ck32 Privacy Policy — How We Handle Your Personal Data

1 Overview

This Privacy Policy ("Policy") describes how ck32 ("ck32", "we", "us", "our") collects, uses, stores, shares, and protects personal data provided by or collected about players and visitors ("you", "your") who access the ck32 website at ck32.io and use the products and services made available through the platform (the "Platform").

ck32 takes data privacy seriously and processes personal data in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, and integrity and confidentiality. By registering a ck32 account or continuing to use the Platform, you acknowledge that you have read this Policy in full and consent to the processing of your personal data as described herein.

This Policy should be read alongside the ck32 Terms & Conditions and the Responsible Gaming Policy. Where any conflict exists between this Policy and those documents with respect to data handling, this Privacy Policy shall take precedence.

ck32 reserves the right to update this Policy at any time. Material changes will be communicated to registered players via SMS to their Bangladesh mobile number at least seven days before the change takes effect. The effective date at the top of this document reflects the most recent version.

2 Personal Data We Collect

ck32 collects only the personal data that is necessary to deliver the Platform's services, comply with applicable legal obligations, and maintain a safe and fair gaming environment. The categories of personal data we collect include the following:

2.1 Registration & Identity Data

• Full legal name — as it appears on your government-issued identity document.
• Date of birth — to verify that you meet the 21+ age requirement.
• Bangladesh mobile number — used for account security, OTP verification, and SMS communications.
• Email address — used for account notifications and support correspondence.
• Username and encrypted password — credentials used to access your ck32 account.
• National Identity Card (NID) number or passport number — collected during KYC verification.

2. 2 Financial & Transaction Data

• Payment method details — including your registered bKash, Nagad, Rocket, or Upay account number, or masked Visa/Mastercard details.
• Deposit and withdrawal history — transaction amounts in Bangladeshi Taka (৳), timestamps, and payment reference numbers.
• Account balance history — running record of credits, debits, bonus allocations, and wagering activity.
• Bank account details — where provided voluntarily for withdrawal processing via Dutch-Bangla Bank, City Bank, BRAC Bank, or other partner institutions.

2.3 KYC Verification Documents

• Government-issued photo ID — scanned copy or photograph of your National Identity Card, passport, or driving licence.
• Proof of address — utility bill, bank statement, or official correspondence dated within 90 days confirming your registered address in Bangladesh.
• Selfie or live photo — where required by our KYC provider to confirm that document photographs match the account holder.

2.4 Technical & Usage Data

• IP address — recorded at login, deposit, and withdrawal events for fraud detection and geolocation purposes.
• Device identifiers — operating system, browser type, device model, and screen resolution.
• Session data — login timestamps, session duration, pages visited, and in-platform navigation paths.
• Game activity logs — bet amounts, game titles played, outcomes, and timestamps for all wagering events.
• Cookies and similar tracking technologies — detailed in Section 9 of this Policy.

2.5 Communications Data

• Live chat transcripts — records of support conversations initiated through the Platform.
• Email correspondence — messages sent to or received from ck32 support addresses.
• Responsible gaming communications — records of deposit limit requests, self-exclusion applications, and related interactions.

3 How We Collect Your Data

ck32 collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account profile.
• Automatically — through cookies, server logs, and tracking pixels as you browse and interact with the Platform. See Section 9 for full details on cookie usage.
• From payment providers — bKash, Nagad, Rocket, Upay, and partner banks may provide transaction confirmation data to ck32 for the purpose of crediting deposits and processing withdrawals.
• From KYC verification services — our third-party identity verification partner provides verification outcomes and fraud risk scores based on the documents you submit.
• From fraud prevention partners — automated fraud detection services may provide risk signals associated with your IP address, device fingerprint, or payment method.

4 How We Use Your Personal Data

ck32 uses your personal data only for the specific purposes set out below. We do not use personal data for automated decision-making that produces significant legal effects without human oversight.

Where ck32 uses your personal data for direct marketing communications (such as bonus offer SMS or promotional emails), you may withdraw your consent at any time by contacting support at [email protected] or by updating your notification preferences in your account settings.

