ceo86 Privacy Policy

1 Introduction & Scope

This Privacy Policy applies to all personal data collected, processed, stored, and transferred by ceo86 in connection with the operation of the ceo86.io online betting and gaming platform (the "Platform"). It applies to all users who visit the Platform, whether or not they have created a registered account, and to all data submitted through account registration, KYC verification, payment processing, customer support interactions, and general Platform use.

ceo86 operates as an English-language platform targeting the Bangladesh market. Players transact in Bangladeshi Taka (৳ BDT) using locally available payment methods including bKash, Nagad, Rocket, and Upay, as well as international card schemes. The Platform is designed for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21.

Throughout this policy, "personal data" refers to any information that identifies or could reasonably be used to identify a natural person — including name, date of birth, national identity number, mobile phone number, email address, payment account details, IP address, and device identifiers. "Processing" refers to any operation performed on personal data, including collection, storage, use, sharing, and deletion.

2 Data We Collect

ceo86 collects personal data across several categories depending on the nature of your interaction with the Platform. The following table summarises the main categories of data collected and specific examples within each category:

We do not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If any additional categories of data are required in future, this policy will be updated accordingly and players notified.

3 How We Collect Data

ceo86 collects personal data through the following channels and mechanisms:

• Direct Submission: Information you actively provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or updating your account profile.
• Automated Technical Collection: When you visit or interact with ceo86.io, our servers automatically log technical data such as your IP address, browser type, device identifiers, pages accessed, and session duration. This collection is automatic and occurs even during anonymous browsing prior to registration.
• Cookies & Tracking Technologies: ceo86 uses first-party cookies and similar tracking technologies to maintain session state, remember your login status, personalise your Platform experience, and collect aggregate analytics data. See Section 7 for full cookie details.
• Payment Providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the relevant payment provider may share limited transaction confirmation data with ceo86 to verify the payment. ceo86 does not receive your full payment credentials from these providers.
• Identity Verification Partners: For KYC compliance purposes, ceo86 may engage third-party identity verification service providers who process your submitted identity documents on our behalf. These providers are bound by strict data processing agreements and may not use your data for any other purpose.

4 How We Use Your Data

ceo86 uses the personal data we collect for the following clearly defined purposes:

• Account Operation: To create and maintain your registered account, authenticate your login sessions, and provide access to all Platform features including sports betting, live casino, and slot games.
• Transaction Processing: To process your ৳ BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay, card schemes, and bank transfer, and to maintain an accurate transaction history in your wallet.
• Identity & Age Verification (KYC): To verify that you are a real person, that you are at least 21 years of age, and that the payment methods associated with your account belong to you. KYC verification is required before ceo86 processes any withdrawal request.
• Legal & Regulatory Compliance: To comply with applicable anti-money laundering (AML) obligations, to respond to lawful requests from regulatory or law enforcement authorities, and to maintain records required under applicable law.
• Fraud Prevention & Platform Security: To detect and prevent fraudulent activity, multiple-account creation, collusion, match-fixing, automated betting abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible Gaming Monitoring: To identify behavioural patterns that may indicate problem gambling and, where appropriate, to trigger responsible gaming interventions such as contact from our support team, imposition of temporary deposit limits, or referral to self-exclusion tools.
• Customer Support: To respond to your queries, complaints, and requests submitted via live chat or email, and to maintain records of past interactions for quality assurance and dispute resolution purposes.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve Platform performance, game selection, betting market offerings, and the overall user experience for players in the Bangladesh market.
• Marketing Communications (Opt-In Only): To send you promotional offers, bonus notifications, and information about new Platform features — but only if you have explicitly opted in to receiving such communications during registration or subsequently via your account settings. You may withdraw marketing consent at any time.

5 Legal Basis for Processing

ceo86 processes your personal data only where a valid legal basis exists for that processing. The primary legal bases upon which ceo86 relies are as follows:

• Contractual Necessity: Processing your identity data, contact data, and financial data is necessary for ceo86 to perform its contractual obligations to you under the Terms & Conditions — including creating your account, accepting bets, and processing payments.
• Legal Obligation: Processing required for KYC verification, AML compliance, transaction record-keeping, and responses to lawful authority requests is carried out to fulfil ceo86's legal obligations under applicable law.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and platform performance analytics is based on ceo86's legitimate interest in operating a safe, fair, and reliable platform — provided such processing does not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out only where you have provided your explicit, informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing & Disclosure

ceo86 does not sell, rent, or trade your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Processing Partners: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking institutions receive transaction reference data necessary to execute your deposit and withdrawal instructions. These providers operate under their own privacy frameworks and are not permitted to use data shared by ceo86 for any other purpose.
• Identity Verification Providers: Third-party KYC service providers process identity documents submitted by players to verify age and identity on ceo86's behalf. These providers are bound by data processing agreements that restrict their use of your data to KYC purposes only.
• Game Content Providers: Providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive a session token and anonymous player identifier to facilitate delivery of their game content within the ceo86 platform. These providers do not receive your name, NID, or financial data.
• Legal & Regulatory Authorities: ceo86 will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by a lawful order, or where disclosure is necessary to prevent or investigate suspected criminal activity including money laundering or fraud.
• Business Transfers: In the event that ceo86 undergoes a merger, acquisition, or transfer of assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material change to data processing practices that results from it.

