Privacy Policy — ceobat Platform

1. Information We Collect

When you use the ceobat platform, we collect personal data in several ways: information you provide directly to us, information generated automatically through your use of the platform, and information we receive from trusted third-party partners. The categories of data we collect are described in detail below.

1.1 Information You Provide Directly

When you register a ceobat account, make a deposit, contact support, or respond to a promotional offer, you may provide us with the following categories of personal data:

Data Category	Examples	Collected At
Identity Data	Full legal name, date of birth, national ID (NID) number, passport number	Registration and KYC verification
Contact Data	Mobile number (bKash/Nagad registered), email address, city of residence (e.g., Dhaka, Chittagong, Sylhet)	Registration and account updates
Financial Data	bKash account number, Nagad number, Rocket number, Upay number, bank account details, transaction history	Deposits, withdrawals, and payment verification
Verification Documents	Scanned NID, passport photo page, utility bill, bank statement, selfie with ID	KYC and fraud prevention
Communications Data	Live chat transcripts, support emails, feedback form submissions	Customer support interactions

1.2 Information Collected Automatically

When you access the ceobat platform, our servers and analytics systems automatically collect certain technical and behavioural data. This includes:

• Your IP address and approximate geographic location derived from it.
• Device type, operating system, browser type and version.
• Pages viewed on the ceobat website, time spent on each page, and navigation paths.
• Game sessions initiated, wagers placed, game outcomes, and session durations.
• Referral source (how you arrived at ceobat, e.g., direct URL entry, search engine, or a specific marketing campaign).
• Login timestamps and session activity logs.

1.3 Information From Third Parties

ceobat may receive personal data about you from the following categories of third parties, where you have authorised such sharing or where we have a legitimate business reason to receive it:

• Payment providers such as bKash, Nagad, Rocket, and Upay, who confirm the status and ownership of payment accounts used on the ceobat platform.
• Identity verification and KYC service providers who help us verify the authenticity of identity documents submitted during the verification process.
• Responsible gaming organisations and self-exclusion registries, if you have registered a self-exclusion request that applies across multiple gambling platforms.
• Fraud detection and anti-money laundering (AML) partners who may flag accounts or transactions associated with suspicious activity.

2. How We Use Your Data

ceobat uses the personal data we collect for clearly defined purposes, each grounded in a specific legal basis. We do not sell your personal data to third parties for their own marketing purposes under any circumstances. The table below summarises the primary purposes for which we process your data and the legal basis for each.

Purpose	Legal Basis
Creating and managing your ceobat account	Performance of contract
Processing deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, and bank transfer	Performance of contract
Verifying your identity and age (KYC) to comply with responsible gaming obligations	Legal obligation and legitimate interest
Detecting and preventing fraud, money laundering, and prohibited conduct	Legal obligation and legitimate interest
Providing customer support via live chat and email	Performance of contract and legitimate interest
Sending you transactional communications (deposit confirmations, withdrawal notifications, account security alerts)	Performance of contract
Sending you promotional communications about ceobat bonuses, new games, cricket betting markets, and seasonal offers (e.g., BPL season, Eid promotions)	Consent (you may withdraw consent at any time)
Analysing platform usage to improve ceobat's games, features, and user experience	Legitimate interest
Enforcing the ceobat Terms & Conditions and this Privacy Policy	Legitimate interest and legal obligation
Complying with applicable law, regulatory requirements, and court orders	Legal obligation

2.1 Marketing Communications

If you have consented to receive marketing communications from ceobat, we may contact you by email or mobile number with information about new games, deposit bonus offers, cricket and BPL betting promotions, seasonal events such as Pohela Boishakh or Eid, and platform updates. You can withdraw your consent and opt out of marketing communications at any time by contacting our support team or using the unsubscribe option included in any marketing message. Opting out of marketing does not affect your ability to use the ceobat platform or receive transactional messages.

