cd45 Privacy Policy — Your Data, Protected

1Who We Are

cd45 ("cd45", "we", "us", "our") operates the online betting and casino platform accessible at cd45.io, along with any associated mobile interfaces or applications that connect to the same platform infrastructure. cd45 is the data controller in respect of all personal data collected from members and visitors who access the cd45 platform.

For the purposes of this Privacy Policy, "personal data" refers to any information that identifies, or could reasonably be used to identify, a living individual — including but not limited to a name, mobile number, email address, device identifier, payment account number, or IP address. "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.

By registering an account on cd45.io or by continuing to use the platform after this Privacy Policy has been updated, you acknowledge that you have read and understood this policy and consent to the processing of your personal data as described herein. If you do not consent, you must not register an account or must close your existing account by contacting support at [email protected].

2Personal Data We Collect

cd45 collects personal data in the following categories. The table below sets out each category, the specific data points within it, and the primary purpose for which each is collected.

3How We Collect Your Data

cd45 collects personal data through the following channels and mechanisms:

3.1 Directly From You

• Registration form — when you create a cd45 account, you provide your name, mobile number, email address, date of birth, and password.
• KYC verification — when you submit identity documents (NID, passport) and proof of payment method ownership for account verification.
• Deposit and withdrawal requests — your financial account identifiers are captured at the point of each transaction initiation.
• Support interactions — any information you share with our support team via email at [email protected] or through the platform's live chat interface.
• Responsible gaming tool usage — when you set deposit limits, activate cooling-off periods, or submit a self-exclusion request.

3.2 Automatically Via Technology

• Cookies and similar tracking technologies — session cookies, preference cookies, and analytics cookies are used as described in Section 7 of this policy.
• Server logs — our web servers automatically record IP addresses, request timestamps, HTTP status codes, and referrer URLs for every request made to cd45.io.
• Device fingerprinting — limited device attributes are collected to support fraud detection and to enforce the single-account rule.
• Game engine logs — all game actions (bets placed, cards dealt, spins executed) are recorded automatically by the game server for integrity and audit purposes.

3.3 From Third Parties

• Payment providers — bKash, Nagad, Rocket, Upay, and our banking partners confirm transaction status and, where required by anti-money-laundering obligations, account holder name matching.
• KYC verification services — where cd45 uses a third-party identity verification provider to cross-check document authenticity, that provider returns a verification result and confidence score.
• Fraud intelligence services — aggregated risk signals from fraud prevention partners may be used to assess account risk scores. No raw personal data from external sources is stored on cd45 servers beyond the risk score itself.

4Legal Basis for Processing

cd45 processes your personal data only where a valid legal basis exists. The legal bases applicable to our processing activities are as follows:

• Contractual necessity: Processing your identity data, contact data, financial data, and transactional data is necessary to perform our obligations under the Terms & Conditions you accepted at registration — including creating your account, processing your deposits and withdrawals, settling your bets, and providing customer support.
• Legal obligation: Processing for KYC verification, anti-money-laundering checks, age verification, and the maintenance of bet and transaction records is required by applicable law and regulatory guidance. cd45 cannot waive these obligations on request.
• Legitimate interests: Processing technical and usage data for fraud detection, security monitoring, responsible gaming pattern analysis, and platform performance optimisation serves cd45's and its members' legitimate interests. We conduct a balancing test before relying on this basis to ensure your rights are not overridden.
• Consent: Where we send you promotional communications by email or SMS, we do so on the basis of your consent, which you may withdraw at any time by contacting [email protected] or by using the unsubscribe mechanism in any marketing message.

5How We Use Your Personal Data

The personal data collected by cd45 is used for the following specific purposes:

