Privacy Policy — How cbb22 Collects, Uses, and Protects Your Personal Data

cbb22 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all users who access and interact with the cbb22 platform at https://cbb22.io. This Privacy Policy ("Policy") sets out, in clear and formal English, the basis on which any personal data we collect from you, or that you provide to us, will be processed by cbb22.

This Policy applies to all users of the cbb22 platform, regardless of whether you have registered a player account, are browsing as a guest, or are accessing the platform from Bangladesh or any other jurisdiction. By accessing or using the cbb22 platform, you acknowledge that you have read, understood, and agree to the collection and use of your personal data as described in this Policy.

This Privacy Policy should be read together with the cbb22 Terms & Conditions, which govern your overall use of the platform. Defined terms used in this Policy have the same meaning as in the Terms & Conditions unless otherwise stated here.

This Policy is effective as of January 2026 and supersedes all previous privacy notices published by cbb22. The "Last Updated" date at the top of this document reflects the most recent revision.

For the purposes of this Privacy Policy, the data controller responsible for your personal data is cbb22, the operator of the online sports betting and casino platform accessible at https://cbb22.io. cbb22 operates as an offshore platform and processes personal data in connection with the provision of its gambling and entertainment services.

As data controller, cbb22 determines the purposes and means by which your personal data is processed. Where cbb22 engages third-party service providers to process data on its behalf — such as payment processors, KYC verification providers, and game studios — those parties act as data processors under written agreements that bind them to cbb22's data protection standards.

If you have any questions about how cbb22 processes your personal data, or if you wish to exercise any of the rights described in Section 10 of this Policy, you may contact the cbb22 data team at the following address: [email protected]

cbb22 collects the following categories of personal data in connection with the operation of its platform and the delivery of its services to players based primarily in Bangladesh:

cbb22 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you actively provide when you create an account, complete your player profile, submit KYC documents, make deposits or withdrawals, contact our support team, or respond to surveys or promotional campaigns.
• Automated Technical Collection: Data collected automatically as you interact with the cbb22 platform, including your IP address, device identifiers, browser information, and session behaviour, via server logs, cookies, and similar tracking technologies. See Section 7 for full cookie details.
• Payment Processors: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, or BRAC Bank, the relevant payment provider transmits transaction confirmation data to cbb22 to enable the crediting or debiting of your account balance.
• KYC Verification Providers: cbb22 uses certified third-party identity verification services to cross-reference the documents you submit during KYC. These providers may return verification status, risk scores, and document authenticity data to cbb22.
• Game Studios: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may transmit game session result data and relevant player interaction logs to cbb22 for the purpose of settling bets and resolving disputes.
• Publicly Available Sources: In limited circumstances related to fraud prevention or compliance obligations, cbb22 may cross-reference publicly available information (such as sanction lists or politically exposed person databases) against the data you have provided.

cbb22 processes your personal data only where it has a valid legal basis for doing so. The following table sets out the primary purposes for which we process personal data, together with the corresponding legal basis:

Where cbb22 relies on legitimate interests as the basis for processing, we have assessed that our legitimate interests are not overridden by your interests, rights, or freedoms, taking into account the context and the safeguards we have in place.

Where we rely on your consent (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your preferences in your account settings or contact [email protected].

cbb22 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank receive the minimum transaction data necessary to process deposits and withdrawals on your behalf. Each provider is subject to its own privacy and data security standards.
• KYC & Identity Verification Providers: Certified third-party verification services receive copies of your identity documents and personal details solely for the purpose of completing the verification process required under our compliance obligations.
• Game Studios & Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive a pseudonymised player identifier and game session data necessary to operate their games within the cbb22 platform. Full identity data is not shared with game studios.
• IT Infrastructure & Security Providers: Cloud hosting providers, content delivery networks, and cybersecurity services that underpin the operation of the cbb22 platform may process technical data as part of their service delivery. These providers operate under data processing agreements.
• Legal & Regulatory Authorities: cbb22 may be required to disclose personal data to law enforcement agencies, courts, regulators, or other public authorities in response to a valid legal obligation, court order, or official request. cbb22 will seek to notify affected users of such disclosures where legally permissible.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by cbb22 may have access to personal data on a strictly confidential basis where necessary for the delivery of professional services.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets involving cbb22, personal data held on platform users may be transferred to the successor entity. Users will be notified of any such transfer and any change in the applicable privacy policy in advance, where practicable.

