cc333 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Introduction

This Privacy Policy ("Policy") describes how cc333 ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects personal data belonging to members, prospective members, and visitors of the cc333 platform, accessible at cc333.io ("the Website").

cc333 is an internationally licensed online casino and sports betting platform operating with a primary focus on the Bangladesh market. We are committed to responsible and transparent data stewardship, and this Policy reflects that commitment in precise, formal terms.

By registering an account on cc333, visiting our Website, or otherwise interacting with cc333 services, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the cc333 platform immediately.

This Privacy Policy should be read in conjunction with the cc333 Terms & Conditions and Responsible Gaming Policy, all of which together form the complete legal framework governing your relationship with cc333. Where this Policy conflicts with any other document, this Policy shall prevail with respect to privacy and data protection matters.

2 Data We Collect

cc333 collects personal data through multiple channels: directly from you when you register or interact with the platform, automatically as you use the Website, and in some cases from third-party service providers who assist us in operating the platform. The categories of data we collect are as follows:

2.1 Identity and Registration Data

When you create a cc333 account, we collect your full legal name, date of birth, nationality, username, and password (stored in hashed, non-recoverable form). We require this information to establish your identity, verify your age eligibility (21+), and maintain your account record.

2.2 Contact Information

We collect your mobile phone number and email address for account communication, transaction alerts, security verification (two-factor authentication), and, where you have opted in, promotional notifications. Your contact details are never shared with third-party advertisers.

2.3 KYC Verification Documents

In compliance with our Know Your Customer (KYC) obligations and anti-money laundering (AML) standards, we may collect copies of government-issued identity documents (National ID Card, passport, or driving licence), proof of address (utility bill or bank statement), and proof of payment method. These documents are stored securely and processed solely for identity verification and regulatory compliance purposes.

2.4 Financial and Transaction Data

We record all deposit and withdrawal transactions associated with your cc333 account, including the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard), transaction amounts in BDT, timestamps, and transaction reference numbers. We do not store full card numbers or full mobile banking credentials — payment processing is handled by our payment partners under their own security standards.

2.5 Gaming Activity Data

cc333 maintains a record of your gaming activity, including game sessions played, bet amounts placed, outcomes, bonus usage, and responsible gaming tool settings (deposit limits, self-exclusion status). This data is used for account management, responsible gaming monitoring, bonus integrity checks, and improving our game offering.

2.6 Technical and Device Data

When you access cc333, we automatically collect technical data including your IP address, browser type and version, operating system, device type (mobile or desktop), screen resolution, referring URL, and session duration. This data helps us diagnose technical issues, detect fraud, and improve platform performance.

2.7 Communications Data

When you contact cc333 support via live chat, email, or WhatsApp, we retain a record of the conversation content, timestamps, and the support agent's responses. These records are used for quality assurance, dispute resolution, and staff training purposes.

3 How We Use Your Data

cc333 uses the personal data we collect exclusively for the following purposes. We do not use your data for any purpose not listed here without first obtaining your explicit consent or being required to do so by law:

• Account management — creating and maintaining your cc333 account, verifying your identity, and managing your account settings and preferences.
• Service delivery — enabling you to place bets, play casino games, make deposits and withdrawals, and access all platform features.
• Payment processing — facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and reconciling transaction records.
• Legal and regulatory compliance — fulfilling our obligations under applicable KYC, AML, and data protection regulations, including reporting suspicious activity to relevant authorities where legally required.
• Fraud detection and security — identifying and investigating suspicious account activity, protecting members from unauthorised account access, and safeguarding the integrity of the platform.
• Responsible gaming — monitoring gaming patterns to identify potential problem gambling behaviour, enforcing self-exclusion and deposit limit settings, and contacting members where we have genuine welfare concerns.
• Customer support — responding to your queries, resolving disputes, and improving the quality of our support service.
• Platform improvement — analysing aggregated, anonymised usage data to improve game selection, website performance, and user experience.
• Marketing communications — sending you promotional offers, bonus announcements, and seasonal campaign notifications where you have opted in to receive such communications. You may opt out at any time.
• Legal proceedings — if required, using personal data in connection with legal claims, regulatory investigations, or compliance audits.

4 Legal Basis for Processing

cc333 processes personal data only when a valid legal basis exists for doing so. The legal bases we rely on are as follows:

4.1 Contractual Necessity

The majority of data processing by cc333 is necessary for the performance of the contract between you and cc333 — specifically, to operate your account, process transactions, and deliver gaming services. Without this processing, we cannot provide the services you have registered to use.

4.2 Legal Obligation

Certain data processing is required for cc333 to comply with applicable legal and regulatory requirements, including KYC identity verification, AML transaction monitoring, and the retention of financial records for audit purposes.

