Data Controller
cricbd operates the online casino and cricket betting platform available at cricbd.im (the "Platform"). For the purposes of applicable data protection law, cricbd is the data controller responsible for the personal data of all players and visitors who interact with the Platform. As data controller, cricbd determines the purposes and means by which personal data is processed and is accountable for ensuring that all processing activities comply with applicable data protection principles.
The Platform is designed and operated specifically for players based in Bangladesh. All data processing activities described in this Privacy Policy are carried out with Bangladeshi players in mind, using payment infrastructure (bKash, Nagad, Rocket, Upay, Visa, Mastercard) and communication channels appropriate to the Bangladeshi market. All customer-facing operations, including data rights enquiries, are handled in English on Bangladesh Standard Time (BST, UTC+6).
For any questions relating to this Privacy Policy or to how your personal data is handled, you may contact the cricbd data protection team at any time. Contact details are provided in Section 09 of this Policy. We aim to respond to all privacy-related enquiries within 2 business hours during operational hours.
Information We Collect
cricbd collects personal data through several distinct channels: information you provide directly during account registration and ongoing account management; information generated automatically through your use of the Platform; information received from payment providers when you make a deposit or withdrawal; and, where applicable, identity verification data provided in connection with our Know Your Customer (KYC) process.
The following table summarises the categories of personal data we collect, together with the typical source and the primary reason each category is collected:
| Data Category | Examples | Source | Primary Purpose |
|---|---|---|---|
| Identity Data | Full legal name, date of birth, NID / passport number | Provided by you at registration or KYC | Age verification, fraud prevention, AML compliance |
| Contact Data | Email address, mobile number, residential address | Provided by you at registration | Account management, support, security notifications |
| Financial Data | bKash/Nagad wallet reference, masked card number, transaction history | Payment provider; your transactions | Processing deposits and withdrawals, AML compliance |
| Technical Data | IP address, device type, browser type, OS version, session tokens | Collected automatically via Platform | Security, fraud detection, service optimisation |
| Usage Data | Pages visited, games played, bet history, session duration, click patterns | Collected automatically via Platform | Personalisation, responsible gaming monitoring, analytics |
| Communications Data | Support chat transcripts, email correspondence, feedback submissions | Provided by you when contacting support | Support resolution, quality assurance, dispute resolution |
| Preference Data | Deposit limits set, self-exclusion status, marketing opt-in status | Set by you via account dashboard | Responsible gaming compliance, marketing preferences |
cricbd does not knowingly collect personal data from individuals under 18 years of age. If we identify or receive credible information that a registered account belongs to an individual under 18, that account will be immediately suspended pending age verification, and any deposits will be returned in accordance with our Terms & Conditions. If you are a parent or guardian and believe a minor has registered on cricbd, please contact us immediately at [email protected].
How We Use Your Data
cricbd processes personal data only for specified, explicit, and legitimate purposes. We do not process your data in a manner incompatible with the purposes for which it was originally collected. The following list sets out the primary purposes for which we use the data described in Section 02, together with the legal basis that justifies each processing activity:
- Account creation and management: We use your identity and contact data to create and maintain your cricbd player account, verify your identity, and ensure that all account communications reach you reliably. Legal basis: performance of a contract.
- Payment processing: We share necessary financial data with our payment partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard) to process deposit and withdrawal transactions in BDT. Legal basis: performance of a contract.
- Age verification and KYC: We use identity data to confirm that you are 18 years of age or older and to satisfy our anti-money laundering obligations. Legal basis: legal obligation; legitimate interests.
- Security and fraud prevention: We use technical data and usage data to detect and prevent unauthorised access, suspicious betting patterns, account takeover attempts, and other fraudulent activity on the Platform. Legal basis: legitimate interests.
- Responsible gaming monitoring: We use usage data and preference data to identify patterns that may indicate problem gambling behaviour and to apply responsible gaming interventions where appropriate. Legal basis: legal obligation; legitimate interests.
- Customer support: We use communications data to respond to your enquiries, resolve disputes, and improve the quality of our support service. Legal basis: performance of a contract; legitimate interests.
- Platform improvement and analytics: We use aggregated and anonymised usage data to understand how players interact with the Platform, identify performance bottlenecks, and improve the overall product experience. Legal basis: legitimate interests.
- Marketing communications: Where you have opted in to receive promotional communications, we use your contact data and preference data to send you relevant offers, tournament notifications (BPL, T20 World Cup, Eid promotions), and bonus updates. Legal basis: consent. You may withdraw consent at any time by contacting [email protected].