The cbb22 platform uses cookies and similar tracking technologies to operate core platform functions, maintain your session, improve your experience, and gather anonymised analytics data. The following categories of cookies are in use on the platform:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They maintain your authenticated session, remember your login state, and enable secure navigation between pages. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional Cookies: These cookies remember your preferences — such as language settings, display preferences, and responsible gaming configurations — so you do not need to re-enter them on each visit. They do not track you across other websites.
• Analytics Cookies: cbb22 uses anonymised analytics data to understand how users interact with the platform, which pages are most visited, where users encounter difficulties, and how to improve the overall experience. This data is aggregated and does not identify individual users.
• Security Cookies: These cookies support cbb22's fraud detection and security monitoring systems. They help identify unusual login patterns, detect bot activity, and protect your account from unauthorised access.

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies via the settings or preferences menu. Please note that blocking strictly necessary cookies will impair your ability to log in and use the cbb22 platform.

cbb22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention guidelines apply:

• Active Account Data: Personal data associated with an active player account is retained for the lifetime of the account and for a minimum of five (5) years following the closure of the account, to satisfy AML, KYC, and audit record-keeping requirements.
• Transaction Records: Deposit, withdrawal, and betting transaction records are retained for a minimum of seven (7) years following the date of the transaction, consistent with standard financial record-keeping obligations.
• KYC Verification Documents: Identity documents submitted during the KYC process are retained for the period required by the applicable compliance framework and are deleted securely once that retention period has expired.
• Support Communications: Emails, live chat transcripts, and formal complaint records are retained for three (3) years from the date of the last communication, to enable dispute resolution and quality assurance review.
• Technical and Usage Data: Server logs and session data are typically retained for ninety (90) days for security monitoring purposes, after which they are deleted or anonymised.
• Self-Exclusion Records: Records of player-initiated self-exclusions are retained for the full duration of the exclusion period plus five (5) years, to prevent re-registration during the exclusion period and to maintain an auditable compliance record.
• Marketing Preferences: Records of your consent to or withdrawal from marketing communications are retained indefinitely, so that cbb22 can demonstrate compliance with your stated preferences at any point.

Upon expiry of the applicable retention period, personal data is either securely deleted from cbb22 systems or anonymised in a manner that makes re-identification impossible, whichever is more appropriate given the nature of the data and the systems involved.

cbb22 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls include:

• SSL/TLS Encryption: All data transmitted between your device and the cbb22 platform is encrypted using industry-standard SSL/TLS protocols. You can verify the security of your connection by checking for the padlock indicator in your browser's address bar.
• At-Rest Encryption: Personal data stored in cbb22's databases is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to personal data within cbb22 is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific role, and all access events are logged and periodically audited.
• Two-Factor Authentication: cbb22's internal systems support two-factor authentication for all staff who have access to personal data, reducing the risk of credential-based breaches.
• Security Monitoring: cbb22 operates continuous security monitoring and intrusion detection systems to identify and respond to threats in real time.
• Penetration Testing: The cbb22 platform undergoes periodic third-party penetration testing to identify and remediate security vulnerabilities before they can be exploited.
• Incident Response: cbb22 maintains a documented data breach response procedure. In the event of a security incident that results in unauthorised access to personal data, affected users will be notified without undue delay where required by applicable law.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data that cbb22 holds about you. To exercise any of these rights, contact the cbb22 data team at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data that cbb22 holds about you. cbb22 will respond to verified access requests within thirty (30) days of receipt.
• Right to Rectification: If any personal data that cbb22 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. Many standard data corrections can be made directly through your account settings.
• Right to Erasure: You may request that cbb22 delete your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected. Note that this right may be limited where cbb22 is required to retain the data to comply with a legal obligation (e.g., AML record-keeping requirements).
• Right to Restriction: You have the right to request that cbb22 restrict the processing of your personal data in certain circumstances, such as while the accuracy of the data is being contested or while a complaint is being investigated.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request that cbb22 provide your personal data in a structured, machine-readable format suitable for transfer to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where cbb22 relies on legitimate interests as the legal basis. You also have an absolute right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

