cd678 Privacy Policy — How We Handle Your Data
At cd678, protecting the personal data of every Bangladeshi player is a core responsibility — not an afterthought. This Privacy Policy explains exactly what information we collect, how we use it, and the rights you hold over your own data.
Six Privacy Principles at cd678
These principles guide every decision we make about how we collect, store, and use personal data across the cd678 platform.
Minimal Collection
cd678 collects only the personal data that is strictly necessary to provide a safe, functional, and compliant gaming service. We do not collect data speculatively or for purposes beyond those stated in this policy.
Secure Storage
All personal data stored on cd678 infrastructure is protected by 256-bit SSL encryption in transit and AES-256 encryption at rest. Access to player data is strictly role-limited to authorised personnel only.
Player Control
You retain meaningful control over your personal data at cd678. You may request access, correction, or deletion of your data at any time by contacting our support team, subject to applicable legal retention obligations.
No Unauthorised Sharing
cd678 does not sell, rent, or trade your personal data to third-party advertisers or data brokers. Data is shared only with service partners directly involved in delivering the cd678 platform — and only under strict contractual data protection obligations.
Transparent Purpose
Every category of data we collect is linked to a clearly stated purpose in this Privacy Policy. We do not repurpose data for undisclosed uses. If our purposes change materially, we will notify you before any new processing begins.
Limited Retention
Personal data is retained only for as long as it is needed to fulfil the purpose for which it was collected, or as required by applicable law. Once the retention period expires, data is securely deleted or anonymised in accordance with our data lifecycle policy.
1. Data We Collect
cd678 collects personal data from players during registration, ongoing platform use, identity verification, and customer support interactions. The categories of personal data we process are described in the table below. We collect only the information that is genuinely necessary to operate a safe and compliant online casino and sports betting platform for Bangladeshi players.
1.1 Categories of Personal Data
| Category | Examples | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, NID number, passport number | Registration and KYC verification |
| Contact Data | Email address, mobile phone number, residential address | Registration and account updates |
| Financial Data | bKash/Nagad/Rocket/Upay wallet numbers, Visa/Mastercard last four digits, transaction history | Deposits, withdrawals, and KYC |
| Usage Data | Login timestamps, games played, bet amounts, session durations, device type, IP address | Continuous platform use |
| Communication Data | Support chat transcripts, email correspondence, complaint records | Customer support interactions |
| Technical Data | Browser type, operating system, device identifiers, cookie identifiers, referral URL | Automatic collection via cookies and analytics |
| Verification Documents | Scanned or photographed NID, passport, utility bills, bank statements | KYC verification and withdrawal processing |
1.2 Data We Do Not Collect
cd678 does not intentionally collect the following categories of sensitive personal data, and players should not submit such information to us:
- Racial or ethnic origin
- Political opinions, religious beliefs, or philosophical convictions
- Trade union membership
- Genetic or biometric data (other than identity document photographs required for KYC)
- Health or medical information (except where voluntarily shared in the context of a self-exclusion or responsible gambling request)
1.3 Data from Minors
cd678 does not knowingly collect personal data from any individual under the age of 18. The platform is strictly intended for adults only. If we become aware that personal data has been submitted by a person under 18, we will delete that data promptly and close the associated account. If you have reason to believe that a minor has submitted data to cd678, please contact us immediately at [email protected].
2. How We Use Your Data
cd678 uses the personal data we collect for the following purposes. Each purpose is tied directly to a lawful basis described in Section 3 of this Privacy Policy. We do not use your data for any purpose that is incompatible with those originally stated at the time of collection.
2.1 Account Registration and Management
We use your identity and contact data to create and manage your cd678 player account, verify your identity, authenticate your login, and enable you to access all platform features including casino games, cricket and sports betting markets, and payment services denominated in Bangladeshi Taka.
2.2 Payment Processing
Financial data is used to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard. We retain transaction records to comply with anti-money laundering (AML) obligations and to resolve payment disputes. cd678 does not store full card numbers; only the last four digits and card type are retained for reference purposes.
2.3 Identity Verification (KYC)
We are obligated to verify the identity of players before processing withdrawals and in response to suspicious activity alerts. Verification documents are used solely for this purpose and are stored securely with access restricted to our compliance team. Documents are not shared with any third party except as required by law.
2.4 Fraud Prevention and Security
Usage data, technical data, and financial data are analysed to detect and prevent fraudulent activity, bonus abuse, money laundering, multiple account creation, and other prohibited conduct as defined in our Terms & Conditions. This processing is carried out in the legitimate interest of protecting our platform and all players who use it.
