Your Privacy Matters at cbaee — How We Handle Your Personal Data

1Introduction

This Privacy Policy ("Policy") describes how cbaee ("cbaee", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the cbaee online betting and casino platform at cbaee.io and any related mobile applications, APIs, or services provided under the cbaee brand.

We take privacy seriously. This Policy has been drafted to be transparent, straightforward, and easy to understand. We have deliberately avoided excessive legal jargon wherever possible while still meeting the standards expected of a responsible online platform serving the Bangladesh market and its players.

By registering an account, depositing funds, placing a bet, accessing any game, or otherwise using the cbaee platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not use the cbaee platform.

This Policy should be read alongside the cbaee Terms & Conditions and Responsible Gaming Policy, both of which are available on the cbaee website and are incorporated into the overall agreement between you and cbaee.

2Data Controller

For the purposes of this Privacy Policy, cbaee acts as the data controller in respect of personal data collected from players and visitors to the cbaee platform. As data controller, cbaee determines the purposes for which and the means by which personal data is processed.

Where cbaee engages third-party service providers to assist in the delivery of its services — such as payment processors, KYC verification providers, or fraud detection partners — those providers act as data processors operating under cbaee's instructions and are bound by contractual data processing agreements that require them to protect your personal data to at least the same standard as cbaee itself.

For all privacy-related queries, requests, or complaints, you may contact the cbaee data protection team at [email protected]. Please include "Privacy Request" in the subject line so that your communication is routed to the appropriate team member.

3Data We Collect

3.1 Data You Provide Directly

When you register, use, or interact with the cbaee platform, you may provide us with the following categories of personal data:

• Identity Data: Full legal name, date of birth, gender, and nationality as provided during registration or KYC verification.
• Contact Data: Email address, mobile phone number, and residential address.
• Identity Documents: Copies of government-issued identity documents (National Identity Card, passport, or driving licence) submitted during the KYC process.
• Financial Data: Mobile wallet identifiers (bKash, Nagad, Rocket, Upay), bank account details where applicable, deposit and withdrawal transaction records, and account balance information.
• Communications Data: Records of your correspondence with the cbaee support team, including live chat transcripts, emails, and any attachments you submit.
• Responsible Gaming Data: Preferences and settings you configure through the responsible gaming tools, including deposit limits, session reminders, cooling-off requests, and self-exclusion records.

3.2 Data Collected Automatically

When you access the cbaee platform through a browser or mobile device, we automatically collect certain technical and behavioural data, including:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers, and hardware fingerprint.
• Usage Data: Pages and sections of the platform visited, games played, bets placed, duration of sessions, click patterns, navigation paths, and feature interactions.
• Location Data: Approximate geographic location derived from your IP address. We do not access precise GPS location data from your device.
• Cookie Data: Data collected through cookies and similar tracking technologies as described in section 6 of this Policy.

3.3 Data From Third Parties

cbaee may receive personal data about you from third-party sources in limited circumstances, including:

• Identity and address verification results from KYC service providers.
• Fraud risk scores and transaction authentication results from payment processor partners.
• Sanctions screening results from compliance service providers.
• Information provided voluntarily by another player in connection with a dispute or complaint.

All third-party data sources used by cbaee are reputable, contracted service partners. Data obtained from these sources is used solely for the specific operational purpose for which it was requested.

4How We Use Your Data

cbaee uses the personal data described in section 3 for the following specific purposes:

• Account Creation & Management: To register your account, verify your identity, maintain your account profile, and provide access to the platform's features.
• Payment Processing: To process deposits, execute withdrawals, conduct anti-fraud checks on transactions, and maintain accurate financial records for your account.
• KYC & Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm that the identity documents you provide are genuine and consistent with the account registration details.
• Platform Delivery & Personalisation: To deliver the betting and gaming products you use, to save your preferences and settings, and to present you with relevant content based on your usage patterns (e.g., recently played games).
• Responsible Gaming: To enforce the deposit limits, cooling-off periods, and self-exclusion requests you have set, and to identify usage patterns that may indicate problem gambling behaviour so that appropriate support can be offered.
• Customer Support: To respond to your queries, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance purposes.
• Legal Compliance & Anti-Money-Laundering: To comply with applicable legal obligations, including financial crime prevention, sanctions screening, and the retention of records required by law.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent account activity, unauthorised access, abuse of promotions, and other prohibited conduct as described in the cbaee Terms & Conditions.
• Marketing Communications: To send you promotional offers, bonuses, and platform updates where you have provided consent to receive such communications. See section 12 for full details on marketing preferences.
• Platform Improvement: To analyse aggregated, anonymised usage data to understand how players interact with the platform and to identify opportunities to improve the user experience, game selection, and payment processes.

cbaee will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your explicit consent.

