ceo13 Privacy Policy

1Introduction

ceo13 ("we", "us", "our", or "the Platform") is committed to protecting and respecting the privacy of every player who accesses our online casino and sports betting services. This Privacy Policy explains in plain language how ceo13 collects, uses, stores, and shares personal data in connection with the ceo13 website and mobile platform, and what rights you — as a data subject — hold over your personal information.

This Privacy Policy forms part of the broader legal framework governing your use of ceo13, alongside our Terms and Conditions and Responsible Gaming Policy. By registering an account or continuing to use the ceo13 platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform immediately and contact support to arrange account closure.

2Information We Collect

ceo13 collects personal data from you through several channels: directly when you register an account or use platform features; automatically as you interact with our website or mobile platform; and, in limited circumstances, from third-party identity and payment verification services. The categories of personal data we collect include:

• Identity data: full legal name, date of birth, nationality, and government-issued identification document details (National ID card, passport, or driving licence number). This information is collected at registration and may be further verified during the KYC process.
• Contact data: mobile phone number (used as primary account identifier), email address (if provided), and residential address in Bangladesh. Contact data is used for account communications, promotional messages (where opted in), and support correspondence.
• Financial data: payment method identifiers (e.g. the last four digits of a linked bKash or Nagad account number, masked card numbers), transaction history (deposits, withdrawals, bonuses claimed), and account wallet balances. Full payment credentials are never stored on ceo13 servers — they are tokenised and processed by our licensed payment service providers.
• Usage data: pages visited, games played (titles, session duration, stakes, wins and losses), betting market interactions, feature usage patterns, login timestamps, and device/browser information (IP address, operating system, browser type, screen resolution).
• Communications data: the content of messages you send to ceo13 via live chat, email, or any other support channel. This includes complaint records, bonus dispute correspondence, and responsible gaming tool requests.
• Responsible gaming data: self-imposed limits (deposit limits, loss limits, session time reminders), cooling-off period records, and self-exclusion status. This data category is treated with heightened confidentiality and is accessible only by authorised compliance staff.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information unless it is directly relevant to a responsible gaming assessment and you have provided explicit consent. We do not collect biometric data.

3How We Use Your Information

ceo13 uses the personal data it collects strictly for the following purposes. We do not use your data for any purpose not listed below without first obtaining your consent or being required to do so by law:

• Account management: to create, verify, and maintain your ceo13 account; to authenticate your login sessions; and to enforce account security including two-factor authentication and unusual access detection.
• Contract performance: to process your deposits, execute your bets, settle winning outcomes, and process withdrawal requests in accordance with our Terms and Conditions.
• Compliance and fraud prevention: to verify your identity and age (KYC), to conduct anti-money-laundering (AML) checks, to detect and prevent fraudulent account activity, and to comply with requests from law enforcement authorities.
• Responsible gaming: to apply and monitor the responsible gaming tools you set (deposit limits, loss limits, self-exclusion), to identify patterns of play that may indicate problem gambling, and to proactively contact you if our systems flag concern.
• Customer support: to respond to your enquiries, resolve complaints, process bonus disputes, and improve the quality of our support services. Support communications are retained for a minimum of 12 months to ensure continuity and accountability.
• Platform analytics and improvement: to understand how players navigate the platform, which games and features are most popular, and where technical issues occur. This analytics data is aggregated and anonymised wherever possible.
• Marketing communications: to send you promotional offers, bonus notifications, and news about new games or features — but only if you have actively opted in to marketing communications. You may withdraw this consent at any time by contacting support or via your account notification settings.

