cb89 Privacy Policy

Introduction

1.1 This Privacy Policy ("Policy") describes how cb89 ("cb89", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://cb89.io, collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "Player") who access, register on, or use our platform.

1.2 cb89 operates as an offshore online gaming platform principally serving players in Bangladesh. This Policy is written in English and constitutes the authoritative statement of cb89's data processing practices. Where translations are provided for convenience, the English version shall prevail in the event of any inconsistency.

1.3 This Policy is incorporated by reference into the cb89 Terms & Conditions. By registering on or using the cb89 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1.4 If you do not agree with any part of this Policy, you must not register on or use the cb89 platform. If you have questions about this Policy at any time, you may contact our Data Support team at [email protected].

Data Controller

2.1 For the purposes of this Policy, cb89 acts as the data controller with respect to personal data collected through the cb89 platform. As data controller, cb89 determines the purposes and means of processing your personal data.

2.2 cb89 operates as an offshore platform. The platform's data infrastructure is maintained under the offshore jurisdiction in which cb89 is registered. While cb89 principally serves players from Bangladesh, the platform does not operate under Bangladesh's direct regulatory framework, and players access the platform on that basis.

2.3 All data-related queries, requests, or complaints should be directed to:

• Email: [email protected]
• Subject line: "Data Privacy Request — [Your Registered Username]"
• Response time: Within 30 days of receipt of a valid, verified request

Personal Data We Collect

3.1 The categories of personal data cb89 collects about you depend on the nature of your interaction with the platform. The table below sets out the main data categories we process:

3.2 cb89 does not intentionally collect special categories of sensitive personal data (such as health, biometric, religious, or political data). If you voluntarily disclose such data in the course of support communications, we will handle it with heightened care and delete it once the relevant support interaction is resolved.

How We Collect Your Data

4.1 cb89 collects personal data through the following means:

Direct Collection

Data you provide directly when you: register an account; complete KYC verification; make a deposit or withdrawal request; contact customer support via live chat or email; update your account preferences; participate in a promotion or tournament; or respond to a survey.

Automated Collection

Data collected automatically when you access or use the platform, including via cookies, web beacons, pixel tags, and server logs. This includes Technical Data and Usage Data as described in Section 3. Automated collection begins when you first access the cb89 website, regardless of whether you have registered an account.

Third-Party Sources

Data received from third parties in the following circumstances:

• Payment providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank, BRAC Bank) — transaction confirmation data and account ownership verification responses.
• KYC verification service providers — identity verification results, document authenticity scores, and watchlist screening outcomes (e.g., sanctions screening, politically exposed persons checks).
• Fraud prevention services — device fingerprint risk scores, IP geolocation data, and velocity check results.
• Game suppliers (e.g., Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) — game session logs, RTP records, and game-level transaction data required for dispute resolution and audit purposes.

Purposes & Legal Basis for Processing

5.1 cb89 processes your personal data only where a valid purpose and lawful basis exists. The table below sets out our primary processing purposes and the corresponding legal basis:

5.2 Where cb89 relies on legitimate interests as a legal basis, we have assessed that our interests do not override your fundamental privacy rights, taking into account the reasonable expectations of players using an online gaming platform.

5.3 Where consent is the legal basis for processing (principally for marketing communications), you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, update your preferences in your account settings or contact [email protected].

Sharing Your Personal Data

6.1 cb89 does not sell, rent, or trade your personal data to any third party. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose.

6.2 Service Providers

cb89 engages third-party service providers who process personal data on our behalf under contractual data processing agreements. These providers include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard — to facilitate deposits and withdrawals.
• KYC and identity verification providers: To verify government-issued ID documents (NID, passport, driving licence) and conduct watchlist screening.
• Fraud prevention and cybersecurity providers: To assess transaction risk, detect account takeover attempts, and protect platform integrity.
• Game suppliers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game providers — to deliver game sessions and maintain game-level audit records.
• Cloud hosting and infrastructure providers: To store and process platform data securely.
• Customer support platform providers: To facilitate live chat and email support interactions.