• Account creation and management — establishing your member profile, linking your payment method, and maintaining accurate account records throughout your membership.
• Identity and age verification — confirming that you are at least 21 years of age and that the details you have provided are genuine and consistent with your submitted documents, in compliance with our 21+ age policy.
• Transaction processing — executing deposit credits, withdrawal disbursements, bonus allocations, bet settlements, and refunds accurately and in a timely manner.
• Security and fraud prevention — detecting and investigating suspicious account activity, enforcing the single-account rule, identifying bot usage, and preventing unauthorised access to member accounts.
• Responsible gaming — monitoring betting patterns for indicators of problem gambling behaviour, enforcing the deposit limits, cooling-off periods, and self-exclusion orders that you request, and proactively reaching out if our system flags concerning activity.
• Customer support — investigating and resolving account queries, disputes, payment issues, and complaints, and maintaining records of those interactions for quality assurance purposes.
• Legal and regulatory compliance — meeting our record-keeping obligations, responding to lawful requests from authorities, and fulfilling our anti-money-laundering reporting duties.
• Platform improvement — using aggregated, anonymised usage data to improve the cd45 platform, fix technical issues, and introduce features that better serve our members across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh.
• Promotional communications — where you have consented, sending you notifications about bonuses, tournaments, seasonal promotions (such as BPL season offers, Eid specials, and Pohela Boishakh promotions), and platform updates.

6Data Sharing & Disclosure

cd45 does not sell your personal data. We share personal data with third parties only in the circumstances described below, and only to the extent necessary for the stated purpose.

6.1 Service Providers

cd45 works with carefully selected service providers who process personal data on our behalf under binding data processing agreements. These include:

• Payment processors — bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank, and BRAC Bank, for the purpose of executing deposits and withdrawals.
• Identity verification providers — third-party KYC services used to authenticate the documents you submit, operating under strict confidentiality obligations.
• Game content providers — Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and other certified studios whose game engines process your bet actions in real time. These providers receive only the minimum data required to execute game logic (session token, bet amount, game outcome).
• Cloud and hosting infrastructure — secure server infrastructure providers on whose systems cd45 data is hosted. These providers act solely on cd45's instructions and have no independent right to access member data.
• Fraud prevention services — risk intelligence providers who receive anonymised or pseudonymised technical signals to generate account risk scores.

6.2 Legal and Regulatory Disclosure

cd45 may disclose personal data to law enforcement authorities, courts, or regulatory bodies where we are required to do so by a valid legal obligation — including court orders, subpoenas, or statutory reporting requirements. We will notify you of any such disclosure where we are legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring involving cd45, member data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material change to this Privacy Policy that results from it, with no less than 30 days' notice before the transfer takes effect.

7Cookies & Tracking Technologies

cd45.io uses cookies and similar technologies to ensure the platform functions correctly, to maintain your login session, and to understand how members interact with the site. The following categories of cookies are used:

Strictly necessary cookies cannot be disabled as they are essential to the operation of the platform. You may adjust your browser settings to block or delete functional and analytics cookies; however, doing so may impair certain platform features. cd45 does not use third-party advertising or retargeting cookies.

8Data Retention

cd45 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

• Active account data — retained for the full duration of your membership and for 5 years following permanent account closure, to meet anti-money-laundering record-keeping requirements.
• KYC documents — retained for 5 years from the date of submission or from the date of account closure, whichever is later, in compliance with financial crime prevention obligations.
• Transaction records — all deposit, withdrawal, bet, and bonus records are retained for 5 years following the transaction date.
• Support communications — email and chat transcripts are retained for 3 years from the date of the interaction, except where they form part of an active dispute, in which case they are retained until the dispute is fully resolved.
• Technical and usage logs — server logs and analytics data are retained for up to 13 months, after which they are aggregated and anonymised.
• Self-exclusion records — records of self-exclusion requests are retained for 7 years from the date of the request, to prevent circumvention of the self-exclusion order.
• Marketing consent records — records of your marketing consent or withdrawal of consent are retained for 3 years from the most recent consent event.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately technically feasible (for example, in backup archives), data is isolated from active processing until it can be deleted.

9Data Security Measures

cd45 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption — all data transmitted between your device and cd45.io is encrypted using industry-standard TLS 1.2 or higher. The cd45 domain enforces HTTPS on all pages and subdomains.
• Password hashing — member passwords are stored as bcrypt hashes with unique per-account salts. Plain-text passwords are never stored or logged anywhere on cd45's infrastructure.
• OTP two-factor authentication — a one-time password is required when logging in from a new or unrecognised device, providing an additional layer of protection against credential theft.
• Role-based access control — internal access to member data is restricted to staff whose roles require it, and all internal data access is logged and subject to quarterly access reviews.
• Database encryption at rest — all database tables containing personally identifiable information are encrypted using AES-256. Encryption keys are stored separately from the data they protect.
• Regular security audits — cd45's infrastructure undergoes periodic vulnerability assessments and penetration testing by qualified security professionals. Critical findings are remediated within 48 hours of identification.
• Incident response plan — cd45 maintains a documented data breach response procedure. In the event of a confirmed breach affecting member personal data, affected members will be notified without undue delay.