cbb22 will respond to all valid data rights requests within thirty (30) days. In complex cases, the response period may be extended by up to an additional sixty (60) days, in which case you will be informed of the extension and the reason for it within the initial thirty-day period.

Please note that exercising certain rights — particularly the right to erasure — may result in the closure of your cbb22 account if the data in question is required for the operation of your account or for compliance purposes.

The cbb22 platform is strictly intended for adults aged 21 and above. cbb22 does not knowingly collect, process, or retain personal data relating to any person under the age of 21. The platform employs age verification procedures as part of the registration and KYC process to prevent underage access.

If cbb22 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted immediately, the associated account will be closed, and any funds held in the account will be returned after identity verification confirms the account holder's identity and age.

cbb22 operates as an offshore platform and its data processing infrastructure may involve the transfer of personal data to servers or service providers located outside of Bangladesh. Where such transfers occur, cbb22 ensures that appropriate safeguards are in place to protect your personal data to a standard consistent with the principles set out in this Privacy Policy.

Safeguards used by cbb22 for international data transfers include:

• Contractual data processing agreements with all third-party processors that include obligations equivalent to those described in this Policy.
• Transfer only to service providers who maintain recognised information security certifications (such as ISO 27001) or who operate under equivalent data protection frameworks.
• Pseudonymisation or anonymisation of data prior to transfer where feasible and appropriate, to reduce the risk associated with the transfer.

By using the cbb22 platform and providing your personal data, you acknowledge that your data may be transferred to and processed in jurisdictions outside Bangladesh in accordance with the safeguards described above.

The cbb22 platform may contain references to or integrations with third-party services, including game studios (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe) and payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank). When you interact with these third-party services — for example, by initiating a payment via bKash or launching a game provided by Pragmatic Play — you may be subject to the privacy policies of those third parties in addition to this Policy.

cbb22 is not responsible for the privacy practices of third-party service providers operating outside the cbb22 platform environment. We recommend that you review the privacy policies of any third-party services you interact with in connection with your use of cbb22.

The cbb22 platform does not contain outbound links to external websites for the purpose of directing users away from the platform. Any third-party service integration is embedded within the cbb22 platform environment and subject to the data processing agreements described in Section 6.

cbb22 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the platform. When material changes are made, cbb22 will endeavour to notify registered players by email or via an on-platform notification prior to the changes taking effect.

The updated Privacy Policy will always be accessible on this page at https://cbb22.io/privacy-policy. The "Last Updated" date displayed at the top of this document will be revised each time the Policy is amended. Your continued use of the cbb22 platform after any amendment has been published constitutes your acknowledgement of the updated Policy.

If you do not agree with any amendment to this Privacy Policy, you should cease using the cbb22 platform and contact [email protected] to request the closure of your account and the handling of your personal data in accordance with your rights under Section 10.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way cbb22 processes your personal data, please contact us using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Use "Privacy Policy Enquiry" or "Data Rights Request" to ensure your message is routed to the correct team
• Response Time: General privacy enquiries are typically answered within 48 hours; formal data rights requests are acknowledged within 5 business days and resolved within 30 days
• Availability: 24 hours a day, 7 days a week, including Bangladesh public holidays