Your Privacy Matters at cb678

1 Who We Are

cb678 is an online casino and sports betting platform accessible at cb678.io. The platform is operated by cb678 and is designed to serve players in Bangladesh, offering a comprehensive library of casino games, live dealer tables, sports betting markets — including cricket BPL, IPL, and T20 World Cup — and instant BDT payment facilities via bKash, Nagad, Rocket, and Upay.

For the purposes of this Privacy Policy, cb678 acts as the data controller in respect of all personal information collected from registered players and site visitors. This means cb678 determines the purposes and means by which your personal data is collected and processed.

If you have any questions about how cb678 handles your personal data, or if you wish to exercise any of your data rights described in this policy, you may contact our Data Support team at any time using the contact details provided in Section 13 of this policy.

2 Information We Collect

cb678 collects personal data in two primary ways: information you provide to us directly, and information collected automatically through your use of the platform. The categories of data we collect are set out below.

2.1 Information You Provide Directly

• Registration Data: When you create a cb678 account, you provide your full legal name, date of birth, residential address, email address, and mobile phone number. This information is required to create and maintain your account.
• Identity Verification (KYC) Documents: To comply with our age verification and anti-fraud obligations, we collect copies of identity documents such as your National Identity Card (NID), passport, or birth certificate, together with proof of residential address such as a utility bill or bank statement.
• Payment Information: When you make a deposit or request a withdrawal, we collect transaction data including your payment method identifiers (e.g., your bKash or Nagad account number, or masked Visa/Mastercard details). We do not store full card numbers on our servers — payment card data is processed by our certified payment partners.
• Communications: When you contact cb678 support by email or live chat, we retain records of those communications, including your queries, our responses, and any attachments you share with us.
• Responsible Gaming Requests: Where you submit a request to set deposit limits, activate a cooling-off period, or self-exclude, we record those instructions and the date on which they were applied to your account.

2.2 Information Collected Automatically

• Device and Technical Data: We automatically collect your IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and device identifiers when you access cb678.
• Usage Data: We record information about how you interact with the cb678 platform, including pages visited, games played, bets placed, session start and end times, and navigation paths through the site.
• Transaction Logs: All deposits, withdrawals, bonus activations, wagers, and game outcomes are recorded in your account transaction history. This data is retained for account management, dispute resolution, and regulatory compliance purposes.
• Cookie Data: cb678 uses cookies and similar tracking technologies as described in Section 7 of this policy. Cookie data may include session identifiers, preference settings, and analytics event data.

3 How We Use Your Information

cb678 uses the personal data it collects for the following purposes:

cb678 does not use your personal data for automated decision-making that produces significant legal effects on you, unless such processing is expressly disclosed and you have given your consent or the processing is required by applicable law.

Where cb678 processes your data for marketing communications — such as informing you of new promotions, seasonal offers (e.g., Eid or Pohela Boishakh specials), or new game releases — you will be given the opportunity to opt out of such communications at the point of registration and at any subsequent time by contacting support at [email protected].

4 Legal Basis for Processing

cb678 processes your personal data under the following legal bases:

• Contractual Necessity: Processing your registration data, KYC documents, payment information, and game records is necessary to fulfil our contractual obligations to you as a registered cb678 player under the cb678 Terms & Conditions.
• Legitimate Interests: cb678 processes certain data — such as IP addresses, device identifiers, and usage logs — on the basis of our legitimate interests in preventing fraud, maintaining platform security, and improving the quality of our services. We carry out this processing only where it does not override your fundamental privacy rights.
• Legal Obligation: cb678 is required to retain certain data — particularly KYC documents and financial transaction records — to comply with anti-money laundering (AML) obligations and other applicable legal requirements. This data is retained for the legally prescribed minimum period regardless of account status.
• Consent: Where cb678 relies on your consent as the legal basis for processing — for example, for optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact [email protected].

