333cd Privacy Policy — How We Collect, Use, and Protect Your Data

This Privacy Policy ("Policy") applies to all users of the 333cd online betting and casino platform, accessible at 333cd.io and any associated subdomains or mobile-optimised versions of the site. It describes how 333cd ("we", "us", "our") collects, uses, stores, shares, and protects the personal data you provide when you register, deposit, bet, play casino games, or otherwise interact with our service.

This Policy forms part of the 333cd Terms & Conditions and should be read alongside them. By creating a 333cd account and using the platform, you confirm that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein.

333cd is committed to responsible data stewardship. This Policy is written to meet the standards expected under internationally recognised data protection frameworks, including principles analogous to those set out in the EU General Data Protection Regulation (GDPR), which 333cd voluntarily applies as a benchmark of good practice for all users regardless of their location.

333cd collects the following categories of personal data from players. Each category is collected only to the extent necessary for the purposes described in this Policy:

333cd does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is strictly necessary for age and identity verification via government-issued documents.

333cd collects personal data through the following channels:

• Direct collection: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, completing responsible gaming forms, or contacting support at [email protected].
• Automated collection: Technical and activity data collected automatically as you browse and use the platform, including through cookies, server logs, and analytics tools. For full details see Section 07 (Cookies & Tracking).
• Third-party sources: Identity verification and fraud-screening data received from KYC service providers and payment processing partners when you initiate a withdrawal or when our fraud-prevention systems flag an account for review.
• Public records: In limited circumstances, 333cd may cross-reference publicly available records (such as sanctions lists or politically exposed persons databases) as part of our anti-money-laundering compliance obligations.

333cd processes your personal data for the following specific purposes:

• Account management: To create, maintain, and administer your 333cd player account, including processing login sessions, managing account preferences, and handling account closure or suspension requests.
• Identity and age verification: To verify that you are at least 21 years of age and that your identity matches the details provided at registration, as required by our responsible gaming and anti-fraud obligations.
• Payment processing: To process deposits received via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and to process withdrawal requests to your verified payment method. Financial data is shared with our payment processing partners solely for this purpose.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account abuse, bonus fraud, match-fixing involvement, and any other prohibited conduct as defined in the 333cd Terms & Conditions.
• Responsible gaming compliance: To monitor player activity for signs of problem gambling behaviour, enforce deposit limits, loss limits, session limits, and self-exclusion requests, and to ensure that players who have self-excluded cannot access the platform.
• Legal and regulatory compliance: To meet applicable anti-money-laundering (AML) obligations, retain transaction records as required by law, respond to lawful requests from competent authorities, and fulfil our obligations under our international operating licence.
• Customer support: To respond to your support requests, resolve disputes, process complaints, and communicate essential account-related notices such as security alerts, KYC requests, and withdrawal confirmations.
• Platform improvement: To analyse aggregated, anonymised usage data to understand how players interact with the 333cd platform and to improve site functionality, game selection, and user experience. Individual-level data is not used for this purpose without further anonymisation.
• Marketing communications: To send promotional offers, bonus notifications, and event announcements to players who have opted in to marketing communications. See Section 13 for full details on marketing and how to opt out.

333cd processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Contract performance: Processing that is necessary to fulfil the contract between you and 333cd — specifically, operating your player account, processing deposits and withdrawals, and delivering betting and casino game services.
• Legal obligation: Processing that is necessary to comply with applicable legal requirements, including AML record-keeping obligations, responses to lawful authority requests, and responsible gaming regulatory requirements under our operating licence.
• Legitimate interests: Processing carried out for 333cd's legitimate interests in fraud detection, platform security, responsible gaming monitoring, and platform improvement, where those interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications, which is carried out only where you have given explicit, freely-given, and informed consent. You may withdraw consent at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

333cd does not sell, rent, or trade your personal data to unaffiliated third parties for commercial purposes. Your data may be shared with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card processing partners receive the minimum financial data necessary to process your deposit or withdrawal transaction. These providers operate under their own published privacy policies and are subject to their own regulatory obligations.
• Identity verification providers: Third-party KYC and document verification services that assist 333cd in verifying the identity and age of players before withdrawals are processed. These providers receive identity documents and personal details strictly for verification purposes and are contractually prohibited from using them for any other purpose.
• Fraud and AML screening services: Third-party fraud detection and anti-money-laundering screening platforms that analyse transaction patterns and cross-reference player details against sanctions and watchlists as required by our compliance obligations.
• IT infrastructure and hosting providers: Cloud hosting, data storage, and content delivery providers that process data on 333cd's behalf under strict data processing agreements as sub-processors.
• Legal and regulatory authorities: Where required by law, court order, or the lawful request of a competent regulatory or law enforcement authority, 333cd may disclose personal data without prior notice to you. 333cd will only comply with such requests where they are legally valid and will limit disclosure to the minimum data required.

