ck49 Privacy Policy — How We Protect Your Personal Data

This Privacy Policy governs the collection, processing, storage, and disclosure of personal data by ck49 (hereinafter "ck49", "we", "us", or "our") in connection with the operation of the online casino and sports betting platform available at ck49.io. It applies to all visitors to the ck49 website, all registered Account holders, and all individuals who interact with ck49 customer support or marketing communications.

ck49 is committed to handling all personal data responsibly, transparently, and in accordance with internationally recognised data protection principles, including the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

By accessing the ck49 Platform, registering an Account, or using any ck49 service, you acknowledge that you have read, understood, and consented to the data practices described in this Privacy Policy. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

This Privacy Policy should be read in conjunction with the ck49 Terms & Conditions, which are incorporated herein by reference. Capitalised terms not defined in this Policy carry the meanings assigned to them in the Terms & Conditions.

For the purposes of this Privacy Policy, ck49 acts as the data controller in respect of all personal data collected from users of the ck49 Platform. As data controller, ck49 determines the purposes and means by which personal data is processed.

All data protection enquiries, subject access requests, and formal complaints should be directed to ck49 using the contact details provided in Section 17 of this Policy. ck49 will respond to all data-related requests within the timeframes specified in Section 12.

ck49 collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity Data

Full legal name, date of birth, nationality, and copies of government-issued identification documents (National Identity Card, passport, or driving licence) provided during the KYC verification process.

3.2 Contact Data

Residential address (including city — for example Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, or Rangpur), mobile telephone number, and email address.

3.3 Financial Data

Mobile banking account details (bKash, Nagad, Rocket, Upay), bank account information (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank), transaction history, deposit amounts, withdrawal amounts, and source-of-funds documentation where required.

3.4 Account & Gaming Data

Username, account registration date, login timestamps, session duration records, game history (including game titles played, bet amounts, wins, and losses), sportsbook betting history, bonus claims, and wagering records.

3.5 Technical Data

IP address, device type and operating system, browser type and version, screen resolution, referring URL, pages visited, session duration, and geolocation data (country and city level only, derived from IP address).

3.6 Communications Data

Records of all written communications between you and ck49 customer support, including live chat transcripts, email correspondence, and any attachments submitted.

3.7 Responsible Gaming Data

Records of any deposit limits, session limits, cooling-off periods, or self-exclusion requests you have submitted, including the dates and durations of any such restrictions.

ck49 collects personal data through the following methods:

• Direct submission: Data you actively provide during account registration, KYC verification, payment setup, form submissions, or support communications.
• Automated collection: Technical and behavioural data collected automatically as you use the Platform, via server logs, cookies, pixel tags, and similar technologies (see Section 7).
• Third-party sources: Data received from payment providers (bKash, Nagad, Rocket, Upay, and banking partners) in connection with transaction processing, and from identity verification service providers used to conduct KYC checks.
• Fraud and AML screening: Data received from fraud detection, anti-money laundering, and sanctions screening services that ck49 uses to fulfil its compliance obligations.

ck49 processes your personal data on the following legal bases:

• Contractual necessity: Processing that is necessary to perform the contract between you and ck49, including operating your Account, processing deposits and withdrawals, and providing access to games and betting markets.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC/AML obligations, age verification, fraud prevention, and record-keeping mandates.
• Legitimate interests: Processing carried out in furtherance of ck49's legitimate business interests, including platform security, fraud detection, responsible gaming monitoring, product improvement, and internal analytics — where such interests are not overridden by your data protection rights.
• Consent: Processing based on your explicit, freely given, and informed consent — principally for the sending of direct marketing communications. Consent may be withdrawn at any time (see Section 13).

ck49 uses the personal data it holds for the following purposes:

• To create, manage, and maintain your ck49 Account, including verifying your identity and age in compliance with KYC requirements.
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer partners.
• To provide access to casino games, live dealer tables, and sportsbook betting markets, including cricket (BPL, IPL, T20 World Cup, Bangladesh Tigers) and football.
• To detect, investigate, and prevent fraud, money laundering, match-fixing, and other prohibited conduct as defined in the ck49 Terms & Conditions.
• To enforce the ck49 responsible gaming programme, including monitoring for patterns consistent with problem gambling and administering deposit limits, cooling-off periods, and self-exclusion requests.
• To communicate with you regarding your Account, transactions, security alerts, and any changes to our Terms & Conditions or this Privacy Policy.
• To send you promotional offers, bonus notifications, and marketing communications where you have consented to receive them.
• To improve the ck49 Platform, including by conducting internal analytics on game performance, platform usage patterns, and user experience research.
• To fulfil any legal or regulatory reporting obligations applicable to ck49's operations.

ck49 uses cookies and similar technologies on the Platform to support core functionality, improve the user experience, and analyse Platform usage. A cookie is a small text file stored on your device by your web browser at the instruction of the ck49 Platform.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They include session management cookies that keep you logged in, security tokens, and cookies that store your responsible gaming settings. These cookies cannot be disabled without rendering the Platform inoperable.
• Functional Cookies: These cookies remember your preferences (such as your preferred language, display settings, and last used payment method) to provide a more personalised experience on return visits.
• Analytics Cookies: These cookies help ck49 understand how users interact with the Platform — which pages are most visited, where users drop off, and which games are most popular. This data is aggregated and does not identify individual users.
• Marketing Cookies: These cookies are used, with your consent, to deliver relevant promotional content and to measure the effectiveness of ck49 marketing campaigns.