5 Sharing Your Information

cb678 does not sell or rent your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Service Providers: To process deposits and withdrawals, we share relevant transaction data with payment partners including bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank. These providers process payment data under their own privacy policies and are bound by payment industry security standards.
• KYC and Identity Verification Partners: cb678 may use third-party identity verification service providers to assist with the KYC process. These partners process identity document data solely for the purpose of verifying your identity on cb678's behalf and are prohibited from using your data for any other purpose.
• Game Technology Providers: Game providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe operate the game software accessible through the cb678 platform. Certain game session data (such as your player ID and bet amounts) may be transmitted to these providers to deliver game functionality. These providers are bound by their own data processing agreements with cb678.
• IT and Cloud Infrastructure Providers: cb678 uses third-party server and cloud infrastructure to host the platform. These providers act as data processors under agreement with cb678 and may have access to personal data stored on our servers solely for the purpose of providing infrastructure services.
• Law Enforcement and Regulatory Authorities: cb678 will disclose personal data to law enforcement agencies, government bodies, or regulatory authorities where required to do so by applicable law or pursuant to a valid legal order. cb678 will notify you of such a disclosure to the extent permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of cb678's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. Registered players will be notified of any such transfer in advance where reasonably practicable.

6 Payment Data and Financial Privacy

cb678 takes the security of your financial data with particular seriousness. The following practices govern how payment-related personal data is handled on the cb678 platform:

• cb678 does not store full payment card numbers (PANs) on its own servers. Card transactions are processed directly by our PCI-DSS compliant payment partners. cb678 retains only masked card references (e.g., the last four digits) for display in your transaction history.
• Mobile banking identifiers — such as your bKash or Nagad account number — are stored in encrypted form and are used solely for the purpose of processing your deposits and withdrawals. They are never shared with third parties for marketing purposes.
• All deposit and withdrawal transactions are logged with timestamps, amounts, payment methods, and status codes. These transaction records are retained for a minimum of five years in accordance with our financial record-keeping obligations.
• cb678 monitors transaction patterns for indicators of fraudulent activity, money laundering, or unusual behaviour. Where suspicious activity is detected, we may suspend payment processing pending further investigation and, where required by law, file a report with the relevant authority.
• In accordance with our anti-money laundering policy, withdrawals are processed to the same payment method used for the player's most recent deposit wherever technically possible. Where this is not possible, alternative arrangements are subject to enhanced verification.

7 Cookies and Tracking Technologies

cb678 uses cookies and similar technologies — including local storage, session storage, and pixel tags — to operate and improve the platform. The table below summarises the categories of cookies used on cb678.io:

You can control cookie behaviour through your web browser settings. Most modern browsers allow you to block all cookies, accept only first-party cookies, or clear cookies after each browsing session. Please note that disabling strictly necessary cookies will impair the functionality of the cb678 platform — in particular, you may not be able to maintain a logged-in session.

cb678 does not use cookies to serve third-party advertising, track you across unrelated websites, or build advertising profiles based on your browsing history outside of cb678.io.

8 Data Retention

cb678 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the minimum retention periods required by applicable legal and regulatory obligations. The following retention schedule applies:

• Active Account Data: Personal data associated with an active cb678 account (registration details, KYC documents, transaction records, game history) is retained for the full duration of the account relationship.
• Closed Account Data: Following account closure — whether initiated by the player or by cb678 — personal data is retained for a minimum of five (5) years from the date of closure. This retention period is required to meet our anti-money laundering record-keeping obligations and to resolve any disputes that may arise after closure.
• KYC Documents: Identity and address verification documents are retained for a minimum of five (5) years following the end of the player relationship, in accordance with applicable financial compliance requirements.
• Customer Support Communications: Records of support interactions (emails, live chat transcripts) are retained for a minimum of two (2) years from the date of the interaction.
• Marketing Opt-Out Records: Where you have opted out of marketing communications, we retain a record of your opt-out indefinitely to ensure that we do not re-add you to marketing lists without your renewed consent.
• Self-Exclusion Records: Records of self-exclusion requests are retained for the full duration of the self-exclusion period and for a minimum of five (5) years thereafter, to prevent circumvention of self-exclusion by re-registration.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