2.5 Customer Support
Communication data — including support chat logs and email correspondence — is retained to enable our support team to resolve queries efficiently, track complaint outcomes, and improve the quality of our customer service. Support records are retained for a period of three years from the date of the last interaction.
2.6 Responsible Gambling
Usage data including session durations, wagering patterns, and deposit frequency is monitored to identify players who may be experiencing signs of problem gambling. Where such indicators are detected, cd678 may proactively reach out to offer responsible gambling tools including deposit limits, cooling-off periods, and self-exclusion. This processing is conducted in the vital interest of player wellbeing.
2.7 Marketing Communications
With your explicit consent at the time of registration — or at any point thereafter — cd678 may send you promotional communications including bonus offers, tournament announcements, and platform updates by email or SMS. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting [email protected]. Withdrawal of marketing consent does not affect your ability to use the platform.
2.8 Platform Improvement and Analytics
Aggregated and anonymised usage data is used to understand how players interact with the cd678 platform, identify technical issues, and improve game performance and user experience. Where analytics tools are used, they are configured to anonymise IP addresses and restrict data to session-level behaviour only — no individual player profiles are built for analytics purposes.
3. Legal Basis for Processing
cd678 processes personal data only where a valid legal basis exists for doing so. The legal bases we rely on are described below, mapped to the processing activities outlined in Section 2.
- Contractual Necessity: Processing your identity, contact, and financial data is necessary to perform the contract between you and cd678 — that is, to provide you with an account, accept deposits, settle bets, and process withdrawals. Without this processing, we could not provide the service.
- Legal Obligation: We are required by applicable law to collect and retain certain data, including identity verification documents and transaction records, for AML compliance and fraud prevention purposes. This processing occurs regardless of consent.
- Legitimate Interests: Fraud detection, security monitoring, platform analytics, and responsible gambling monitoring are carried out on the basis of our legitimate interest in operating a safe and fair platform. We have conducted a balancing assessment and are satisfied that our interests do not override your fundamental privacy rights in these contexts.
- Consent: Marketing communications are sent only where you have given explicit, informed consent. You may withdraw consent at any time without penalty.
- Vital Interests: In exceptional circumstances — for example, where a player contacts us in crisis in relation to problem gambling — we may process data to protect the vital interests of that individual.
4. Data Sharing & Third Parties
cd678 does not sell, rent, or trade your personal data to any third party. We share data only with the categories of partners described below, and only to the extent necessary for the stated purpose. All third-party data processors engaged by cd678 are bound by contractual data processing agreements that require them to handle your data securely and in accordance with applicable data protection standards.
4.1 Game Software Providers
cd678 partners with certified game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, Spribe, and Ezugi to deliver casino games and live dealer experiences on the platform. These providers may receive technical session data (such as player session tokens) that is necessary to deliver their games. They do not receive your full identity or financial data.
4.2 Payment Processors
To process deposits and withdrawals, cd678 shares the minimum necessary financial and identity data with payment partners including bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing networks. These partners process your payment data under their own privacy policies and applicable financial regulation.
4.3 Identity Verification Services
For KYC compliance, cd678 may use third-party identity verification services to cross-reference the documents you submit against authoritative databases. These services are provided under strict data processing agreements and do not retain copies of your documents beyond the verification transaction.
4.4 Legal and Regulatory Authorities
cd678 may be required to disclose player data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts of competent jurisdiction where required by applicable law or a valid legal order. In such cases, we will disclose only the minimum data required to comply with the obligation and will notify the affected player where permitted by law to do so.
4.5 International Data Transfers
Some of our third-party service providers operate infrastructure outside Bangladesh. Where personal data is transferred internationally, cd678 ensures that appropriate safeguards are in place — including standard contractual clauses or equivalent protections — to maintain data protection standards consistent with those applied within Bangladesh.
5. Cookies & Tracking
cd678 uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to collect anonymised analytics data. This section explains the types of cookies we use and how you can manage them.
5.1 Types of Cookies Used
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, login authentication, CSRF protection, load balancing | Session / up to 24 hours |
| Functional | Language and display preferences, responsible gambling settings, game lobby filters | Up to 12 months |
| Analytics | Anonymised page view counts, session durations, feature usage — used to improve platform UX | Up to 13 months |
| Security | Fraud detection signals, device fingerprint hashes for anomaly detection | Up to 6 months |
5.2 Managing Cookies
Strictly necessary cookies cannot be disabled as they are essential to the operation of the cd678 platform. All other cookie categories may be managed through your browser settings. Most modern browsers allow you to block, delete, or restrict cookies via the settings menu. Please note that disabling functional cookies may affect your experience — for example, your session preferences may not be saved between visits.
cd678 does not use third-party advertising cookies or retargeting pixels. We do not participate in cross-site tracking networks and do not share cookie data with advertising platforms.