4Legal Basis for Processing

ceo13 processes personal data only where a valid legal basis exists. The applicable bases for the processing activities described in this policy are:

• Contractual necessity: processing that is necessary to deliver the services you have signed up for — account creation, bet settlement, payment processing, and customer support. Without this processing, ceo13 cannot provide its core services to you.
• Legal obligation: processing required to comply with applicable law, including KYC identity checks, AML transaction monitoring, reporting obligations to law enforcement or financial intelligence authorities, and age verification requirements.
• Legitimate interests: processing carried out in ceo13's legitimate interests, including fraud prevention and security monitoring, platform analytics and improvement, and responsible gaming risk assessment — provided that these interests are not overridden by your fundamental privacy rights.
• Consent: processing that relies on your freely given, specific, and informed consent — principally, sending direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5Sharing Your Information

ceo13 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following circumstances, and only to the minimum extent necessary to fulfil the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, and our card and crypto payment processors receive only the transaction data necessary to execute deposits and withdrawals. These providers operate under their own privacy policies and are bound by applicable financial data protection regulations.
• Identity verification providers: third-party KYC and age verification service providers receive copies of identity documents and biographic data strictly for the purpose of verifying your identity and age. These providers are contractually bound to use your data for no other purpose.
• Game software providers: game studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming may receive a pseudonymous player session token and stake/result data to facilitate game play and audit game integrity. These providers do not receive your name, contact details, or payment information.
• Law enforcement and regulatory bodies: ceo13 will disclose personal data to police, financial intelligence units, courts, or other competent authorities when required to do so by a valid legal order, warrant, or regulation. Where permitted by law, ceo13 will notify you of such a disclosure.

In all cases where ceo13 shares data with third-party processors, those processors are required to implement appropriate technical and organisational security measures to protect the data, and they are forbidden from using the data for any purpose beyond the specific contracted purpose. ceo13 remains the data controller and is responsible for ensuring third-party compliance.

6Payment Data

ceo13 treats payment data with the highest level of confidentiality. When you make a deposit via bKash, Nagad, Rocket, Upay, or a card network, the transaction is processed through a secure encrypted connection. ceo13 does not store your full bKash PIN, card number, CVV, or bank account credentials on its servers. What ceo13 retains is a masked reference token (for example, the last four digits of your mobile wallet number) that allows us to associate future transactions with your account without exposing your full credentials.

Cryptocurrency transactions (USDT and BTC) are recorded on the public blockchain. While the blockchain itself is public, ceo13 does not publish or share the association between your blockchain wallet address and your ceo13 account identity. Wallet addresses linked to your account are stored securely and treated as confidential financial data subject to the same access controls as other payment data.

7Cookies and Tracking Technologies

ceo13 uses cookies and similar tracking technologies (such as web beacons and local storage) to deliver, maintain, and improve the platform. Cookies are small text files placed on your device when you visit ceo13. The types of cookies we use are:

• Essential cookies: required for the platform to function. These include session authentication cookies (keeping you logged in), security cookies (CSRF protection), and load-balancing cookies. You cannot opt out of essential cookies without losing access to the platform.
• Analytics cookies: used to measure platform performance, track page views and session data, and understand player navigation patterns. Analytics data is aggregated and does not identify you individually. You may opt out of analytics cookies by adjusting your browser settings.
• Preference cookies: store your platform preferences such as language selection, default game category, and notification settings. These improve your experience by personalising the interface on each visit.
• Security and fraud-prevention cookies: used to identify and block suspicious access attempts, bot traffic, and account takeover patterns. These cookies are part of our security infrastructure and cannot be disabled.

ceo13 does not use third-party advertising or retargeting cookies. We do not permit advertising networks to place cookies on ceo13 pages. To manage your cookie preferences for analytics and preference cookies, please refer to your browser's privacy settings. Most modern browsers (Chrome, Firefox, Safari, Samsung Internet) allow you to review, delete, and block cookies on a site-by-site basis.

8Data Retention

ceo13 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply: active account data is retained for the lifetime of the account; transaction and financial records are retained for a minimum of five years following account closure to satisfy anti-money-laundering and financial record-keeping requirements; responsible gaming records (including self-exclusion history) are retained for a minimum of five years after the exclusion period ends to prevent circumvention; customer support communications are retained for a minimum of 12 months; and anonymised analytics data may be retained indefinitely.

When your data is no longer needed and there is no legal basis to retain it, ceo13 will securely delete or anonymise it. Secure deletion means overwriting or cryptographically erasing the data so that it cannot be reconstructed. If you request account closure, ceo13 will begin the deletion process for data not subject to mandatory retention within 30 days of account closure being confirmed.

