Privacy Policy — How cg22 Protects Your Personal Data

This Privacy Policy ("Policy") is published by cg22 ("cg22", "we", "us", "our"), the operator of the online casino and cricket betting platform accessible at cg22.io. This Policy applies to all registered players, prospective players, visitors, and any other individuals whose personal data is processed by cg22 in connection with the operation of the platform.

cg22 is committed to handling all personal data with the highest standards of care, transparency, and security. We recognise that our players — across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and every corner of Bangladesh — entrust us with sensitive personal and financial information, and we take that responsibility seriously.

This Policy explains:

• What categories of personal data cg22 collects from you.
• How and why that data is collected and processed.
• Who we may share your data with, and under what conditions.
• How long we retain your data and how we keep it secure.
• What rights you hold over your personal data and how to exercise them.

By registering an account on cg22, accessing the platform, or submitting any personal information to us, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not register an account or continue to use the cg22 platform.

cg22 collects only the personal data that is genuinely necessary for the purposes described in this Policy. The categories of personal data we collect are set out in the table below.

We do not intentionally collect special category data (such as health information, racial or ethnic origin, political opinions, or religious beliefs) from players. If any such data is incidentally disclosed in support communications, it will not be recorded or used for any processing purpose.

cg22 collects personal data through the following channels:

• Directly from you: When you register an account, complete a KYC submission, make a deposit or withdrawal request, contact our support team, or respond to a survey or promotional communication.
• Automatically: When you access or use the cg22 platform, our servers and analytics tools automatically collect Technical Data including your IP address, device identifiers, browser fingerprint, and session activity logs. This collection is necessary for platform security, fraud detection, and performance monitoring.
• From payment providers: When you process a transaction via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment provider shares transaction confirmation data with cg22 to enable deposit crediting and withdrawal processing. The data shared is limited to what is necessary to verify and complete the transaction.
• From KYC verification partners: When your identity documents are submitted for verification, our accredited KYC provider returns a verification status (verified, pending, or rejected) and, where applicable, a reference number. cg22 does not receive raw document images from the KYC provider beyond what is necessary for record-keeping obligations.
• From game providers: Certified game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) share session and game-round data with cg22 to enable accurate settlement of game outcomes, bonus wagering calculations, and responsible gaming monitoring.
• From cookies and tracking technologies: As described in Section 9 of this Policy, cg22 uses cookies, local storage, and similar technologies to collect Technical Data and session data for the purposes of platform functionality, security, and analytics.

cg22 processes your personal data for the following specific, explicit, and legitimate purposes:

• Account registration and management: To create, maintain, and administer your cg22 player account, including processing your login credentials, account preferences, and responsible gaming settings.
• Identity verification (KYC): To verify your identity and age in compliance with our minimum age policy (21+) and to prevent fraud, money laundering, and the use of the platform by ineligible individuals.
• Payment processing: To process your deposit and withdrawal requests via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank, and to maintain accurate financial records of all transactions conducted on your account.
• Game and betting services: To provide, operate, and settle casino games and cricket betting markets, to calculate bonus wagering contributions, and to maintain a complete and accurate history of your gaming activity.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, account compromise, money laundering, unauthorised access, and any other conduct that violates our Terms & Conditions.
• Customer support: To respond to your enquiries, manage support tickets and live chat interactions, resolve complaints, and provide assistance with account, payment, and game-related issues.
• Responsible gaming: To administer deposit limits, loss limits, session time limits, and self-exclusion tools, and to monitor gaming behaviour for indicators that may suggest a player requires responsible gaming intervention. Full details are available on our Responsible Gaming page.
• Legal and regulatory compliance: To maintain records required for the purposes of anti-money laundering compliance, to respond to lawful requests from competent authorities, and to enforce our Terms & Conditions.
• Direct marketing (with consent only): To send you promotional emails, SMS notifications, and in-platform messages about bonuses, new games, and seasonal offers — only where you have provided explicit consent to receive such communications. You may withdraw this consent at any time.
• Platform analytics and improvement: To analyse aggregated usage data in order to understand how players interact with the cg22 platform, identify areas for improvement, and develop new features and game categories.

cg22 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform our contractual obligations to you as a registered player — including account management, payment processing, and the provision of gaming services — is carried out on the basis of contractual necessity. Without this processing, cg22 would be unable to provide the services you have requested.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, technical data collection for platform operation, and anonymous analytics is carried out on the basis of cg22's legitimate business interests. In each case, we have assessed that our legitimate interests are not overridden by your rights and interests as a data subject.
• Legal obligation: Processing required for anti-money laundering record-keeping, identity verification, and responses to lawful authority requests is carried out on the basis of compliance with applicable legal obligations.
• Consent: Processing for direct marketing communications (email, SMS, in-platform messages) and the use of non-essential cookies is carried out on the basis of your explicit, freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

cg22 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. We share personal data only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, and Sonali Bank receive only the transactional data required to process your deposit or withdrawal. Each payment partner operates under its own privacy policy and applicable regulatory framework.
• KYC and identity verification providers: Accredited third-party KYC partners receive copies of identity documents you submit for verification. These partners are contractually bound to process your documents solely for verification purposes and to maintain appropriate security standards.
• Certified game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified providers receive session tokens and player identifiers necessary to serve game content and return accurate game-round results for settlement. These providers do not receive your full identity or financial data.
• Technology and hosting providers: Third-party cloud hosting and infrastructure providers who process data on our behalf under data processing agreements that impose confidentiality and security obligations equivalent to those in this Policy.
• Legal and regulatory authorities: Where required by applicable law or a binding order from a competent authority, cg22 will disclose the minimum personal data necessary to satisfy the legal obligation. Where permitted by law, we will notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of cg22's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer before it takes effect.