2.2 Automated Decision-Making

ceobat may use automated systems to make certain decisions that affect your account. These include automated fraud detection systems that may flag or temporarily restrict accounts based on unusual transaction patterns, and automated responsible gaming tools that may impose temporary limits based on your account activity. Where an automated decision results in a material impact on your account — such as a withdrawal hold or account suspension — you have the right to request human review of that decision by contacting our support team.

3. Cookies and Tracking Technologies

The ceobat website uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. A cookie is a small text file stored on your device when you visit a website. Cookies allow the website to remember your preferences, keep your session active, and collect analytics data about how the platform is used.

3.1 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the ceobat platform to function. They maintain your login session, remember your language and display preferences, and protect the platform against cross-site request forgery attacks. You cannot opt out of strictly necessary cookies without disabling the functionality they support.
• Analytics Cookies: We use analytics cookies to understand how players navigate the ceobat website — which pages they visit most, how long they spend on each section, and where they encounter difficulty. This data is aggregated and anonymised and helps us improve the ceobat experience for all Bangladesh players.
• Functional Cookies: Functional cookies remember your preferences such as your preferred deposit method (e.g., bKash vs. Nagad) and your recently played games, so you can pick up where you left off without having to reconfigure your settings on each visit.
• Marketing Cookies: Where you have consented, we may use marketing cookies to measure the effectiveness of our promotional campaigns and to deliver relevant ceobat offers across partner sites. These cookies do not share your personal data with unrelated third parties.

3.2 Managing Your Cookie Preferences

You can control cookie settings through your browser. Most browsers allow you to view, block, and delete cookies via their settings menu. Please note that blocking strictly necessary cookies will impair the functionality of the ceobat platform and may prevent you from logging in or completing transactions. For analytics and marketing cookies, you can also withdraw consent by contacting the ceobat support team.

4. Data Sharing and Third Parties

ceobat does not sell, rent, or trade your personal data to third parties for their own commercial purposes. However, in order to deliver our services, comply with legal obligations, and maintain the security of the platform, we share personal data with a limited set of trusted third parties in the following categories:

4.1 Payment Processors

To process deposits and withdrawals, ceobat shares necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Visa, and Mastercard. The data shared is limited to what is strictly necessary to complete the transaction — typically your account identifier and the transaction amount. These providers operate under their own privacy policies and are independently responsible for their data practices.

4.2 Identity Verification Partners

ceobat works with licensed KYC and identity verification service providers to validate the identity documents you submit during the account verification process. These partners receive your identity data solely for the purpose of verification and are contractually prohibited from using it for any other purpose.

4.3 Game Providers

When you launch a game supplied by a third-party provider such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, limited technical data — including your session identifier and stake information — is shared with that provider to facilitate the game session. This data sharing is governed by our data processing agreements with each provider.

4.4 Legal and Regulatory Disclosure

ceobat may disclose your personal data to law enforcement authorities, regulatory bodies, courts, or other government agencies where we are legally required to do so, or where disclosure is necessary to prevent fraud, protect the safety of our users, or enforce our Terms & Conditions. We will disclose only the minimum data necessary for the specific legal or regulatory purpose.

4.5 Business Transfers

In the event that ceobat undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity as part of that transaction. In such cases, ceobat will take reasonable steps to ensure that your data continues to be protected in a manner consistent with this Privacy Policy, and we will notify affected players of any material change to data handling practices arising from such a transfer.

5. Data Security and Retention

ceobat takes the security of your personal data seriously. We implement a layered security architecture designed to protect your data against unauthorised access, disclosure, alteration, and destruction.

5.1 Security Measures

The technical and organisational security measures ceobat employs include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the ceobat platform.
• AES-256 encryption for sensitive data stored on ceobat servers, including payment details and identity document scans.
• Role-based access controls ensuring that ceobat employees can only access the data necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Two-factor authentication (2FA) options available to all registered ceobat players.
• Automated monitoring systems that detect and alert on unusual login patterns or data access anomalies.
• Secure, encrypted backup storage with defined recovery procedures.