5 Legal Basis for Processing

ck32 processes your personal data on the following legal grounds:

• Contractual necessity — Processing your registration data, KYC documents, and financial transaction records is necessary to perform the contract between you and ck32 as set out in the Terms & Conditions.
• Legal obligation — ck32 is required to collect and retain certain personal data to comply with anti-money laundering (AML) obligations, age verification requirements, and the record-keeping requirements of our international operating licence.
• Legitimate interests — ck32 processes technical and usage data to detect fraud, prevent abuse of the Platform, maintain account security, and improve the player experience. These legitimate interests do not override your fundamental rights and freedoms.
• Consent — Where we send you direct marketing communications or deploy non-essential cookies, we do so only on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Sharing Your Personal Data

ck32 does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

6.1 Service Providers

ck32 engages carefully selected third-party service providers who process personal data on our behalf, subject to written data processing agreements that require them to maintain confidentiality and implement appropriate technical and organisational security measures. These providers include:

• Payment processors — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard, for the processing of deposits and withdrawals.
• KYC verification providers — third-party identity verification services that process submitted documents to confirm player identity.
• Fraud detection services — automated risk assessment providers that analyse transaction and session data to identify fraudulent activity.
• Licensed game providers — studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive pseudonymised player identifiers necessary to operate games and confirm bet outcomes.
• Cloud hosting and infrastructure providers — data is stored on secure servers managed by ck32's infrastructure partners, subject to strict confidentiality and security obligations.

6.2 Legal Disclosure

ck32 may disclose personal data to law enforcement agencies, regulatory authorities, or other government bodies where required to do so by applicable law, court order, or other binding legal process. ck32 will notify affected players of such disclosure requests where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial portion of ck32's assets, personal data held by ck32 may be transferred to the acquiring entity as part of that transaction. Affected players will be notified of any such transfer and of any changes to data processing arrangements that may result.

7 Data Retention

ck32 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and our international operating licence obligations. The following indicative retention periods apply:

• Account registration and KYC data — retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Financial transaction records — retained for a minimum of five (5) years following each transaction, as required for AML and audit purposes.
• Game activity logs — retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support communications — retained for two (2) years following the resolution of the relevant support case.
• Marketing consent records — retained until consent is withdrawn, and for one (1) year thereafter as evidence of the consent history.
• Technical and usage logs — retained for twelve (12) months on a rolling basis for security monitoring and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

8 Data Security

ck32 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption — applied to all data transmissions between your device and the ck32 Platform, including login, deposit, withdrawal, and KYC document upload flows.
• Encrypted password storage — account passwords are stored using industry-standard one-way hashing algorithms. ck32 staff cannot view your password in plain text.
• Two-factor authentication (2FA) — available to all ck32 account holders via OTP sent to your registered Bangladesh mobile number. Players are strongly encouraged to enable 2FA.
• Access controls — access to personal data within ck32 is restricted to employees and contractors who require it to perform their role. All access is logged and subject to periodic review.
• Penetration testing and vulnerability scanning — ck32 conducts regular security assessments of the Platform and its infrastructure to identify and remediate potential vulnerabilities.
• Incident response procedures — in the event of a data breach affecting your personal data, ck32 will notify affected players and relevant authorities in accordance with applicable breach notification obligations and within the timeframes required by our operating licence.

While ck32 takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You play an important role in keeping your account secure by using a strong, unique password and enabling 2FA.

9 Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device by the ck32 Platform when you visit the site. They allow the Platform to recognise your device across sessions, remember your preferences, and collect usage data for the purposes described in this Policy.

9.2 Types of Cookies Used

• Strictly necessary cookies — essential to the functioning of the Platform. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies — used to remember your language preferences, game display settings, and account notification preferences across sessions.
• Analytics cookies — used in aggregated, anonymised form to understand how players navigate the Platform, which pages are most visited, and where technical issues arise. ck32 uses this data to improve the player experience.
• Fraud prevention cookies — device fingerprinting and risk scoring cookies used to identify unusual session behaviour that may indicate account compromise or fraudulent activity.

9.3 Managing Cookies

You may control non-essential cookies through your browser settings. Disabling analytics or functional cookies will not prevent you from using the Platform but may affect the quality of your experience. Strictly necessary cookies cannot be disabled via browser settings without logging out of your account. Please refer to your browser's help documentation for instructions on managing cookies on your specific device.

10 Your Data Rights

As a ck32 account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact the ck32 data privacy team at [email protected] with the subject line "Data Rights Request". ck32 will respond to all verified requests within 30 days.

• Right of access — you may request a copy of the personal data ck32 holds about you, along with information about how it is being used.
• Right to rectification — you may request correction of inaccurate or incomplete personal data. You can update basic profile information directly from your account settings panel.
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ck32's legal and regulatory retention obligations described in Section 7.
• Right to restriction of processing — you may request that ck32 restricts processing of your personal data while a rectification or objection request is under consideration.
• Right to data portability — you may request that ck32 provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another service provider.
• Right to object — you may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on ck32's legitimate interests, subject to ck32 demonstrating compelling grounds that override your interests.
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing before the withdrawal.

ck32 will not charge a fee for processing data rights requests in standard circumstances. Where requests are manifestly unfounded or excessive, ck32 reserves the right to apply a reasonable administrative fee or decline to act on the request, with written reasons provided.

11 Children's Privacy

The ck32 Platform is strictly intended for adults aged 21 years and over. ck32 does not knowingly collect, process, or retain personal data from any individual under the age of 21. If ck32 becomes aware that personal data has been collected from a person under 21, the associated account will be suspended immediately, the personal data erased in accordance with Section 7, and any real-money balance returned to the original payment method.

Parents and guardians who believe that their child may have registered a ck32 account should contact [email protected] immediately. ck32 treats such notifications as high-priority and will act within 24 hours of a verified report.

12 International Data Transfers

ck32 operates as an internationally licensed offshore platform. Personal data collected from players in Bangladesh may be transferred to, and processed in, countries other than Bangladesh where ck32's infrastructure, KYC, or fraud prevention service providers are located. Such transfers are conducted under appropriate safeguards, including contractual clauses that impose data protection standards equivalent to those described in this Policy.

ck32 does not transfer personal data to countries or entities that cannot demonstrate an adequate level of data protection. By using the Platform, you acknowledge and consent to the international transfer of your personal data in accordance with the terms of this Policy.

13 Third-Party Links

The ck32 Platform may contain references to third-party game studios and payment providers. While ck32 takes care to engage reputable partners, this Privacy Policy applies solely to the ck32 Platform. ck32 is not responsible for the privacy practices of any third-party service, including payment gateways and game providers accessed through the Platform. Players are encouraged to review the privacy policies of any third-party services they interact with.

14 Amendments to This Policy

ck32 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our operating licence requirements. Where a change is material — for example, a new category of data being collected, a new purpose for processing, or a new category of third-party recipient — ck32 will provide registered players with at least seven (7) days' advance notice via SMS to their registered Bangladesh mobile number.

Minor or administrative updates (such as clarifications of existing language or corrections of typographical errors) may be made without prior notice. The effective date displayed at the top of this Policy reflects the date of the most recent substantive revision. Continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the revised terms.

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a concern about how ck32 handles your personal data, please contact us using the details below:

• Email — [email protected] with subject line "Privacy Enquiry" (plain text — not a clickable link).
• Live Chat — Available 24/7 directly on the ck32 Platform, with average first response times under two minutes during Bangladesh Standard Time (BST, UTC+6) peak hours.

ck32 aims to resolve all privacy-related enquiries within 30 days. Where a complaint cannot be resolved through the internal process, you may escalate the matter to the relevant data protection authority or dispute resolution body specified under ck32's international operating licence.

All privacy correspondence is handled by a dedicated team member and treated with strict confidentiality. ck32 will never use a privacy enquiry as a basis for penalising or restricting a player's account.