6.3 Legal and Regulatory Disclosures

cb89 may disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or lawful government request. In such cases, cb89 will disclose only the minimum data necessary to comply with the legal obligation.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of cb89's business assets, personal data held by cb89 may be transferred to the acquiring entity. You will be notified of any such transfer via the registered email address no fewer than 30 days before the transfer takes effect, and the acquiring entity will be bound by the privacy commitments made in this Policy.

Cookies & Tracking Technologies

7.1 cb89 uses cookies and similar tracking technologies (collectively "cookies") to operate the platform, remember your preferences, analyse usage, and — where you have consented — to deliver personalised promotional content.

7.2 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without rendering core platform features non-functional.
• Functional Cookies: Remember your preferences such as language, game lobby layout, and responsible gaming settings you have configured. These are active by default but may be disabled via your browser settings.
• Analytics Cookies: Collect aggregated, anonymised data about how players use the platform — pages visited, session length, game categories browsed — to help cb89 improve platform performance and usability.
• Marketing Cookies: Used only where you have opted in to receive personalised promotions. These allow cb89 to tailor bonus offers and promotional notifications to your activity profile. Marketing cookies may be withdrawn at any time via account settings.

7.3 Managing Cookies

You may control cookie use through your browser's privacy settings. Note that disabling strictly necessary cookies will impair platform functionality. The cb89 platform does not respond to browser "Do Not Track" signals, as no uniform industry standard for responding to such signals currently exists. You may also update your marketing preferences at any time through your account dashboard or by contacting [email protected].

Data Retention

8.1 cb89 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The table below sets out the standard retention periods applied to each data category:

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised data (which is no longer personal data) may be retained indefinitely for aggregate statistical and analytical purposes.

Data Security

9.1 cb89 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key measures include:

• Encryption at rest: Personal data stored on cb89 servers is encrypted using AES-256 encryption.
• Encryption in transit: All data transmitted between your browser and the cb89 platform is protected using TLS 1.2 or TLS 1.3 protocols. Our SSL certificate is maintained by a recognised certificate authority.
• Access controls: Internal access to personal data is restricted to authorised personnel who require access to fulfil their specific job function. Role-based access control (RBAC) is enforced across all internal systems.
• Two-factor authentication (2FA): Available and strongly recommended for all player accounts. All internal cb89 systems require multi-factor authentication for staff access.
• Intrusion detection and monitoring: cb89 operates continuous security monitoring systems to detect and respond to anomalous access patterns or potential breaches.
• Regular security assessments: cb89 conducts periodic vulnerability assessments and penetration tests on its platform infrastructure.
• Incident response plan: In the event of a confirmed personal data breach, cb89 has a documented incident response procedure. Affected players will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

9.2 While cb89 takes all reasonable technical and organisational precautions to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account password and for any activity that occurs under your account. Enable two-factor authentication and report any suspected unauthorised access to [email protected] immediately.

Your Data Subject Rights

10.1 As a data subject, you hold the following rights with respect to the personal data cb89 holds about you. These rights may be exercised at any time by contacting [email protected] with the subject line "Data Privacy Request — [Your Registered Username]".

10.2 cb89 will respond to all verified data subject requests within 30 days of receipt. In complex or high-volume cases, this period may be extended by a further 30 days, in which case you will be notified of the extension and the reason for it.

10.3 To protect your privacy and prevent fraudulent data requests, cb89 will verify your identity before processing any data subject request. Verification typically involves confirming your registered email address, username, and a piece of KYC data already on file.

International Data Transfers

11.1 cb89 operates as an offshore platform, and personal data may be transferred to and processed in jurisdictions outside Bangladesh. Such transfers may occur when data is processed by cloud hosting providers, KYC verification services, payment processors, or game suppliers whose infrastructure is located in other countries.