All third-party data processors engaged by 333cd are contractually required to process personal data only for the purposes specified by 333cd, to maintain appropriate security measures, and to delete or return data upon termination of the engagement.

333cd uses cookies and related tracking technologies on the 333cd website to provide a functional, personalised, and secure user experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the 333cd website and platform. These include session authentication cookies that keep you logged in, security tokens that prevent cross-site request forgery, and load-balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred deposit method, and responsible gaming limit configurations so that you do not need to re-enter them on each visit.
• Analytics cookies: Used to collect aggregated data about how visitors interact with the 333cd website, including page visit counts, session durations, navigation paths, and error occurrences. This data is used solely for platform improvement and is anonymised before analysis. 333cd uses self-hosted analytics tools and does not share raw analytics data with third-party advertising networks.
• Security and fraud-detection cookies: Used to detect suspicious login behaviour, flag unusual navigation patterns, and identify potential bot activity or account takeover attempts.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent you from logging in or using certain platform features. 333cd does not use third-party advertising cookies or cross-site behavioural tracking cookies.

333cd retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your registered account and for a period of five years following account closure, to meet AML record-keeping obligations and to handle any post-closure disputes or regulatory enquiries.
• KYC documents: Retained for a minimum of five years from the date of submission, as required by international AML compliance standards applicable to our operating licence.
• Transaction and betting records: Retained for five years from the date of each transaction, consistent with standard financial record-keeping requirements.
• Support communications: Retained for two years from the date of closure of each support ticket or complaint, to maintain an auditable record of dispute resolution.
• Technical and analytics data: Anonymised after 13 months and retained in anonymised form for up to three years for platform trend analysis. Raw IP address logs are deleted after 90 days.
• Marketing consent records: Retained for the duration of your marketing opt-in and for one year following any opt-out, as evidence of the consent status at any given time.

Upon expiry of the applicable retention period, personal data is securely deleted using methods that render recovery impossible, or irreversibly anonymised. Where deletion is not immediately technically feasible, data is quarantined and access-restricted pending scheduled deletion.

333cd operates as an internationally licensed offshore platform. Personal data collected from players in Bangladesh and other jurisdictions may be stored on and processed by servers located outside Bangladesh. 333cd takes all reasonable steps to ensure that international transfers of personal data are conducted with appropriate safeguards in place, including:

• Entering into data processing agreements with all sub-processors that incorporate internationally recognised standard contractual clauses or equivalent data transfer protections.
• Selecting hosting and infrastructure providers that operate under internationally recognised security certifications, including ISO 27001 or equivalent standards.
• Restricting access to personally identifiable data to authorised personnel only, on a strict need-to-know basis, regardless of where those personnel are located.

By registering with 333cd, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh, and you consent to such transfers taking place subject to the safeguards described in this section.

333cd implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• SSL/TLS encryption: All data transmitted between your browser or device and the 333cd platform is encrypted using current industry-standard SSL/TLS protocols. The 333cd website operates exclusively over HTTPS.
• Encryption at rest: Sensitive personal data — including KYC documents, payment details, and password hashes — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data is restricted to 333cd personnel and authorised sub-processors who require it to perform their specific role. Access is governed by role-based permissions, and all access events are logged.
• Password security: Player passwords are stored as salted cryptographic hashes. 333cd never stores plaintext passwords and will never ask you to provide your password via email or any communication channel.
• Incident response: 333cd maintains a documented data breach incident response procedure. In the event of a breach affecting personal data, affected players will be notified within a reasonable timeframe consistent with applicable regulatory requirements.
• Regular security reviews: 333cd conducts periodic internal and third-party security reviews of its platform infrastructure and data-handling processes to identify and remediate vulnerabilities.

While 333cd takes all reasonable precautions to protect your personal data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your account login credentials and for notifying 333cd immediately if you suspect any unauthorised access to your account.