4.3 Legitimate Interests

cc333 processes some data on the basis of our legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and product analytics — provided that such interests are not overridden by your fundamental rights and freedoms. Where we rely on legitimate interests, we have conducted an internal balancing assessment to confirm this basis is appropriate.

4.4 Consent

For optional data processing activities — most notably, marketing communications and non-essential cookies — cc333 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without detriment to your account, by contacting [email protected] or adjusting your communication preferences in your account dashboard.

5 Data Sharing and Disclosure

cc333 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. Data is shared only in the limited circumstances described below:

5.1 Service Providers and Sub-processors

We work with a carefully selected group of third-party service providers who process data on cc333's behalf. These include:

• KYC and identity verification providers — to verify the identity and age of members as required by our compliance obligations.
• Payment processors — including bKash, Nagad, Rocket, Upay, and card network processors — to facilitate deposits and withdrawals.
• Game software providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — who may receive session data necessary for the delivery of game content.
• Customer support platform providers — who provide the live chat and ticketing infrastructure used by our support team.
• Fraud prevention and security vendors — who assist in detecting and preventing fraudulent activity on the platform.

All service providers are bound by written data processing agreements that restrict them from using your data for any purpose other than providing the contracted service to cc333, and that require them to apply appropriate security safeguards.

5.2 Legal and Regulatory Disclosure

cc333 may disclose personal data to law enforcement agencies, regulatory authorities, or courts if we are legally required to do so by applicable law, court order, or regulatory directive. We will, where legally permissible, notify affected members of such disclosures.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of cc333's assets, member personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice prior to any such transfer and will ensure the receiving entity is bound by privacy obligations no less protective than those in this Policy.

6 International Data Transfers

cc333 operates as an internationally licensed platform and some of its service providers and game content partners are located outside of Bangladesh. This means that your personal data may be transferred to and processed in countries other than the country in which you reside.

When we transfer data internationally, we ensure that appropriate safeguards are in place to protect your data to the same standard as applied within cc333's own systems. These safeguards may include:

• Standard contractual clauses agreed with the receiving entity that impose data protection obligations equivalent to those in this Policy
• Data processing agreements with service providers certified under internationally recognised data protection frameworks
• Transfers only to entities that cc333 has verified maintain security standards consistent with our own

By using the cc333 platform, you acknowledge and consent to the international transfer of your data under the safeguards described in this section.

7 Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function correctly, to remember your preferences, and to provide analytical data to site operators. cc333 uses cookies and similar technologies including web beacons and session tokens across our Website.

7.2 Types of Cookies We Use

7.3 Managing Cookies

You can manage or disable cookies through your browser settings at any time. Most browsers allow you to refuse new cookies, delete existing cookies, and be notified when new cookies are placed. Please note that disabling strictly necessary or security cookies will significantly affect your ability to use the cc333 platform, including the ability to log in and maintain a secure session.

cc333 does not use advertising or tracking cookies that follow your activity across other websites. Analytical cookies used on cc333 measure on-site behaviour only and the resulting data is anonymised and aggregated before analysis.

8 Data Retention

cc333 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulation. The general retention periods we apply are as follows:

• Active account data — retained for the full duration of your account's active status plus a minimum of 5 years following account closure, in accordance with standard financial record-keeping requirements.
• KYC and identity documents — retained for a minimum of 5 years from the date of the most recent transaction or account closure, whichever is later, in accordance with AML regulatory requirements.
• Transaction records — retained for a minimum of 5 years from the date of each transaction for financial audit and AML reporting purposes.
• Support communications — retained for up to 3 years from the date of the interaction, or longer if the communication relates to an ongoing dispute or legal matter.
• Technical and device logs — retained for up to 12 months from the date of collection, unless a security investigation requires longer retention.
• Marketing consent records — retained for the duration of your membership plus a reasonable period to demonstrate consent was obtained if later challenged.

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised such that it can no longer be associated with any individual. If you request deletion of your account prior to the end of a retention period, we will delete all non-legally-mandated data immediately and flag the remaining data for deletion as soon as the legal retention obligation expires.

9 Your Data Rights

As a cc333 member, you hold a number of rights regarding your personal data. cc333 is committed to facilitating the exercise of these rights promptly and without undue burden. Your rights are as follows:

• Right of access — you have the right to request a copy of the personal data cc333 holds about you, along with information about how it is being used. We will respond to access requests within 30 days.
• Right to rectification — if any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For identity-critical data (name, date of birth), we may require documentary evidence before making changes.
• Right to erasure — you have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you have withdrawn consent and no other legal basis for processing exists. This right is subject to legal retention obligations.
• Right to restriction — in certain circumstances (e.g., where you contest the accuracy of your data or have objected to processing), you may request that cc333 restrict processing of your data to storage only until the matter is resolved.
• Right to data portability — you have the right to receive a copy of personal data you have provided to cc333 in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object — you have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the cc333 data team at [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 5 business days and provide a full response within 30 days. In complex cases, this period may be extended by a further 30 days with prior notice.