5.2 Data Retention Periods

ceobat retains your personal data for different periods depending on the category of data and the purpose for which it was collected. Our general retention framework is as follows:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years after closure	Legal obligation and dispute resolution
Financial transaction records	7 years from date of transaction	AML compliance and legal obligation
KYC and identity documents	5 years from account closure	Regulatory compliance
Customer support communications	3 years from last interaction	Quality assurance and dispute resolution
Marketing consent records	Until consent is withdrawn + 1 year	Demonstrating consent compliance
Platform analytics data	24 months (anonymised after 12 months)	Platform improvement

Upon expiry of the applicable retention period, ceobat will securely delete or irreversibly anonymise your personal data so that it can no longer be associated with you as an individual.

6. Your Privacy Rights

As a ceobat player, you hold a set of rights regarding the personal data we hold about you. These rights are described below along with guidance on how to exercise them.

6.1 Right of Access

You have the right to request a copy of the personal data ceobat holds about you. Upon receipt of a verified access request, ceobat will provide you with a summary of the data categories we hold, the purposes for which they are processed, and — where applicable — the third parties with whom your data has been shared.

6.2 Right to Rectification

If any personal data ceobat holds about you is inaccurate or incomplete, you have the right to request that we correct it. You can update most account details directly through your ceobat account settings. For changes to identity data (such as your legal name or date of birth as recorded on your NID), please contact support and provide the relevant supporting documentation.

6.3 Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been processed unlawfully. Please note that ceobat may be required to retain certain data for legal or regulatory reasons even following an erasure request — for example, transaction records required for AML compliance. In such cases, ceobat will inform you of the data that must be retained and the reason for its retention.

6.4 Right to Restrict Processing

You have the right to ask ceobat to restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or where you have objected to processing based on legitimate interest and that objection is under review.

6.5 Right to Withdraw Consent

Where ceobat processes your data on the basis of your consent — most commonly for marketing communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal. To withdraw consent for marketing, contact our support team or use the unsubscribe option in any marketing email.

6.6 How to Exercise Your Rights

To exercise any of the rights described above, please contact the ceobat data team at [email protected]. Please include your registered account username and a description of your request. ceobat will verify your identity before processing any data request to prevent unauthorised disclosure. We aim to respond to all data rights requests within 30 calendar days. If the request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you.

7. Minors and Privacy Protection

The ceobat platform is strictly for adults aged 18 and above. ceobat does not knowingly collect, process, or store personal data belonging to individuals under the age of 18. Age verification is a mandatory step in the ceobat registration process, and all accounts are subject to further age confirmation during KYC verification.

If ceobat discovers or has reasonable grounds to believe that a registered account belongs to a person under 18 years of age, we will immediately suspend that account, delete any personal data associated with it, and — where applicable — refund any deposits made while the account was active. Winnings accumulated by an underage player will not be paid out.

If you are a parent or guardian and believe that your child has registered a ceobat account or has accessed the ceobat platform without your knowledge, please contact our support team immediately at [email protected]. We will investigate promptly and take all necessary steps to protect the child's data and close the account. ceobat strongly encourages parents and guardians to make use of parental control software and to have open conversations with young people about the risks of gambling.

8. Changes to This Policy

ceobat reserves the right to update or revise this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes in our data processing practices, new services or features added to the ceobat platform, or feedback received from our players in Bangladesh and elsewhere.

When we make material changes to this Privacy Policy, we will update the "Last Updated" date shown at the top of this page and — where the changes significantly affect your rights — notify registered ceobat players by email or via a notice on the platform. We encourage you to review this Privacy Policy periodically to stay informed about how ceobat protects your personal data.

Your continued use of the ceobat platform following the posting of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the revised policy, you must cease using the ceobat platform and, if you wish, request closure of your account by contacting our support team.