11.2 Whenever personal data is transferred internationally, cb89 takes steps to ensure that adequate safeguards are in place to protect the data to a standard equivalent to that described in this Policy. These safeguards may include:

• Contractual clauses requiring the recipient to process data only for the stated purpose and to apply appropriate technical and organisational security measures.
• Engaging service providers who are certified under recognised international data security frameworks.
• Restricting transfers to service providers in jurisdictions that maintain adequate data protection standards as assessed by cb89.

11.3 If you have questions about the specific safeguards applied to any particular international transfer of your personal data, you may request further information by contacting [email protected].

Children & Minors

12.1 The cb89 platform is strictly restricted to individuals aged 21 years or older. cb89 does not knowingly collect, process, or store personal data from individuals under the age of 21.

12.2 Age verification is a mandatory step in the cb89 account registration and KYC process. If cb89 has reasonable grounds to believe that a registered account belongs to a person under the age of 21, the account will be immediately suspended pending further verification. If the suspicion is confirmed, the account will be permanently closed, all funds will be handled in accordance with the cb89 Terms & Conditions, and all personal data associated with the account will be deleted to the extent permissible under applicable legal retention obligations.

12.3 If you are a parent or guardian and have reason to believe that a minor in your care has registered on the cb89 platform, please contact us immediately at [email protected] with the subject line "URGENT — Minor Account Report". cb89 will investigate and act on all such reports promptly.

Marketing Communications

13.1 cb89 sends promotional and marketing communications — including bonus offers, tournament announcements, seasonal promotions (such as Eid, Pohela Boishakh, BPL season, and IPL promotions), and platform news — only to players who have expressly opted in to receive such communications at the time of registration or subsequently via account settings.

13.2 Marketing communications from cb89 may be delivered via:

• Email to your registered email address
• SMS to your registered mobile number (Bangladesh numbers)
• In-platform notifications when you are logged in to the cb89 platform

13.3 You may withdraw your marketing consent and opt out of all marketing communications at any time using any of the following methods:

• Clicking the unsubscribe link in any marketing email sent by cb89
• Updating your communication preferences in your account dashboard
• Contacting [email protected] with the subject line "Marketing Opt-Out — [Your Registered Username]"

13.4 Opt-out requests are processed within 5 business days. Please note that opting out of marketing communications does not affect the delivery of transactional messages (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent regardless of marketing preference as they relate to the operation of your account.

13.5 cb89 does not engage in unsolicited bulk marketing and does not share your contact details with third-party marketers. All promotional communications originate from cb89 directly and will be clearly identified as such.

Changes to This Privacy Policy

14.1 cb89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we provide. The "Last updated" date displayed at the top of this page will be revised whenever a material change is made to the Policy.

14.2 For material changes that significantly affect how your personal data is processed or that reduce your privacy rights, cb89 will provide advance notice by email to your registered address no fewer than 14 days before the changes take effect. Your continued use of the cb89 platform after the effective date of an updated Policy constitutes your acceptance of the revised terms.

14.3 Where a proposed change requires your fresh consent (for example, a new purpose for processing data that was previously collected on a different basis), cb89 will seek that consent explicitly before proceeding with the new processing activity.

14.4 We encourage you to review this Policy periodically to remain informed of how cb89 protects your personal data. The current version of this Policy is always accessible at https://cb89.io/privacy-policy.

Contact & Complaints

15.1 If you have any questions, concerns, or feedback regarding this Privacy Policy or the way cb89 processes your personal data, please contact us using the details below. All data privacy correspondence is handled in English, with a target initial response time of 24 hours and a resolution target of 30 days for substantive data subject requests.

• Customer Support Email: [email protected]
• Subject line for data requests: "Data Privacy Request — [Your Registered Username]"
• Subject line for complaints: "Privacy Complaint — [Your Registered Username]"
• Support hours: 24 hours a day, 7 days a week, 365 days a year
• Average live chat response time: 2–5 minutes
• Email response time: Within 24 hours

15.2 cb89 takes all privacy complaints seriously. Upon receipt of a complaint, cb89 will acknowledge receipt within 2 business days and aim to resolve the complaint within 30 days. If a complaint cannot be resolved within 30 days, you will be kept informed of progress and the expected resolution timeline.