333cd respects your right to control your personal data. Subject to applicable law and legitimate exceptions (such as legal retention obligations), you have the following rights in respect of the personal data 333cd holds about you:

• Right of access: You may request a copy of the personal data 333cd holds about you, together with information about how it is being used. This is commonly referred to as a Subject Access Request (SAR).
• Right to rectification: You may request that 333cd correct any inaccurate or incomplete personal data it holds about you. For account details such as email address or phone number, you may also update these directly within your account settings.
• Right to erasure: You may request that 333cd delete your personal data ("right to be forgotten") where there is no longer a legitimate legal or contractual basis for retaining it. Note that 333cd may be required to retain certain data (such as AML records) regardless of a deletion request, in which case 333cd will explain the applicable obligation.
• Right to restriction: You may request that 333cd restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of the data is being resolved.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to 333cd, for the purpose of transferring it to another service.
• Right to object: You may object to 333cd processing your personal data on the basis of legitimate interests, or processing for direct marketing purposes. Marketing opt-outs take effect immediately.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time by contacting [email protected] or using the unsubscribe option in any marketing email.

To exercise any of the above rights, contact 333cd at [email protected] with the subject line "Data Rights Request" and a clear description of the right you wish to exercise. 333cd will acknowledge your request within five business days and respond in full within 30 calendar days. Identity verification may be required before 333cd processes certain types of request.

The 333cd platform is strictly for adults aged 21 years and above. 333cd does not knowingly collect, process, or retain personal data from any individual under the age of 21. Age verification is a mandatory step in the KYC process, and 333cd implements technical and procedural controls to prevent underage registration.

If 333cd discovers or has reasonable grounds to believe that a registered account belongs to an individual under the age of 21, the account will be immediately suspended, all balances frozen pending investigation, and the personal data associated with the account will be deleted or returned as appropriate following the conclusion of the investigation.

If you believe that a minor has registered on the 333cd platform, please notify 333cd immediately at [email protected]. 333cd takes underage gambling prevention extremely seriously and will act on any credible report without delay.

333cd may send marketing communications — including promotional bonus offers, seasonal campaigns such as Eid and Pohela Boishakh specials, BPL and IPL match-day promotions, and new game launch notifications — to players who have explicitly opted in to receiving such communications at the time of registration or subsequently via their account settings.

Marketing communications from 333cd are sent exclusively by email to the address registered on your account. 333cd does not send unsolicited SMS marketing messages and does not use third-party advertising networks or social media retargeting to deliver promotional content based on your 333cd activity.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included at the bottom of every marketing email sent by 333cd; or
• Emailing [email protected] with the subject line "Unsubscribe" from your registered email address.

Opting out of marketing communications does not affect your ability to receive essential transactional communications from 333cd, such as deposit confirmations, withdrawal notifications, KYC requests, account security alerts, and support responses. These communications are sent regardless of your marketing preference because they are necessary for the operation of your account.

The 333cd platform may contain references to third-party services such as game providers (Evolution Gaming, Ezugi, Pragmatic Play, Spribe, Microgaming, NetEnt) and payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard). While these services are integrated into the 333cd platform experience, they operate as independent entities under their own privacy policies and data-handling practices.

333cd is not responsible for the privacy practices of third-party game providers or payment processors. When you use a third-party payment service to deposit or withdraw funds, that service's own privacy policy governs how it handles the data you provide directly to it. 333cd recommends that you review the privacy policies of any third-party services you interact with through the 333cd platform.

333cd does not link to external websites for commercial or advertising purposes. Any link from the 333cd platform to a third-party site (if applicable) is provided solely for informational convenience and does not constitute an endorsement of that site's privacy practices or content.

333cd reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our platform's services. The current version of this Policy will always be accessible at 333cd.io/privacy-policy and will display the effective date at which the current version came into force.

Where changes are material — such as a change in the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — 333cd will notify registered players by email at least 14 days before the changes take effect. Minor updates such as clarifications of existing practices or corrections of typographical errors may be made without advance notice.

Your continued use of the 333cd platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the platform and contact [email protected] to request account closure and data deletion.

For all enquiries, requests, or concerns relating to this Privacy Policy or the handling of your personal data by 333cd, please contact the 333cd Data & Privacy team via the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: "Data Rights Request"
• Subject line for privacy concerns: "Privacy Concern"
• Response time: Acknowledgement within 5 business days; full response within 30 calendar days
• Support availability: 24 hours a day, 7 days a week, 365 days a year

333cd will never ask you to provide your account password, full payment card number, or any sensitive authentication credential via email or any other communication channel. All official communications from 333cd originate exclusively from the @333cd.io email domain. If you receive a communication purporting to be from 333cd from any other domain, treat it as fraudulent and report it to [email protected] immediately.