5Legal Bases for Processing

cbaee processes your personal data on the basis of one or more of the following recognised legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and cbaee — including account registration, payment processing, game delivery, and KYC verification. Without this processing, cbaee cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering obligations, age verification requirements, and financial record-keeping rules.
• Legitimate Interests: Processing carried out on the basis of cbaee's legitimate business interests, where those interests are not overridden by your fundamental rights and freedoms. Legitimate interests include fraud prevention, platform security, responsible gaming monitoring, and improvement of services.
• Consent: Processing based on your explicit, freely given consent. This applies primarily to the sending of direct marketing communications and to certain types of profiling for personalisation. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6Cookies & Tracking Technologies

6.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device, remember your preferences, and gather analytical data about how the site is used. cbaee uses cookies and similar technologies (including local storage, session storage, and device fingerprinting) to operate and improve the platform.

6.2 Types of Cookies Used

• Strictly Necessary Cookies: Essential to the operation of the platform. These cookies enable you to log in, maintain a session, and use core features. They cannot be disabled without disrupting platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how players use the platform — which pages are visited most, how long sessions last, and where errors occur. This data helps us improve the platform.
• Functionality Cookies: Used to remember your preferences such as language settings, preferred payment method, and recently played games so that your experience is more personalised on return visits.
• Security Cookies: Used as part of fraud detection and session security systems to identify unusual activity and protect your account from unauthorised access.

6.3 Managing Cookies

You may control cookie usage through your browser's privacy settings. Most browsers allow you to block or delete cookies entirely, or to manage preferences on a site-by-site basis. Please note that disabling strictly necessary cookies will impair or prevent your ability to use the cbaee platform. Disabling other categories of cookies will reduce the personalisation and analytical capabilities of the platform but will not prevent you from placing bets or accessing games.

For mobile users accessing cbaee via a browser on a device running Android or iOS, cookie management is available through the relevant browser's application settings. cbaee's platform does not currently offer a cookie preference centre widget, and all cookie-related preferences must therefore be managed at the browser level.

7Third-Party Sharing

cbaee does not sell, rent, or trade your personal data to any third party. We share personal data with external parties only in the following strictly defined circumstances:

• Payment Processors: Mobile wallet operators including bKash, Nagad, Rocket, and Upay, as well as partner banks, receive transaction data necessary to execute your deposit and withdrawal instructions. These parties process data under their own privacy policies and are independent data controllers for that processing.
• KYC Verification Partners: Identity document verification service providers receive copies of the documents you submit during the KYC process. These providers verify the authenticity of your documents and return a verification result to cbaee. Document images are not retained by cbaee beyond the legally required minimum retention period.
• Fraud & Security Service Providers: Specialist fraud detection providers receive device fingerprint data, IP address information, and transaction patterns to assess risk and prevent financial crime. These providers act as data processors under cbaee's instruction.
• Game Content Providers: Third-party game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi may receive a pseudonymised player identifier and game session data to enable game delivery. These providers do not receive your full personal profile or financial data.
• Legal & Regulatory Authorities: cbaee may disclose personal data to law enforcement bodies, financial intelligence units, or regulatory authorities where required by law, court order, or legitimate official request. cbaee will notify you of any such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of cbaee's business assets, personal data held by cbaee may be transferred to the acquiring entity. You will be notified of any such transfer before your data is subjected to a materially different privacy policy.

All third-party data processors engaged by cbaee are subject to written data processing agreements that prohibit them from using your personal data for any purpose other than the specific service they are providing to cbaee. cbaee conducts due diligence on all data processors before engagement and reviews those relationships on a regular basis.

8International Data Transfers

cbaee's primary operations and data storage are structured to serve the Bangladesh market. However, some of our third-party service providers — including KYC verification partners, fraud detection providers, and game content providers — may process data in jurisdictions outside Bangladesh. Where such transfers occur, cbaee takes appropriate measures to ensure that your personal data is protected to a standard comparable to the protections described in this Policy.

These measures include the use of standard contractual clauses in data processing agreements with international service providers, and the selection of providers who maintain internationally recognised security certifications and data protection frameworks.

If you have questions about the international transfer mechanisms applied to your data, you may contact [email protected] with the subject line "International Data Transfer Query" and a member of the data protection team will respond within 14 business days.

9Data Retention

cbaee retains personal data for no longer than is necessary to fulfil the purpose for which it was collected or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual. Anonymised and aggregated data — from which no individual can be identified — may be retained indefinitely for statistical and analytical purposes.

10Your Rights Over Your Data

cbaee recognises and respects the following rights in relation to your personal data. To exercise any of these rights, please contact [email protected] with the subject line "Data Rights Request" and specify which right you wish to exercise. cbaee will respond within 30 days of receiving a valid request.