9Data Security

ceo13 implements a layered approach to data security, combining technical controls with organisational policies and staff training. Technical security measures in place include: TLS 1.2 or higher encryption for all data in transit between your device and ceo13 servers; AES-256 encryption at rest for sensitive personal data fields; strict access controls ensuring that staff can only access the personal data necessary for their specific role; multi-factor authentication requirements for all platform administrator access; regular automated vulnerability scanning and periodic third-party penetration testing; and real-time intrusion detection and anomaly monitoring on all production infrastructure.

Despite these measures, no internet transmission or electronic storage system is 100% secure. ceo13 cannot guarantee absolute security of data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ceo13 will notify affected players as soon as reasonably practicable, and will take all appropriate steps to contain and remediate the breach.

10Your Rights Over Your Personal Data

As a data subject, you hold the following rights in respect of the personal data ceo13 holds about you. To exercise any of these rights, please contact support at [email protected] with the subject line "Data Rights Request" and your registered account mobile number. ceo13 will respond within 30 days of receiving a valid request:

• Right of access: you have the right to request a copy of all personal data ceo13 holds about you, together with information about how it is being used, who it has been shared with, and how long it will be retained.
• Right to rectification: if any personal data ceo13 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For account name or contact details, this can often be done directly in your account settings.
• Right to erasure ("right to be forgotten"): you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that mandatory legal retention periods (e.g. AML records) may prevent complete erasure.
• Right to restriction of processing: in certain circumstances, you may request that ceo13 restrict (but not delete) the processing of your personal data — for example, while the accuracy of your data is being contested, or pending the outcome of an objection.
• Right to data portability: where processing is based on consent or contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to have that data transmitted to another controller where technically feasible.
• Right to object: you have the right to object to processing carried out on the basis of legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes, in which case ceo13 will cease such processing immediately.

ceo13 will never charge you a fee for exercising any data rights request. If a request is manifestly unfounded or excessive, ceo13 reserves the right to charge a reasonable administrative fee or to refuse to act on the request, with written reasons provided. Where ceo13 is unable to fulfil a request due to a conflicting legal obligation, we will explain this in writing.

11Children's Privacy

ceo13 is strictly an adults-only platform. Persons under the age of 21 are prohibited from registering an account or using any ceo13 service. ceo13 does not knowingly collect personal data from anyone under 21 years of age. If we become aware that personal data has been collected from a person under 21, we will immediately delete that data and permanently close the associated account. If you are a parent or guardian and believe that your child has registered on ceo13, please contact support immediately at [email protected] so we can investigate and take action.

12Third-Party Links

The ceo13 platform does not contain links to external websites. All navigation within ceo13 remains within the ceo13 domain. If you independently navigate away from ceo13 to a third-party website, ceo13 has no control over and accepts no responsibility for the privacy practices or content of that third-party site. You should review the privacy policy of any external website you visit before providing personal information.

13International Data Transfers

ceo13 primarily stores and processes personal data on servers located in secure data centres. In some cases, third-party service providers (such as KYC verification providers or game studios) may process your data in countries outside Bangladesh. Where such transfers occur, ceo13 takes steps to ensure that appropriate safeguards are in place — such as contractual data protection clauses — so that your personal data receives a level of protection consistent with this Privacy Policy. By using ceo13, you acknowledge and consent to the possibility that your data may be transferred to and processed in jurisdictions outside Bangladesh.

14Changes to This Privacy Policy

ceo13 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes, we will post the updated policy on this page with a revised "Last updated" date and, where the changes are significant, notify registered players via their registered contact details.

Your continued use of the ceo13 platform following the posting of any update to this Privacy Policy constitutes your acceptance of the revised policy. We encourage you to periodically review this page to stay informed about how ceo13 protects your personal data.

15Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ceo13 handles your personal data, please contact our support team. We aim to acknowledge all privacy queries within 2 business days and resolve them within 30 days.

Email (plain text, not a link): [email protected]

For information about how we use your data in our games and betting services, please also review our Terms & Conditions.