10 Children and Minors

The cc333 platform is strictly intended for adults aged 21 years and above. cc333 does not knowingly collect, store, or process personal data relating to individuals under the age of 21. Registration on cc333 by a person under 21 years of age is a direct violation of our Terms & Conditions and is strictly prohibited.

If cc333 becomes aware that personal data relating to a person under the age of 21 has been collected, we will take immediate steps to delete that data from our systems and close the associated account. Any funds deposited by an underage account will be returned via the original payment method after verification.

Parents and guardians who believe that a minor in their care has registered on cc333 are urged to contact our support team immediately at [email protected] so that the matter can be investigated and resolved without delay. cc333 fully supports parental control tools and filtering software that restrict access to online gambling platforms.

11 Security Measures

cc333 applies a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption — all data transmitted between your device and cc333 servers is encrypted in transit using industry-standard TLS protocols, preventing interception by third parties.
• Encrypted data storage — sensitive personal data, including KYC documents and financial records, is stored in encrypted form at rest on secured servers with access restricted by role-based permissions.
• Two-factor authentication (2FA) — members are encouraged to enable 2FA on their accounts. cc333 staff access to member data systems also requires multi-factor authentication.
• Access control policies — only authorised cc333 personnel with a documented business need may access member personal data. All staff access is logged and subject to periodic audit.
• Regular security audits — cc333 conducts periodic internal and third-party security assessments to identify and address potential vulnerabilities in our systems and processes.
• Incident response plan — in the event of a data security incident, cc333 has a documented response plan that includes containment, investigation, regulatory notification (where required), and member notification procedures.
• Staff training — all cc333 staff who handle personal data receive regular training on data protection obligations and security best practices.

Despite these measures, no system is entirely immune to security risks. cc333 cannot guarantee absolute security of data transmitted over the internet. Members are encouraged to use strong, unique passwords, enable 2FA, and contact support immediately if they suspect their account has been compromised.

12 Third-Party Links

The cc333 website may, in limited contexts, reference or display the names of third-party service providers, game studios, or payment partners. While cc333 takes care to work only with reputable partners, we do not control the privacy practices of any third-party entity and are not responsible for the content, policies, or practices of external organisations.

This Privacy Policy applies solely to data collected and processed by cc333 directly. If you provide personal data to any third-party service — including payment providers such as bKash, Nagad, or Rocket — your interaction with that service is governed exclusively by their own privacy policy, and cc333 bears no responsibility for how that data is handled.

Members are advised to review the privacy policies of any third-party services they interact with in connection with their cc333 account.

13 Marketing Communications

cc333 may from time to time send members promotional communications including bonus offers, game announcements, seasonal promotions (such as those tied to Eid, Pohela Boishakh, or BPL season), and platform news. Marketing communications are sent only to members who have explicitly opted in to receive them.

13.1 Opting In

By checking the relevant opt-in box during registration, or by later updating your communication preferences in your account dashboard, you consent to receiving marketing communications from cc333 via email, SMS, or WhatsApp message. cc333 does not share your contact details with third-party marketers for their own promotional use.

13.2 Opting Out

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email sent by cc333
• Updating your notification preferences in your cc333 account dashboard
• Contacting [email protected] with the subject line "Unsubscribe — [Your Username]"

Opt-out requests will be processed within 5 business days. Please note that opting out of marketing communications does not affect transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are necessary for the operation of your account and cannot be disabled.

14 Policy Updates

cc333 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes to this Policy, we will notify active members via email or a prominent notice on the cc333 platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. Your continued use of the cc333 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with a revised Policy, you should discontinue use of the platform and contact [email protected] to close your account.

We encourage members to review this Privacy Policy periodically to stay informed about how cc333 protects your personal data. All previous versions of this Policy are available upon written request to [email protected].

15 Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way cc333 handles your personal data, please contact our data protection team using the details below. We take all privacy concerns seriously and will respond promptly and transparently.

• Email: [email protected]
• WhatsApp: +880 1700 000 333
• Subject line for data requests: "Data Rights Request — [Your Username]"
• Subject line for privacy complaints: "Privacy Complaint — [Your Username]"
• Support hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

cc333 aims to resolve all privacy-related queries and complaints within 14 business days of receipt. If you are not satisfied with our response, you retain the right to escalate the matter to the relevant data protection authority or seek legal remedy through the appropriate jurisdiction.