7.2 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional or analytics cookies may affect the usability of certain Platform features. Strictly necessary cookies cannot be disabled through browser settings as they are technically required for the Platform to operate.

ck49 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank, to the extent necessary to process your financial transactions.
• Game and Technology Providers: Certified game studios and software providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) receive limited technical data to facilitate seamless game delivery, game history reconciliation, and RTP auditing.
• Identity Verification and KYC Providers: Specialist third-party services engaged to verify the authenticity of identity documents and to conduct age verification checks.
• Fraud Prevention and AML Services: Third-party providers used to screen transactions and player activity for indicators of fraud, money laundering, or sanctions exposure.
• Legal and Regulatory Authorities: Where required by applicable law, court order, or legitimate regulatory request, ck49 may disclose personal data to relevant law enforcement or regulatory bodies without prior notice to the affected Account holder.
• Professional Advisers: Lawyers, auditors, and accountants engaged by ck49, subject to professional confidentiality obligations.

All third-party data processors engaged by ck49 are subject to written data processing agreements that require them to process personal data only in accordance with ck49's instructions and to implement appropriate technical and organisational security measures.

Due to the global nature of the online gaming industry, some of ck49's third-party service providers — including game studios, cloud infrastructure providers, and KYC processors — may process personal data in countries outside Bangladesh. Where such international transfers occur, ck49 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to, or exceeding, that which applies within Bangladesh.

These safeguards may include contractual data protection clauses, data processing agreements incorporating internationally recognised transfer mechanisms, or reliance on the recipient country's adequacy status. If you require further information regarding the specific safeguards applicable to any international transfer of your personal data, please contact ck49 using the details in Section 17.

ck49 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with any individual. Where data is anonymised rather than deleted, it may be retained for analytical purposes without limitation.

ck49 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the ck49 Platform is encrypted using industry-standard TLS 1.3 protocols, ensuring that data in transit cannot be intercepted or read by third parties.
• Password Hashing: All account passwords are stored using a modern, salted, one-way cryptographic hashing algorithm. Plain-text passwords are never stored or accessible to any ck49 employee or system.
• Two-Factor Authentication (2FA): ck49 offers — and strongly recommends — 2FA via OTP for all registered accounts, providing an additional security layer against unauthorised access.
• Access Controls: Access to personal data within ck49's internal systems is restricted to employees and contractors who require it to perform their specific job functions. All internal access is logged and periodically audited.
• Firewall and Intrusion Detection: ck49's servers are protected by enterprise-grade firewalls and real-time intrusion detection systems. Suspicious activity triggers automated alerts and manual investigation protocols.
• Data Breach Response: In the event of a confirmed personal data breach that poses a risk to the rights and freedoms of affected individuals, ck49 will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach.

Subject to applicable law and certain legal exceptions, you have the following rights in relation to the personal data ck49 holds about you:

• Right of Access: You may request a copy of all personal data ck49 holds about you (commonly known as a Subject Access Request or SAR). ck49 will respond to verified SAR requests within 30 days of receipt.
• Right to Rectification: You may request the correction of any inaccurate or incomplete personal data held on your ck49 Account. If your details have changed, you may also update certain information directly through the Account management area or by contacting support.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other lawful basis applies), or where the data has been processed unlawfully. Note that this right is subject to ck49's legal retention obligations — data required to be kept for AML, KYC, or financial record-keeping purposes cannot be deleted before the applicable retention period has elapsed.
• Right to Restriction of Processing: You may request that ck49 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction to erasure.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data where that processing is based on ck49's legitimate interests. ck49 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request". ck49 may require you to verify your identity before processing any data rights request.

ck49 may send you promotional communications by email or SMS — including bonus offers, game launch announcements, and seasonal promotions such as Eid offers, Pohela Boishakh specials, BPL cricket season promotions, and other Bangladesh-market events — provided you have given your express consent to receive such communications at the time of registration or subsequently through your Account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link included in every marketing email sent by ck49; or
• Updating your communication preferences in your ck49 Account settings; or
• Contacting ck49 customer support at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent does not affect your right to continue using the ck49 Platform, nor does it prevent ck49 from sending you transactional or service communications that are strictly necessary for the operation of your Account (such as deposit confirmations, withdrawal notifications, and security alerts).

The ck49 Platform is strictly for adults aged 21 and above. ck49 does not knowingly collect personal data from any person under the age of 21. If ck49 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data and permanently close the associated Account.

If you are a parent or guardian and believe that a minor under your care has registered on the ck49 Platform, please contact ck49 immediately at [email protected] with the subject line "Minor Account Report". ck49 will prioritise the investigation and closure of any such account.

The ck49 Platform may, from time to time, contain references to third-party services such as payment providers or game studios. ck49 has no control over, and assumes no responsibility for, the privacy practices, data collection, or content of any third-party websites or services. This Privacy Policy applies solely to data processed by ck49 in connection with the ck49 Platform. Users are advised to review the privacy policies of any third-party services they interact with independently of ck49.

ck49 reserves the right to update or amend this Privacy Policy at any time. Where a material change is made, ck49 will provide reasonable notice by posting the updated Policy on the Platform and, where practicable, notifying registered Account holders via the contact details held on their Account.

The effective date at the top of this document will be updated to reflect the date of the most recent revision. Your continued use of the ck49 Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. The most current version of this Policy will always be available at ck49.io/privacy-policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which ck49 handles your personal data, please contact us using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Privacy Requests: "Privacy Request" or "Data Rights Request"
• Subject Line for Formal Complaints: "Formal Privacy Complaint"
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Response Time: ck49 aims to acknowledge all privacy requests within 48 hours and provide a substantive response within 30 days of receipt.