- Legal and regulatory compliance: We may process any category of your personal data as necessary to comply with a legal obligation, respond to a regulatory enquiry, or cooperate with a law enforcement request made under applicable law. Legal basis: legal obligation.
Data Sharing & Disclosure
cricbd does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for each purpose:
- Payment service providers: When you make a deposit or request a withdrawal, we share the minimum necessary financial data with the relevant payment provider (bKash, Nagad, Rocket, Upay, Visa, Mastercard) to complete the transaction. These providers are contractually bound to process your data only for the purpose of facilitating the payment and in accordance with applicable data protection standards.
- Game technology providers: The casino games and betting markets on cricbd are powered by third-party studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive your player session token and stake data as part of the real-time game delivery infrastructure. No more personal data than is technically necessary is shared.
- Identity verification services: To satisfy KYC obligations, we may share identity documents and supporting data with specialist identity verification providers. These providers operate under strict confidentiality obligations and may not use your data for any purpose other than the verification task we have assigned.
- Analytics and infrastructure providers: We use trusted cloud infrastructure and analytics tools to operate and improve the Platform. These providers act as data processors on our behalf and may process technical and usage data solely under our documented instructions.
- Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law or by a valid legal order. In such cases, we disclose only the specific data required by the request and, where legally permitted, will notify the affected account holder.
- Business transfers: In the event of a merger, acquisition, or sale of all or part of the cricbd business, player data may be transferred to the acquiring entity as part of the transaction. Affected players will be notified via email in advance of any such transfer, and the acquiring entity will be required to honour the commitments in this Privacy Policy.
Cookies & Tracking
cricbd uses cookies and similar tracking technologies to operate the Platform, maintain your session, detect fraud, and understand how players navigate the site. A cookie is a small text file placed on your device by the Platform when you visit. Cookies do not contain executable code and cannot carry viruses or access other data stored on your device.
The Platform uses the following categories of cookies:
| Cookie Type | Purpose | Duration | Required? |
|---|---|---|---|
| Strictly Necessary | Maintain your login session, store language preference, enable security features | Session / up to 24 hours | Yes — cannot be disabled |
| Functional | Remember your deposit limit settings, preferred payment method, game history | Up to 90 days | No — opt-out available |
| Analytics | Measure page visits, session lengths, game engagement metrics (anonymised) | Up to 12 months | No — opt-out available |
| Security / Fraud | Fingerprint device to detect account takeover and multi-account registration attempts | Up to 30 days | Yes — required for platform integrity |
You may manage or disable non-essential cookies at any time through your browser settings. Please note that disabling functional or analytics cookies may affect your experience on the Platform — for example, your deposit limit preferences may not persist between sessions if functional cookies are disabled. Disabling strictly necessary or security cookies may prevent you from logging in or accessing game features altogether.
cricbd does not use third-party advertising cookies or cross-site tracking pixels. The Platform does not participate in behavioural advertising networks or remarketing programmes that track your activity across external websites.
Data Retention
cricbd retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory retention obligations, or to resolve disputes and enforce our agreements. The specific retention period applicable to each category of personal data depends on the nature of the data and the legal basis on which it was collected.
- Active account data: Identity, contact, and preference data is retained for the full duration of your account's active lifetime on the Platform.
- Financial transaction records: Records of all deposits, withdrawals, and game stakes are retained for a minimum of 7 years from the date of the transaction to satisfy financial record-keeping requirements under applicable anti-money laundering regulations.
- KYC and identity verification documents: Copies of identity documents submitted for KYC verification are retained for a minimum of 5 years from the date of account closure, or for the period required by applicable law if longer.
- Support communications: Email correspondence and chat transcripts are retained for up to 3 years from the date of the interaction, to support dispute resolution and quality assurance processes.
- Responsible gaming records: Records of self-exclusion requests, deposit limit settings, and cooling-off periods are retained for a minimum of 5 years from the date of account closure to prevent re-registration during an active exclusion period.
- Technical and usage data: Anonymised and aggregated analytics data is retained indefinitely. Identifiable technical data (such as IP address logs) is retained for up to 12 months and then permanently deleted or anonymised.
- Closed account data: Following voluntary account closure, identifiable personal data not subject to a mandatory retention obligation is deleted or fully anonymised within 90 days of the closure being confirmed.
At the end of the applicable retention period, personal data is securely deleted from all cricbd systems and from any third-party processor systems where it was stored on our behalf, unless further retention is required by law.
Data Security
cricbd takes the security of your personal data seriously and has implemented a layered set of technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. While no online platform can guarantee absolute security, the controls described below represent our commitment to maintaining a high standard of data protection for all Bangladeshi players.