• Right of Access: You may request a copy of all personal data that cbaee holds about you. This is sometimes referred to as a Subject Access Request (SAR). We will provide the information in a structured, readable format.
• Right to Rectification: If personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain details (such as your email address or mobile number) directly through your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing. Note that erasure may not be possible where cbaee has a legal obligation to retain the data.
• Right to Restrict Processing: You may request that cbaee restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing on the basis of legitimate interests and a decision is pending.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a machine-readable format and to request that it be transmitted to another data controller where technically feasible.
• Right to Object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, though cbaee may be able to demonstrate compelling grounds for the processing that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before withdrawal.

11Children & Minors

cbaee operates a strict minimum age policy. The platform is available only to individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data relating to individuals under the age of 21. This threshold is set above the general adult threshold in recognition of the nature of the platform and our commitment to player wellbeing.

Age verification is conducted during the KYC process for all accounts prior to the processing of any withdrawal. Where cbaee has reason to believe that an account has been registered by or on behalf of a person under 21 years of age, the account will be immediately suspended, all betting activity will be voided, and any deposits received from the account will be refunded to the payment method from which they originated.

If you believe that a person under the age of 21 has registered an account on cbaee, please contact us immediately at [email protected]. Include as much detail as possible to assist with the investigation. We treat reports of underage gambling with the utmost seriousness and will act on any such report without delay.

12Marketing Communications

cbaee may send you marketing communications about bonuses, promotions, new game launches, and seasonal offers (such as those tied to Eid, BPL cricket season, or the T20 World Cup) where you have explicitly consented to receive such communications at the time of account registration or through your account settings.

Marketing communications from cbaee may be sent via email, SMS to your registered mobile number, or in-platform notification. You may opt out of any or all of these channels at any time by:

• Updating your communication preferences in the Notifications section of your account settings.
• Clicking the unsubscribe link included in any marketing email we send you.
• Contacting the support team at [email protected] with the subject line "Marketing Opt-Out".

Opting out of marketing communications will not affect your ability to receive transactional and service messages such as deposit confirmations, withdrawal notifications, KYC status updates, account security alerts, and responses to your support requests. These operational communications are necessary for the delivery of the service and are sent on the basis of contractual necessity rather than consent.

cbaee will honour all opt-out requests within 5 business days of receipt. Please note that if you opt out and subsequently re-register or re-consent, the updated preference will take effect from the point of re-consent.

13Security Measures

cbaee implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and cbaee's servers is encrypted using industry-standard 256-bit TLS/SSL encryption. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Data Encryption at Rest: Sensitive personal data fields — including identity document data, financial account identifiers, and KYC records — are encrypted at the database level using strong encryption algorithms.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific role. All access is logged and audited.
• Two-Factor Authentication: cbaee's internal systems require multi-factor authentication for all staff accessing production data environments. Players are also encouraged to enable two-factor authentication on their accounts.
• Intrusion Detection & Monitoring: Automated intrusion detection systems monitor platform traffic continuously for signs of suspicious activity, brute-force attacks, and data exfiltration attempts. Security events are reviewed by the operations team in real time.
• Regular Security Audits: cbaee conducts periodic security assessments of its platform infrastructure, including vulnerability scanning and penetration testing, to identify and remediate security weaknesses before they can be exploited.
• Staff Training: All cbaee staff with access to personal data receive mandatory data protection and information security training. Staff are required to complete refresher training on an annual basis.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, cbaee will notify the relevant authorities and the affected players as required by applicable law, and without undue delay.

You also play an important role in keeping your account secure. You should use a strong, unique password for your cbaee account, never share your login credentials with any third party, and contact cbaee support immediately if you suspect that your account has been accessed without your authorisation.

14Policy Amendments

cbaee reserves the right to update or amend this Privacy Policy at any time to reflect changes in the law, changes to our data processing practices, or changes to the services we offer. When material changes are made to this Policy, we will notify registered players via the email address associated with their account and/or via a prominent notice on the cbaee platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy will be revised each time a new version is published. We encourage you to review this Policy periodically so that you remain informed about how cbaee handles your personal data. The most current version of this Policy will always be accessible at cbaee.io/privacy-policy.

Your continued use of the cbaee platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using the platform and may contact [email protected] to request account closure and data deletion where applicable.

15Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to cbaee's data processing practices, please contact the cbaee data protection team using the details below. We aim to respond to all privacy-related enquiries within 14 business days.

• Email: [email protected] (subject line: "Privacy Request" or "Data Rights Request")
• Platform: cbaee.io — Privacy Policy page
• Response time: Within 14 business days for general queries; within 30 days for formal data rights requests

If you are not satisfied with cbaee's response to your privacy concern, or if you believe that cbaee has processed your personal data in a manner that is inconsistent with this Policy or applicable data protection law, you have the right to escalate your complaint to the appropriate data protection authority in your jurisdiction.