6. Data Retention
cd678 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods applicable to each category of data are set out below.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and Identity Data | Duration of account + 5 years after closure | AML compliance and dispute resolution |
| Financial Transaction Records | 7 years from transaction date | Financial regulation and audit requirements |
| KYC Verification Documents | 5 years after account closure | AML obligations and regulatory audit |
| Support Communications | 3 years from last interaction | Complaint handling and quality assurance |
| Session and Usage Logs | 13 months from collection | Platform analytics and fraud detection |
| Marketing Consent Records | Duration of consent + 3 years | Proof of consent and regulatory compliance |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual. Where data is anonymised rather than deleted, the resulting anonymised data sets may be retained indefinitely for statistical and analytical purposes.
Players who request account closure should be aware that certain data categories will be retained for the periods stated above even after the account is closed, as required by our legal and regulatory obligations. This retention does not affect your right to request erasure of data that is not subject to a mandatory retention obligation.
7. Your Privacy Rights
cd678 respects and upholds your rights in relation to the personal data we hold about you. You may exercise any of the following rights by submitting a written request to [email protected]. We will acknowledge your request within two business days (Bangladesh Standard Time, UTC+6) and aim to fulfil it within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 30 days and will notify you accordingly.
7.1 Right of Access
You have the right to request a copy of the personal data cd678 holds about you, along with information about how it is used, where it came from, and with whom it has been shared. This is commonly referred to as a Subject Access Request (SAR). We will provide a copy of your data in a structured, commonly used format at no charge.
7.2 Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For data such as your registered address or phone number, you can update this directly in your account settings. For identity data that forms part of a KYC record, corrections must be supported by updated documentation.
7.3 Right to Erasure
You may request that cd678 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (for consent-based processing), or where the data has been unlawfully processed. This right is subject to our obligations to retain certain data under applicable law — data categories subject to mandatory retention periods cannot be erased until those periods have elapsed.
7.4 Right to Restrict Processing
You have the right to request that cd678 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or where you have objected to processing based on legitimate interests and the objection is under review.
7.5 Right to Data Portability
Where processing is carried out on the basis of your consent or on the basis of contractual necessity, and where processing is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format. You may also request that we transmit this data directly to another controller where technically feasible.
7.6 Right to Object
You have the right to object to processing carried out on the basis of cd678's legitimate interests. If you raise such an objection, cd678 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
7.7 Rights Related to Marketing
You have an unconditional right to object to processing of your personal data for direct marketing purposes at any time. Upon receiving such an objection, cd678 will remove you from all marketing lists promptly and without penalty. This right is distinct from the general right to object and requires no justification.
8. Contact & Data Queries
If you have any questions, concerns, or complaints about how cd678 collects, uses, or protects your personal data, we encourage you to contact us directly in the first instance. Our team is committed to resolving all privacy-related queries promptly and transparently.
8.1 How to Contact Us
All privacy-related correspondence should be directed to our support team at [email protected] with the subject line "Privacy Query" or "Data Protection". We aim to acknowledge all queries within two business days (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.
Please include your registered email address and a brief description of your query or concern to enable us to locate your account record and respond accurately. For subject access requests or erasure requests, we will ask you to verify your identity before any data is disclosed or deleted.
8.2 Changes to This Privacy Policy
cd678 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. Where material changes are made, we will notify registered players via the email address associated with their account at least 14 days before the changes take effect. The updated policy will also be published on this page with a revised effective date. Your continued use of the cd678 platform following the effective date of any revised policy constitutes your acceptance of the updated terms.
8.3 Links to Other Policies
This Privacy Policy should be read alongside the following related documents, all of which are published on the cd678 platform:
- Terms & Conditions — governing the overall player-platform relationship
- Responsible Gaming Policy — detailing player protection tools and self-exclusion procedures
- FAQ — answering common questions about accounts, payments, and platform rules
Your Privacy Is Protected at cd678
Still have questions about how we handle your data? Our support team is available around the clock. You can also explore the FAQ for quick answers or visit the cd678 Casino to start playing securely today.
18+ only. Please gamble responsibly. This Privacy Policy was last updated on 1 January 2026.