7 Cookies & Tracking Technologies

ceo86 uses cookies and similar tracking technologies on the Platform to deliver core functionality, maintain session security, and improve your experience. The following categories of cookies are in use:

Most web browsers allow you to control cookies through the browser settings. Disabling strictly necessary cookies will affect your ability to log in to and use the Platform. Disabling functional or analytics cookies will not prevent you from accessing any core Platform feature but may reduce personalisation of your experience.

8 Data Retention

ceo86 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply as a general guide:

• Account Data (active accounts): Retained for the duration of your account's active life on the Platform.
• Account Data (closed accounts): Retained for a minimum of five years following account closure to meet AML record-keeping requirements and to handle any post-closure disputes or regulatory enquiries.
• KYC Verification Documents: Retained for a minimum of five years following account closure, or longer where required by applicable law.
• Transaction Records: All deposit and withdrawal records are retained for a minimum of five years to comply with financial record-keeping obligations.
• Customer Support Records: Live chat transcripts and support tickets are retained for three years following closure of the relevant support interaction.
• Technical Logs (IP addresses, session logs): Retained for 12 months from the date of collection, unless a longer retention period is required for an ongoing security or fraud investigation.
• Marketing Consent Records: Retained for the duration of your account's active life, plus three years following account closure, to demonstrate compliance with consent obligations.

When personal data is no longer required under the applicable retention period, it is securely deleted or permanently anonymised so that it can no longer be associated with an identifiable individual.

9 Data Security

ceo86 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the ceo86 servers is protected by industry-standard SSL/TLS encryption, ensuring that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Encrypted Data Storage: Personal data and KYC documents stored on ceo86's servers are encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data.
• Access Controls: Access to personal data within ceo86's systems is restricted to authorised staff who require access to perform their specific job function. Access rights are reviewed regularly and revoked immediately upon change of role or departure from the organisation.
• Two-Factor Authentication: ceo86 strongly recommends enabling two-step verification on your player account as an additional layer of login security. Internal staff accounts with access to player data require mandatory two-factor authentication.
• Regular Security Audits: ceo86 conducts periodic security reviews of its platform infrastructure, access controls, and data handling procedures. Identified vulnerabilities are remediated on a priority basis.
• Incident Response: In the event of a data security incident that poses a risk to your personal data, ceo86 will notify affected players without undue delay and take all reasonable steps to contain and remediate the incident.

10 Your Privacy Rights

As a registered player on ceo86, you hold the following rights in relation to your personal data. To exercise any of these rights, contact ceo86 customer support via live chat or email. Requests will be acknowledged within 48 hours and responded to within 30 calendar days.

Please note that certain rights — particularly the right to erasure — may be limited where ceo86 has a legal obligation to retain your data (for example, under AML record-keeping requirements). In such cases, ceo86 will clearly explain the basis for the limitation when responding to your request.

11 Children & Minors

If you believe that a minor has registered an account on ceo86 using false information, please contact our customer support team immediately at [email protected]. We treat all reports of underage accounts with the highest priority and will investigate and act swiftly upon receipt of any cred ible report.

12 Third-Party Links

The ceo86 Platform may display the names or logos of third-party game providers, payment partners, and sports leagues for informational and promotional purposes. Where the Platform contains any reference to external organisations, ceo86 is not responsible for the privacy practices of those organisations.

If you navigate away from ceo86.io to any third-party website — for example, by following a link in a support email or accessing a payment provider's own platform to verify a transaction — your activity on that third-party website is governed entirely by that website's own privacy policy. ceo86 has no control over, and accepts no responsibility for, the data practices of any third-party website or service that is not operated by ceo86.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your ceo86 account, including your mobile banking provider (bKash, Nagad, Rocket, Upay) and any card-issuing bank.

13 Policy Updates

ceo86 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the features and services available on the Platform. The effective date shown at the top of this page will always reflect the date on which the current version came into force.

When we make material changes to this Privacy Policy — meaning changes that significantly affect your rights or the way we process your personal data — we will notify registered players via the email address associated with their account at least 14 days before the updated policy takes effect. Continued use of the Platform after the effective date of an updated policy constitutes your acceptance of the revised terms.

We recommend reviewing this Privacy Policy periodically to stay informed of how ceo86 protects your personal data. Archived versions of previous policies are available upon request by contacting our customer support team.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data ceo86 holds about you, please contact our Data Protection team through any of the following channels:

• Live Chat: Available 24/7 directly on the ceo86.io Platform. Average response time: 2–5 minutes.
• Email: [email protected] — please include "Privacy Request" in the subject line for fastest routing to the appropriate team member.
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6).

All privacy-related requests and complaints are handled with strict confidentiality. ceo86 aims to acknowledge all requests within 48 hours and to provide a full written response within 30 calendar days of receipt. Where a request is complex or involves a high volume of data, we will notify you within the initial 30-day period if an extension of up to a further 60 days is required.