9 Data Security

cb678 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures in place include:

• SSL/TLS Encryption: All data transmitted between your device and cb678's servers is encrypted using TLS (Transport Layer Security) protocols. The cb678 platform enforces HTTPS across all pages and does not permit unencrypted HTTP connections.
• At-Rest Encryption: Personal data stored in cb678's databases — including KYC documents, player profile information, and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within cb678's internal systems is restricted on a strict need-to-know basis. Staff with access to personal data are required to use strong, unique passwords and multi-factor authentication. Access privileges are reviewed and audited regularly.
• Intrusion Detection: cb678 operates network-level intrusion detection and prevention systems to identify and respond to unauthorised access attempts in real time.
• Regular Security Audits: The cb678 platform undergoes regular security assessments, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: In the event of a data security incident that affects your personal data, cb678 will take immediate steps to contain the breach, assess the risk to affected individuals, and notify affected players without undue delay where required by applicable law.

10 Your Rights

As a cb678 player, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will respond to all valid requests within a reasonable timeframe:

• Right of Access: You have the right to request a copy of the personal data cb678 holds about you, together with information about how that data is used. This is sometimes called a Subject Access Request (SAR).
• Right to Rectification: If any personal data cb678 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure: In certain circumstances, you have the right to request that cb678 delete your personal data. This right is subject to our legal obligation to retain certain data for the periods described in Section 8 of this policy. We cannot delete data that we are legally required to retain.
• Right to Restrict Processing: You may request that cb678 restrict the processing of your personal data in circumstances where you contest the accuracy of the data, object to the processing, or require the data to be retained for the purpose of a legal claim.
• Right to Data Portability: Where processing is based on your consent or on a contractual relationship, you have the right to receive a copy of the personal data you provided to cb678 in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to cb678's processing of your personal data where that processing is based on our legitimate interests. We will cease processing your data unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for a legal claim.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

cb678 will not charge a fee for processing a data rights request unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply. cb678 may request additional information to verify your identity before processing a data rights request in order to protect your data from unauthorised access.

11 Children and Minors

Where cb678 identifies that personal data has been collected from a player who is under the age of 21 — whether through KYC verification, a report from a third party, or any other means — the following steps will be taken immediately:

• The relevant account will be suspended and then permanently closed.
• Any deposits made will be returned to the original payment method used, subject to identity verification and confirmation that the funds were not derived from a third party's payment account.
• All personal data associated with the underage account will be deleted as soon as legally permissible, consistent with our legal obligations under Section 8 of this policy.

If you are a parent or guardian and believe that your child has registered on cb678 without your consent, please contact us immediately at [email protected] with the subject line "Minor Account Report". We take underage gambling prevention extremely seriously and will act on all such reports promptly and confidentially.

12 Changes to This Policy

cb678 reserves the right to update, amend, or replace this Privacy Policy at any time. When changes are made, the revised policy will be published on this page with an updated "Last Updated" date at the top of the document.

Where changes are material — meaning they significantly affect the way we collect or use your personal data, or significantly alter your rights — cb678 will make reasonable efforts to notify registered players in advance via their registered email address or through a notice displayed on the platform at the next login.

Your continued use of the cb678 platform following any revision to this Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must stop using the platform and contact [email protected] to close your account and arrange return of any verified real-money balance.

We encourage you to review this Privacy Policy periodically to stay informed about how cb678 is protecting your personal information. The most current version will always be accessible at cb678.io/privacy-policy.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way cb678 handles your personal data, please contact our support team using the details below:

• Email: [email protected] — please use the subject line "Privacy Enquiry" for data-related questions
• Data Rights Requests: [email protected] — use subject line "Data Rights Request"
• Minor Account Reports: [email protected] — use subject line "Minor Account Report"
• Support Hours: 24 hours a day, 7 days a week, including all Bangladeshi public holidays
• Response Time: Privacy and data rights enquiries are acknowledged within 24 hours and resolved within 5 business days for standard requests