you are a parent or guardian and believe that an individual under 21 in your care has registered an account with 33cd, please contact us immediately at [email protected]. We will treat such reports with the highest priority and will action them within 24 hours.

14 Changes to This Privacy Policy

14.1 33cd may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or platform features. Where changes are material — meaning they significantly affect how we use your personal data or reduce the rights available to you — we will provide at least 14 days' advance notice by email to your registered address and via a notice on the platform before the revised policy takes effect.

14.2 Minor or clarificatory changes may be made without advance notice. The "Last Updated" date at the top of this policy will always reflect the date of the most recent revision. We encourage you to review this policy periodically to stay informed about how we protect your data.

14.3 Your continued use of the 33cd platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with the revised policy, you should stop using the platform and contact us to arrange account closure.

15 Contact and Complaints

15.1 For all privacy-related inquiries, data subject requests, or complaints regarding the handling of your personal data, please contact the 33cd Data Protection team using the details below. All communications must be in English.

• Data Protection Contact Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Subject Request"
• Subject Line for Privacy Complaints: "Privacy Complaint"
• Response Target: Acknowledgement within 3 business days; substantive response within 10 business days
• Operating Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

15.2 If you are not satisfied with 33cd's response to a privacy complaint, you may escalate the matter through good-faith negotiation as described in our Terms & Conditions. We take all privacy complaints seriously and commit to working constructively toward a fair resolution.