cck4 Privacy Policy

This Privacy Policy ("Policy") is issued by the entity operating the cck4 platform ("cck4", "we", "us", or "our") and applies to all individuals who visit, register on, or otherwise interact with the cck4.io website, including all sub-pages, mobile-optimised views, and any future applications operated under the cck4 brand (collectively, the "Platform").

By accessing the Platform, creating an Account, making a deposit, or placing a wager on cck4, you acknowledge that you have read and understood this Policy and consent to the collection, processing, storage, and use of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the Platform immediately.

This Policy should be read alongside the cck4 Terms & Conditions, which are available at /terms-conditions. In the event of any conflict between this Policy and the Terms & Conditions in relation to data matters, this Policy shall take precedence.

For the purposes of this Policy, the data controller is the offshore-licensed entity operating the cck4 platform at cck4.io. As data controller, cck4 determines the purposes for which and the means by which your personal data is processed.

If you have any questions about how cck4 handles your personal data, wish to exercise any of your privacy rights, or wish to submit a data-related complaint, you may contact our dedicated Privacy team at any time:

• Privacy Email: [email protected] — use the subject line "Privacy Request" for the fastest response.
• Response Time: All privacy-related enquiries will receive an initial acknowledgement within 48 hours and a substantive response within 30 calendar days.
• Support Hours: Our Privacy team operates 24 hours a day, 7 days a week, including Bangladesh public holidays.

cck4 collects only the personal data that is necessary for the specific purposes described in this Policy. The categories of personal data we collect include, but are not limited to, the following:

cck4 collects personal data through three primary channels:

1. Data you provide directly:

• When you complete the cck4 registration form, including your name, date of birth, email address, and mobile number.
• When you submit KYC documents (national ID, passport, proof of address) for identity and age verification.
• When you make a deposit or withdrawal and provide your bKash, Nagad, Rocket, Upay, or bank account details.
• When you contact the cck4 support team via email or live chat.
• When you opt into a promotion or complete a survey or feedback form on the Platform.
• When you update your Account settings, communication preferences, or responsible gaming limits.

2. Data collected automatically:

• Technical and usage data collected via cookies, web beacons, pixel tags, and server-side logging each time you visit the Platform. See Section 8 (Cookies & Tracking) for full details.
• Device fingerprint data used for fraud detection and security monitoring, including IP address, browser characteristics, and login timestamps.
• Game interaction data logged by game engines operated by our licensed third-party game providers (e.g., Pragmatic Play, Evolution Gaming, Spribe, Ezugi).

3. Data received from third parties:

• Identity verification results from KYC/AML service providers used to confirm the authenticity of documents you submit.
• Payment confirmation data from mobile money operators (bKash, Nagad, Rocket, Upay) and banking partners confirming transaction status.
• Fraud and risk scoring data from third-party fraud detection systems used to protect the integrity of the Platform.

cck4 processes personal data only where there is a lawful basis for doing so. The table below sets out each processing purpose and its corresponding legal basis:

cck4 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply:

• Active Account data (identity, contact, financial, transaction data): Retained for the full duration of your Account and for a minimum of five (5) years following Account closure, in compliance with AML and record-keeping obligations.
• KYC documents (national ID scans, proof of address, passport copies): Retained for a minimum of five (5) years after the end of the business relationship, as required by international AML standards.
• Transaction records (deposit and withdrawal history, bet logs): Retained for a minimum of five (5) years for audit, dispute resolution, and AML compliance purposes.
• Support communications (email and live chat transcripts): Retained for three (3) years from the date of the communication, or longer where the communication relates to an unresolved dispute.
• Marketing consent records: Retained for three (3) years from the date consent was given or last confirmed.
• Technical and usage data (logs, IP records): Retained for twelve (12) months from the date of collection, unless retained longer for active fraud investigations.
• Self-exclusion records: Retained for the full duration of the self-exclusion period and for a minimum of five (5) years thereafter to prevent re-registration.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with cck4's data destruction procedures. Anonymised data (data from which all identifiers have been permanently removed) may be retained indefinitely for statistical and analytical purposes.

cck4 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the relevant purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank receive the payment account and transaction data necessary to process your deposits and withdrawals.
• Game providers: Licensed third-party game studios (including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming) may receive your Account identifier and game session data in order to power the games you play. These providers are bound by data protection obligations consistent with this Policy.
• KYC / AML service providers: Specialist identity verification and anti-money laundering service providers receive your KYC document data and identity information to perform verification checks required by our operating licence.
• Fraud prevention services: Third-party fraud detection platforms receive Technical Data (IP address, device identifiers, session patterns) to assess the risk profile of transactions and account activity.
• IT and hosting providers: Cloud infrastructure and data hosting providers store Platform data on servers used to operate cck4.io. All such providers are contractually bound to process data only on cck4's instructions and to maintain appropriate security standards.
• Legal and regulatory authorities: cck4 may disclose personal data to competent governmental or regulatory authorities, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or regulatory direction. In such cases, cck4 will disclose only the minimum data required to satisfy the legal obligation.
• Professional advisors: Lawyers, auditors, accountants, and insurers may receive personal data on a confidential, need-to-know basis in connection with the provision of professional services to cck4.