cg22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any individual player. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data.

cg22 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security programme includes the following measures:

• Encryption in transit: All data exchanged between your device and the cg22 platform is encrypted using TLS 1.2 or higher (256-bit SSL). Our platform does not permit unencrypted HTTP connections.
• Encryption at rest: All personal data stored on cg22 servers is encrypted at rest using AES-256 encryption. This includes account data, financial records, KYC documents, and gaming history.
• Access controls: Access to personal data is restricted to authorised cg22 personnel whose role requires access. All access events are logged and subject to periodic audit. Privileged access is protected by multi-factor authentication.
• Password security: Player account passwords are never stored in plain text. They are hashed using industry-standard one-way cryptographic hashing algorithms (bcrypt or equivalent) before storage.
• Fraud detection systems: cg22 operates automated fraud detection and anomaly detection systems that monitor account activity in real time to identify suspicious patterns and prevent unauthorised access.
• Penetration testing: cg22 conducts periodic security assessments and penetration tests of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach that poses a risk to your rights and interests, cg22 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

While cg22 employs robust security measures, no online platform can provide an absolute guarantee of security. You are responsible for maintaining the confidentiality of your account credentials and for notifying cg22 immediately at [email protected] if you suspect any unauthorised access to your account.

The cg22 platform uses cookies, local storage, and similar tracking technologies to enable core platform functionality, maintain your session state, detect fraud, and — where you have provided consent — to deliver relevant promotional content and gather analytics data.

The following categories of cookies are used on cg22:

• Strictly necessary cookies: These cookies are essential for the cg22 platform to function correctly. They manage your login session, remember your language and currency preferences, maintain your game session state, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without disrupting platform functionality.
• Performance and analytics cookies: These cookies collect anonymised information about how players use the cg22 platform — such as which pages are visited most frequently and where players encounter errors — to help us improve the platform. These cookies are only set with your consent.
• Functional cookies: These cookies remember your account preferences and personalisation settings between sessions, such as your preferred game category and responsible gaming settings. They enhance your experience but are not strictly required for core functionality.
• Marketing cookies: These cookies track your engagement with cg22 promotional communications and in-platform bonus offers. They are only used where you have provided explicit consent for marketing communications. They are never used to build profiles for third-party advertising purposes.

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to view, block, and delete cookies. Please note that blocking strictly necessary cookies will impair your ability to use the cg22 platform. For full details on specific cookies in use, please contact us at [email protected].

As a cg22 player, you hold the following rights in respect of your personal data. You may exercise any of these rights at any time by contacting us at [email protected], clearly identifying yourself and the right you wish to exercise. cg22 will respond to all valid rights requests within 30 calendar days.

Please note that certain rights are subject to limitations where cg22 is required to retain or process your data to comply with a legal obligation (such as AML record-keeping requirements) or to exercise or defend a legal claim. Where a limitation applies, cg22 will inform you of this clearly when responding to your request.

Self-exclusion records are a specific category of data that cannot be deleted upon request, as their retention is a fundamental player protection measure. Deleting a self-exclusion record could expose you to harm; accordingly, this data is permanently retained regardless of erasure requests.

The cg22 platform is strictly intended for use by individuals who are at least 21 years of age. cg22 does not knowingly collect or process personal data from individuals under the age of 21. Our registration process includes age verification steps, and accounts suspected of being held by underage individuals are subject to immediate suspension and KYC review.

If you are a parent or guardian and believe that a person under the age of 21 has registered an account on cg22 using false age information, please contact us immediately at [email protected]. We will investigate the matter promptly and, where an underage account is confirmed, will close the account and delete all associated personal data, subject to any data we are legally required to retain for fraud prevention or AML purposes.

cg22 reserves the right to update, amend, or replace this Privacy Policy at any time. Any changes will take effect from the date the revised Policy is published on the cg22 platform. The "last reviewed" date at the top of this document will be updated to reflect the date of the most recent revision.

Where a proposed change materially affects your rights or the way in which cg22 processes your personal data, we will provide you with reasonable advance notice of the change — typically no less than 14 calendar days — by email to the address registered on your account and by a prominent notice on the cg22 platform. Your continued use of the platform after the effective date of a revised Policy constitutes your acceptance of the changes.

If you do not accept a material change to this Policy, you must cease using the cg22 platform and may request closure of your account by contacting us at [email protected]. Account closure requests will be processed in accordance with our Terms & Conditions.

We recommend that you review this Privacy Policy periodically to stay informed of how cg22 is protecting your personal data. Previous versions of this Policy are available on request.

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data subject rights as described in Section 10, please contact the cg22 Data Privacy team using the details below. All enquiries will be acknowledged within 2 business days and resolved within 30 calendar days.

When submitting a data subject rights request, please include your full name, your cg22 account username, the email address registered on your account, a clear description of the right you wish to exercise, and any supporting information that will help us locate and verify your account. We may be required to verify your identity before processing a rights request.

If you are not satisfied with our response to your privacy enquiry, or if you believe cg22 is processing your personal data in a manner that is inconsistent with this Policy, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction.