ca44 Privacy Policy – How We Collect, Use, and Protect Your Personal Data

1 Introduction & Scope

This Privacy Policy ("Policy") is published by ca44 ("ca44", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "the Player") who access or use the ca44 website at https://ca44.io, the ca44 mobile-optimised interface, any associated applications, and all services, features, products, and communications provided under the ca44 brand.

ca44 acts as the data controller in respect of the personal data processed under this Policy. As data controller, ca44 determines the purposes and means of processing your personal data and is responsible for ensuring that processing activities are carried out lawfully, fairly, and transparently.

This Policy applies to all players regardless of their geographic location, but is specifically designed with players based in Bangladesh in mind, given that Bangladesh is ca44's primary target market. Where differences in applicable data protection standards are relevant, ca44 applies the higher standard of protection.

This Policy should be read alongside the ca44 Terms & Conditions, which are incorporated by reference. Capitalised terms used but not defined in this Policy have the meanings given to them in the Terms & Conditions.

2 Personal Data We Collect

ca44 collects the following categories of personal data in connection with the registration, operation, and maintenance of player accounts and the delivery of gaming and betting services:

• Identity Data: Full legal name, date of birth, gender (where provided), government-issued identification number, passport number or national identity card details, and any other information submitted during the KYC verification process.
• Contact Data: Email address, mobile phone number, residential address (including city, district, and postcode), and preferred communication channel.
• Financial Data: Payment method identifiers (such as bKash or Nagad mobile account references), masked card numbers (last four digits only), bank account references where applicable, deposit and withdrawal history, and account balance information.
• Technical Data: IP address, device identifier, browser type and version, operating system, screen resolution, time zone setting, referring URL, and session authentication tokens.
• Usage Data: Records of games played, bets placed, wager amounts, game outcomes, session start and end times, platform features accessed, and responsible gaming tool activations (such as deposit limit settings and self-exclusion requests).
• Marketing & Preference Data: Communication preferences, opted-in or opted-out marketing channels, and records of promotional offers claimed.
• Support & Correspondence Data: Records of all communications with ca44 support, including live chat transcripts, email correspondence, and formal complaint records.
• Verification Document Data: Scanned or photographed copies of identity documents, proof of address documents, and proof of payment method ownership submitted during the KYC process. These are handled with the highest level of security and access restriction.

3 How We Collect Your Data

ca44 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when registering an account, completing the KYC verification process, making deposits or withdrawals, contacting our support team, or responding to surveys and promotions.
• Automated Technical Collection: Data collected automatically when you access or interact with the ca44 platform, including through cookies, web beacons, server logs, and similar tracking technologies as described in Section 8 of this Policy.
• Third-Party Identity Verification Providers: Data received from identity verification and KYC service providers used by ca44 to confirm your identity, age, and address as required by our compliance obligations.
• Payment Processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, Visa, Mastercard, and DBBL in connection with deposit and withdrawal processing.
• Fraud Prevention and AML Screening Services: Data received from third-party fraud screening, anti-money laundering, and sanctions list checking providers used to protect the integrity of the platform and comply with applicable financial crime prevention obligations.
• Game Providers: Aggregated or session-level game data received from third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi in connection with gameplay activity on the ca44 platform.

4 How We Use Your Personal Data

ca44 uses the personal data it collects for the following purposes:

• Account Management: To register and maintain your ca44 player account, authenticate your identity at login, manage your preferences, and communicate account-related information including security alerts, balance notifications, and policy updates.
• Identity and Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity as required by our KYC and compliance obligations. This includes verifying documents submitted during registration and at any subsequent verification stage.
• Payment Processing: To process deposits and withdrawals via your chosen payment method, to reconcile transactions, and to apply the same-method withdrawal rule in accordance with our Terms & Conditions.
• Legal and Regulatory Compliance: To fulfil our legal and regulatory obligations, including anti-money laundering (AML) screening, sanctions list checking, suspicious transaction reporting, and the maintenance of records required by applicable law.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, to apply deposit limits, session reminders, cooling-off periods, and self-exclusion measures as requested by players or as required under our responsible gaming obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, bonus abuse, money laundering, and other prohibited conduct on the platform.
• Platform Improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall quality and performance of the ca44 platform for all players.
• Marketing Communications: Where you have provided consent, to send you personalised promotional offers, bonus notifications, event-based promotions (such as BPL season or Eid offers), and other marketing communications via your preferred channel. You may withdraw consent at any time.
• Customer Support: To respond to your enquiries, process complaints, and maintain records of support interactions for quality assurance and audit purposes.

5 Legal Bases for Processing

ca44 processes personal data only where a valid lawful basis exists. The lawful bases on which ca44 relies are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between ca44 and the player — including account registration, payment processing, game delivery, and withdrawal processing.
• Legal Obligation: Processing that is required to comply with applicable legal and regulatory requirements, including AML obligations, KYC requirements, age verification mandates, and data retention obligations imposed by law.
• Legitimate Interests: Processing carried out for ca44's legitimate business interests, including fraud detection, platform security, technical performance monitoring, and internal analytics, provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily in the context of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing & Disclosure

ca44 does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial purposes. ca44 shares personal data with third parties only in the following limited and controlled circumstances:

• Payment Processors: ca44 shares necessary transaction data with bKash, Nagad, Rocket, Upay, Visa, Mastercard, and DBBL to facilitate deposit and withdrawal processing. Each payment processor operates under its own privacy policy and data security standards.
• Identity Verification Providers: ca44 shares identity document data with third-party KYC and identity verification providers to confirm player identities, verify ages, and comply with AML obligations. These providers are bound by strict data processing agreements.
• Game Studios and Content Providers: Session-level data necessary for game operation is shared with third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi as part of the technical integration of their games into the ca44 platform.
• Fraud Prevention and AML Screening Services: ca44 shares data with third-party fraud prevention, sanctions screening, and AML compliance services as part of our financial crime prevention obligations.
• Legal and Regulatory Authorities: ca44 may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required by applicable law, a valid court order, or a regulatory directive. ca44 will, where permitted by law, notify the affected player of any such disclosure.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of ca44's business, player data may be transferred to the acquiring entity, subject to the acquiring entity providing equivalent or greater privacy protections.

7 International Data Transfers

ca44 operates as an international online gaming platform. Some of the third-party service providers used by ca44 — including game studios, payment processors, and KYC providers — may process personal data in jurisdictions outside Bangladesh. Where such international transfers occur, ca44 takes appropriate steps to ensure that your personal data receives a level of protection equivalent to the standards described in this Policy.

Measures used to safeguard international data transfers include contractual clauses in data processing agreements with third-party processors that impose data protection obligations equivalent to those described in this Policy, and the selection of processors that maintain recognised international security certifications such as ISO 27001 or SOC 2 Type II.

By using the ca44 platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside Bangladesh. ca44 will always ensure that such transfers are subject to appropriate safeguards as described above.

8 Cookies & Tracking Technologies

ca44 uses cookies and similar tracking technologies (including web beacons, pixel tags, and local storage) on the ca44 platform. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential to the operation of the ca44 platform. They enable core functions such as player session authentication, security token management, and load balancing. These cookies cannot be disabled without preventing core platform functionality from working correctly.
• Performance and Analytics Cookies: These cookies collect aggregated, anonymised data about how players use the ca44 platform — such as which pages are visited most frequently and where errors occur. This data is used exclusively to improve platform performance and usability.
• Functional Cookies: These cookies remember your preferences and settings (such as language preferences and display settings) to provide a more personalised experience on return visits.
• Session Cookies: Temporary cookies that exist only for the duration of your browser session and are deleted automatically when you close your browser. Used to maintain your logged-in state during a gaming session.

ca44 does not use third-party advertising cookies or cookies that build profiles for retargeting or cross-site advertising purposes. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may impair your ability to use the ca44 platform.

9 Data Security

ca44 maintains a comprehensive information security programme designed to protect the personal data of all players against unauthorised access, disclosure, alteration, loss, or destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and the ca44 platform is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all pages of the platform, including the login, deposit, withdrawal, and account management pages.
• Encryption at Rest: Sensitive data stored on ca44 systems — including identity verification documents and financial data — is encrypted at rest using industry-standard encryption algorithms.
• Password Security: Player account passwords are never stored in plain text. Passwords are processed using a one-way cryptographic hashing function with a unique per-account salt, ensuring that even if the password database were compromised, individual passwords could not be recovered.
• Access Controls: Access to player personal data within ca44's internal systems is restricted on a strict need-to-know basis. All internal access is logged and audited. Staff with access to sensitive data undergo background checks and mandatory data protection training.
• Regular Security Audits: ca44 conducts periodic security assessments and penetration testing of the platform to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: ca44 maintains a data breach response procedure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ca44 will notify affected players without undue delay.

10 Data Retention

ca44 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, and for as long as required by applicable legal, regulatory, and contractual obligations. The following general retention periods apply:

• Active Account Data: Personal data associated with active player accounts is retained for the full duration of the account relationship.
• Closed Account Data: Following account closure, ca44 retains personal data — including identity documents, transaction records, and communication logs — for a minimum of five (5) years from the date of closure to satisfy AML record-keeping obligations and to defend against potential legal claims.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following the end of the account relationship in accordance with AML and financial record-keeping obligations.
• Transaction Records: Records of all financial transactions (deposits, withdrawals, bonuses) are retained for a minimum of five (5) years for AML and audit purposes.
• Support Correspondence: Customer support records, including chat transcripts and email correspondence, are retained for two (2) years from the date of the last interaction, unless a longer period is required in connection with an unresolved dispute.
• Marketing Data: Marketing preference records and communication logs are retained until you withdraw consent or for two (2) years of platform inactivity, whichever is earlier.

Once the applicable retention period has expired and there is no remaining legal basis for retaining the data, ca44 will securely delete or anonymise the data in accordance with our internal data destruction procedures.

11 Your Data Rights

As a ca44 player, you have the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and your registered email address. ca44 will respond within five (5) business days of receiving a valid request.

• Right of Access: You have the right to request confirmation of whether ca44 holds personal data about you, and to receive a copy of that data together with information about how it is being processed.
• Right to Rectification: You have the right to request that ca44 correct any inaccurate personal data held about you, and to have incomplete data completed where relevant.
• Right to Erasure ("Right to be Forgotten"): You have the right to request that ca44 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully. This right is subject to ca44's legal retention obligations — ca44 may be required to retain certain data regardless of an erasure request.
• Right to Restriction of Processing: You have the right to request that ca44 restrict the processing of your data in certain circumstances — for example, while the accuracy of data is being contested or while an objection to processing is under consideration.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where ca44 relies on legitimate interests as the lawful basis. ca44 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

12 Children & Minors

ca44 is strictly an adults-only platform. The minimum age to register and use any ca44 service is 21 years. ca44 does not knowingly collect personal data from individuals under the age of 21.

If ca44 discovers or is notified that personal data has been collected from a player who is under 21 years of age, ca44 will immediately suspend the relevant account, delete all associated personal data to the extent permitted by applicable legal obligations, and refund any deposits made net of any withdrawals already processed, in accordance with our responsible gaming procedures.

Parents and guardians who believe that a minor has created a ca44 account are urged to contact [email protected] immediately so that the account can be identified and closed without delay. ca44 treats underage gambling as a serious safeguarding matter and will act on all such notifications as a priority.

13 Marketing Communications

ca44 may send you promotional communications about bonuses, seasonal offers (such as BPL season promotions, Eid specials, and Pohela Boishakh campaigns), new game launches, and platform updates, but only where you have given explicit consent to receive such communications during registration or through your account settings.

Marketing communications may be delivered via email or mobile SMS, depending on your stated preferences. ca44 does not send unsolicited marketing communications via third-party channels or purchase contact lists for outbound marketing purposes.

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link included in any marketing email sent by ca44.
• Updating your communication preferences in your ca44 account settings panel.
• Sending a written opt-out request to [email protected] with the subject line "Marketing Opt-Out".

Withdrawal of marketing consent does not affect the delivery of transactional communications such as deposit confirmations, withdrawal notifications, security alerts, and account verification requests, which are sent as part of the contractual service and cannot be opted out of while your account remains active.

14 Third-Party Links

The ca44 platform may contain references to third-party game providers, payment partners, or other external services. Where third-party brand names or service descriptions appear on the ca44 platform, they are referenced for informational purposes only and do not constitute endorsement of, or a data-sharing arrangement with, the third party beyond what is described in Section 6 of this Policy.

ca44 is not responsible for the privacy practices or data handling of any third-party service provider's own platforms or websites. If you navigate to a third-party website or service from any reference on the ca44 platform, you do so at your own discretion and your interactions with that third party are governed by that party's own privacy policy. ca44 recommends reviewing the privacy policies of any third-party services you use in connection with your gaming activity.

15 Changes to This Privacy Policy

ca44 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. All changes will be published on this page with a revised "Last Updated" date at the top of the Policy and in the page hero section.

Where a change to this Policy is material — meaning it significantly affects how we collect, use, or share your personal data — ca44 will provide advance notice by sending an email to your registered email address at least seven (7) days before the change takes effect. Your continued use of the ca44 platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

ca44 encourages all players to review this Policy periodically to stay informed about how their personal data is being handled. The version of this Policy currently published on ca44.io is the version that governs all current processing activities.

16 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or to ca44's handling of your personal data, please contact our Data Protection team using the details below:

If you are not satisfied with ca44's response to your privacy concern, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. ca44 is committed to resolving all privacy concerns in good faith and will cooperate fully with any regulatory investigation arising from a player complaint.

ca44 takes all privacy complaints seriously. Every complaint received is logged, reviewed by a qualified member of our compliance team, and responded to with a reasoned written response. ca44 does not charge any fee for the exercise of data rights or the submission of privacy complaints.