10Your Data Rights

As a cd45 member, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request — [Your Account ID]". We will respond within 14 business days of receiving a valid, verified request.

• Right of access — you may request a copy of all personal data that cd45 holds about you, together with information about how it is processed, the categories it falls into, who it has been shared with, and how long it will be retained.
• Right to rectification — if any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated. Where the correction affects KYC-verified data, you may be asked to resubmit supporting documentation.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where you believe it has been processed unlawfully. This right is subject to legal retention obligations — data that must be retained under anti-money-laundering or other regulatory requirements cannot be deleted on request alone.
• Right to restriction — you may request that cd45 restrict its processing of your personal data in certain circumstances, such as while a dispute about data accuracy is being resolved.
• Right to data portability — where processing is based on your consent or on contract performance, and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests (including profiling for responsible gaming monitoring) at any time. cd45 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for legal claims.
• Right to withdraw consent — where processing is based on your consent (e.g., for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that took place before the withdrawal.

11Children & Minors

cd45 is strictly an adults-only platform. Our services are not directed at, intended for, or available to any person under the age of 21. We do not knowingly collect, store, or process personal data belonging to individuals under 21 years of age.

During the registration process, every applicant is required to confirm that they are at least 21 years old. Where our KYC verification process identifies that a member is under 21, the account will be suspended immediately, all funds will be returned via the original payment method, and all personal data associated with the account will be deleted within 30 days of the identification, except where retention is required for legal reporting purposes.

If you are a parent or guardian and you believe that a person under the age of 21 in your care has registered an account with cd45, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will investigate and act promptly.

12Third-Party Services & External Links

The cd45 platform integrates with third-party game content providers including but not limited to Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe. When you interact with a game provided by one of these studios, certain minimal technical data (such as session tokens, bet amounts, and game outcomes) is exchanged with that provider's game server in real time in order to run the game correctly. Each provider operates under contractual data processing obligations that restrict their use of this data to game delivery and integrity purposes only.

cd45.io does not contain outbound hyperlinks to external third-party websites as part of its standard navigation. If any promotional or informational content on the platform references an external source, please note that cd45 is not responsible for the privacy practices or content of external sites. You should review the privacy policy of any third-party site you visit independently of your cd45 experience.

Payment partners including bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank, and BRAC Bank operate under their own privacy policies and data protection frameworks when processing your payment transactions. cd45 recommends that you familiarise yourself with the relevant privacy documentation of your chosen payment provider.

13Amendments to This Privacy Policy

cd45 reserves the right to update, revise, or replace this Privacy Policy at any time. Such changes may reflect updates in applicable law, changes in our data processing activities, the introduction of new platform features, or the adoption of new service providers.

When a material change is made to this Privacy Policy — meaning a change that substantively affects how your personal data is collected, used, shared, or protected — cd45 will provide no less than 14 days' advance notice of the change via:

• A prominent notice displayed on cd45.io at the point of login for all active members.
• An email notification to the registered email address on your cd45 account.
• An updated "Effective Date" and "Last Reviewed" date at the top of this document and in the page hero section.

For minor, non-material changes (such as typographical corrections, clarifications that do not alter the substance of the policy, or updated contact details), cd45 may update this policy without advance notice. The "Last Reviewed" date will be updated in all cases.

Your continued use of the cd45 platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the updated policy, you must close your account before the effective date by contacting [email protected].

14Contact & Complaints

cd45 takes all privacy concerns seriously. If you have a question about this Privacy Policy, wish to exercise a data subject right, or wish to raise a complaint about how your personal data has been handled, please use the contact details below.

• Email: [email protected] — use subject line "Privacy Enquiry — [Your Account ID]" for fastest routing
• Response time: Acknowledgement within 48 hours; full resolution within 14 business days for data subject requests
• Support hours: 24 hours a day, 7 days a week, 365 days a year including public holidays in Bangladesh
• Service area: All regions of Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar

If you submit a privacy complaint and you are not satisfied with cd45's response or resolution, you have the right to escalate the matter through any applicable dispute resolution mechanism available to you under the laws of Bangladesh. cd45 will cooperate fully with any lawful investigation by a competent authority.