cck4 uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage objects) to operate the Platform effectively, maintain your logged-in session, remember your preferences, and analyse how the Platform is used. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your login state, security tokens that protect against cross-site request forgery (CSRF), and load-balancing cookies. These cookies cannot be disabled as they are required for the Platform to operate.
• Functional Cookies: Used to remember your preferences and personalise your experience, such as your preferred display language, last visited game category, and responsible gaming limit settings.
• Analytical Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform, including which pages are visited most frequently, session duration, and navigation paths. This data helps cck4 improve the Platform's design and performance.
• Security & Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, identify unusual login patterns, and enforce account security policies including device recognition for OTP-based two-factor authentication.

You may configure your browser to block or delete cookies; however, please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and may prevent you from logging into your Account. Instructions for managing cookies in common browsers are available in each browser's help documentation.

cck4 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-Bit TLS Encryption: All data transmitted between your device and the cck4 Platform is encrypted using 256-bit Transport Layer Security (TLS). This applies to every page of the Platform including the login page, deposit flows, and account settings.
• Encrypted Data Storage: Sensitive data at rest — including KYC documents, financial account details, and password hashes — is stored using industry-standard encryption algorithms. Passwords are never stored in plain text.
• OTP Two-Factor Authentication (2FA): cck4 applies one-time password (OTP) verification on new device logins as an additional layer of protection for your Account.
• Access Controls: Access to personal data within cck4's systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of data access required to perform their role.
• Regular Security Audits: cck4's Platform and infrastructure are subject to regular security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response: cck4 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a high risk to your rights, affected players will be notified promptly with details of the breach and the steps being taken to address it.

While cck4 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. You are also responsible for keeping your Account credentials secure and for notifying cck4 immediately if you believe your Account has been compromised.

As a data subject, you hold the following rights in relation to the personal data that cck4 holds about you. To exercise any of these rights, please contact [email protected] with the subject line "Privacy Request" and describe the specific right you wish to exercise. All requests will be processed within 30 calendar days.

cck4 operates a strict minimum age policy. The Platform is intended exclusively for individuals who are 21 years of age or older. cck4 does not knowingly collect, process, or store personal data belonging to individuals under the age of 21.

During registration, all applicants are required to confirm their date of birth and submit valid government-issued identity documentation (such as a Bangladesh National Identity Card or passport) to verify that they meet the minimum age requirement. Accounts where age verification cannot be confirmed will not be activated, and any funds deposited will be returned.

• Under-age data detected: If cck4 becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately and the associated Account will be permanently closed.
• Parental or guardian notification: Where cck4 identifies that a minor has attempted to register or has accessed the Platform, we will, where practicable, notify the parent or guardian and provide guidance on parental controls.
• No marketing to minors: cck4 does not direct any marketing communications, promotional materials, or advertising to individuals who are or appear to be under the age of 21.

As an offshore-licensed platform serving players primarily in Bangladesh, cck4 may transfer your personal data to, and process it in, countries other than Bangladesh. These international transfers may occur when your data is processed by third-party service providers — such as cloud infrastructure providers, KYC verification services, or game providers — whose servers are located outside Bangladesh.

cck4 ensures that all international transfers of personal data are subject to appropriate safeguards, which may include:

• Contractual safeguards: Data Processing Agreements (DPAs) with all third-party processors that include standard data protection clauses requiring the recipient to protect personal data to a standard consistent with this Policy.
• Technical safeguards: End-to-end encryption of data in transit and at rest, regardless of where data is stored, ensuring that personal data cannot be accessed by unauthorised parties during or after transfer.
• Due diligence: Prior to engaging any new third-party processor, cck4 conducts a data protection impact assessment to confirm that the processor's security practices meet cck4's standards.

By using the cck4 Platform, you acknowledge that your personal data may be transferred internationally as described in this section and consent to such transfers on the basis of the safeguards outlined above.

cck4 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The updated Policy will be published on this page with a revised effective date at the top of the document.

Where changes are material — meaning they significantly affect how your personal data is processed or the rights available to you — cck4 will notify registered Account holders via the email address on file at least 14 calendar days before the changes take effect. Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which cck4 processes your personal data, please contact our Privacy team using the details below. We take all privacy enquiries seriously and are committed to resolving concerns promptly and fairly.

• Email: [email protected] — use the subject line "Privacy Request" or "Privacy Complaint".
• Response Time: Initial acknowledgement within 48 hours; substantive response within 30 calendar days.
• Support Availability: 24 hours a day, 7 days a week, including Bangladesh public holidays such as Eid, Victory Day (16 December), and Independence Day (26 March).
• Escalation: If you are not satisfied with cck4's response to your privacy complaint, you may escalate your concern to the relevant data protection authority in your jurisdiction. Players based in Bangladesh may refer the matter to the Bangladesh Telecommunication Regulatory Commission (BTRC) or seek independent legal advice.