- 256-bit SSL/TLS encryption: All data transmitted between your device and the cricbd Platform is encrypted using 256-bit Transport Layer Security (TLS). This applies to all pages of the Platform — not just login or payment screens — ensuring that your data is protected throughout your entire session.
- Encrypted data storage: Sensitive personal data stored in cricbd's systems — including identity documents, financial records, and password credentials — is encrypted at rest using industry-standard encryption protocols. Plain-text passwords are never stored on our systems.
- Access controls: Access to personal data held in cricbd's internal systems is restricted on a strict need-to-know basis. Staff who require access to personal data as part of their role must complete data protection training and are bound by confidentiality obligations.
- Fraud and intrusion detection: The Platform employs automated monitoring systems that flag anomalous login behaviour, unusual transaction patterns, and potential intrusion attempts in real time. Flagged events are reviewed by the security team within defined escalation timelines.
- Payment tokenisation: cricbd does not store full card numbers or mobile wallet credentials on its servers. Payment data is tokenised at source by the relevant payment provider, and cricbd retains only a reference token that cannot be used to initiate independent transactions.
- Incident response: In the event of a confirmed data security incident that poses a risk to your rights, cricbd will notify affected players via their registered email address without undue delay and will take all reasonable steps to contain the incident and prevent recurrence.
Your Privacy Rights
As a player on the cricbd Platform, you hold a number of rights with respect to the personal data we hold about you. These rights are exercisable by contacting the cricbd data protection team at [email protected]. We will respond to all rights requests within a reasonable timeframe and at no cost to you, unless a request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or decline to act on the request.
Request a copy of the personal data cricbd holds about you, including the categories processed and the purposes for which it is used.
Request correction of any inaccurate or incomplete personal data held on your account. You may update most contact details directly via your account settings.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Request that we restrict the processing of your data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.
Request a copy of personal data you have provided to cricbd in a commonly used, machine-readable format, where technically feasible.
Object to the processing of your personal data where it is carried out on the basis of legitimate interests, including processing for direct marketing purposes.
Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.
If you are unsatisfied with how we have handled your personal data, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction.
Please note that certain rights are subject to limitations where the data concerned is required to satisfy a legal obligation — for example, financial transaction records that must be retained for anti-money laundering purposes cannot be erased on request prior to the expiry of the mandatory retention period. In all such cases, cricbd will inform you of the applicable limitation and the expected retention end date.
Contact & DPO
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way cricbd handles your personal data, please reach out to our data protection team. All privacy-related enquiries are handled in English by staff operating on Bangladesh Standard Time (BST, UTC+6). We aim to acknowledge receipt of all enquiries within 24 hours and to provide a substantive response within 5 business days.
You may contact the cricbd data protection team at the following address:
Email: [email protected]
Subject line: Privacy Enquiry — [Your Account Username]
Operating hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6)
When submitting a privacy rights request, please include your registered account username, the email address associated with your account, and a clear description of the right you wish to exercise or the concern you wish to raise. We may ask you to verify your identity before processing any request that involves accessing, correcting, or deleting personal data, in order to ensure that your data is not disclosed to or acted upon by an unauthorised party.
cricbd reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing activities, changes in applicable law, or improvements to our security practices. When we make a material change to this Policy, we will notify registered players via their registered email address and update the "Last Updated" date at the top of this document. Continued use of the Platform following notification of a material change constitutes your acceptance of the revised Policy. We encourage you to review this Privacy Policy periodically to stay informed about how cricbd protects your personal data.
Six Ways cricbd Protects Your Data
Every page of the cricbd Platform is served over HTTPS with 256-bit SSL encryption. Your login credentials, payment details, and personal data are never transmitted in plain text — ever.
cricbd has a strict no-data-sales policy. Your personal information is never sold to data brokers, advertising networks, or any third party for commercial targeting — period. Your data belongs to you.
Full card numbers and mobile wallet credentials (bKash, Nagad) are never stored on cricbd servers. Payments are tokenised at source by our payment partners, keeping your financial data safe.
Access to player personal data within cricbd's systems is restricted on a strict need-to-know basis. All staff with data access are trained in data protection and bound by written confidentiality agreements.
You can request access to, correction of, or deletion of your personal data at any time. You can also withdraw marketing consent, request data portability, or object to specific processing — all free of charge.
In the event of a confirmed data security incident affecting your account, cricbd will notify you via your registered email without undue delay and will take immediate steps to contain the incident and prevent recurrence.