Privacy Policy — cd222

1 Introduction

This Privacy Policy (hereinafter "Policy") is issued by cd222 (the "Platform", "Operator", "We", "Us" or "Our"), accessible at https://cd222.cam. It describes how we collect, use, store, share and protect personal data relating to individuals who register for, access or use the cd222 platform (each a "User", "You" or "Data Subject").

cd222 is committed to handling personal data responsibly and in accordance with applicable data protection legislation. This Policy is intended to be read alongside our Terms & Conditions, which govern the contractual relationship between you and the platform.

By registering an account, accessing the platform or submitting personal information to cd222, you acknowledge that you have read, understood and agree to the data practices described in this Policy. If you do not agree, please discontinue your use of the platform and contact us to close your account.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, payment details and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, deletion or any combination thereof.
• "Data Controller" means cd222, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means a third party that processes personal data on behalf of cd222, under contractual instruction.
• "KYC" means Know Your Customer — the identity verification process required to comply with anti-money laundering (AML) standards.
• "Cookies" means small text files placed on your device by the platform for session management, preference storage and analytics purposes.
• "Consent" means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Personal Data" means a subset of personal data warranting heightened protection, including government-issued identification numbers such as CNIC.

3 Data We Collect

cd222 collects the following categories of personal data:

4 How We Collect Your Data

cd222 collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC, contacting support, or updating your account profile;
• Automated collection: Technical and usage data collected automatically as you interact with the platform, via cookies, log files and session tracking technologies;
• Third-party sources: Identity verification data obtained from KYC service providers and fraud screening partners, in connection with our AML obligations;
• Payment providers: Transaction confirmation and payment method data received from payment processing partners, including references to familiar Pakistani payment channels (such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) where applicable. These providers operate under their own privacy policies.

5 Legal Basis for Processing

cd222 processes personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and cd222 — account management, payment processing, withdrawal handling and support services;
• Legal obligation: Processing required to comply with applicable AML, KYC, fraud prevention and responsible-gambling legal requirements;
• Legitimate interests: Processing necessary for cd222's legitimate business interests, including platform security, fraud detection, analytics and product improvement, provided these interests are not overridden by your rights;
• Consent: Processing based on your explicit agreement, particularly in respect of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6 How We Use Your Personal Data

cd222 uses personal data for the following purposes:

1. To create, manage and maintain your account on the platform;
2. To verify your identity and age in compliance with KYC/AML requirements;
3. To process deposits and withdrawals through your chosen payment method;
4. To detect, investigate and prevent fraud, money laundering and platform abuse;
5. To provide customer support and respond to queries or complaints;
6. To monitor your account activity in connection with our responsible gambling obligations;
7. To send transactional communications (account alerts, withdrawal confirmations, security notifications);
8. To send promotional communications where you have provided explicit consent to receive them;
9. To improve the platform's features, interface and content based on anonymised usage analytics;
10. To comply with applicable legal requirements and respond to lawful requests from regulatory authorities.

7 Data Sharing & Disclosure

7.1 cd222 does not sell, rent or trade your personal data to third parties. Sharing is limited to the following categories of recipients, each of whom is contractually obligated to process data only for the specified purpose:

• KYC and identity verification providers: To verify your identity, age and source of funds as required by AML obligations;
• Payment processing partners: To execute deposits and withdrawals through your chosen payment channel;
• Game technology providers: Limited technical data shared to enable game play functionality and session management;
• Fraud prevention and security partners: To screen for suspicious activity, multi-accounting and financial crime;
• IT infrastructure and hosting providers: Who store and process platform data on our behalf under strict data processing agreements;
• Legal and regulatory authorities: Where cd222 is required by law, court order or regulatory instruction to disclose personal data.

7.2 In the event of a corporate restructuring, merger, acquisition or sale of assets involving cd222, personal data held by the platform may be transferred to a successor entity. Users will be notified in advance of any such transfer via the email address registered to their account.

8 KYC & AML Data Processing

8.1 cd222 is required to operate Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures as a condition of its operation. KYC data — including government-issued photo identification (such as a Pakistani CNIC), proof of address and source-of-funds documentation — is processed on the basis of legal obligation.

8.2 KYC documents are shared only with authorised identity verification service providers engaged by cd222. They are not shared with marketing partners or used for any purpose other than identity verification and AML compliance.

8.3 KYC records are retained for the period required by applicable AML legislation, typically a minimum of five (5) years following account closure, unless a longer retention period is required by law.

8.4 Failure to provide KYC documentation when requested will result in the suspension of withdrawal processing and, in some cases, account restriction until verification is completed.

9 Cookies & Tracking Technologies

9.1 cd222 uses cookies and similar tracking technologies (including pixel tags and local storage) to operate and improve the platform. Cookies are placed on your device when you access the platform.

cd222 uses the following categories of cookies:

9.2 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair platform functionality. Declining analytics or marketing cookies will not affect your ability to use core platform features.

10 Data Retention

10.1 cd222 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations.

General retention periods applied by cd222:

• Active account data: Retained for the duration of the account relationship plus a post-closure period as required by law;
• KYC and AML documentation: Minimum five (5) years following account closure, or longer if required by applicable AML legislation;
• Financial transaction records: Minimum five (5) years to comply with financial record-keeping obligations;
• Support correspondence: Up to three (3) years, or longer if relevant to an active dispute or legal proceeding;
• Analytics and technical data: Typically up to twenty-six (26) months in anonymised or aggregated form.

10.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identified individual.

11 Data Security

11.1 cd222 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure.

These measures include:

• HTTPS/SSL encryption for all data transmitted between the platform and user devices;
• Encrypted storage for sensitive personal data at rest;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments of platform infrastructure;
• Multi-factor authentication options for user accounts;
• Contractual data security obligations imposed on all third-party data processors.

11.2 Notwithstanding the above measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Users should exercise caution in protecting their own login credentials and report any suspected security incident to support@cd222.cam immediately.

12 International Data Transfers

12.1 cd222 may transfer personal data to third-party service providers located outside Pakistan for the purposes described in this Policy. Where such transfers occur, cd222 takes steps to ensure an adequate level of data protection is in place, including through contractual protections such as standard data processing agreements.

12.2 By using the cd222 platform, Pakistani users acknowledge and consent to the transfer of their personal data to data processors located outside Pakistan, where necessary to provide the services described in this Policy.

13 Your Rights as a Data Subject

Subject to applicable law and certain exemptions (particularly in the context of AML and legal-obligation processing), you have the following rights in respect of your personal data:

• Right of Access: You may request a copy of the personal data cd222 holds about you;
• Right of Rectification: You may request correction of inaccurate or incomplete personal data;
• Right of Erasure: You may request deletion of your personal data, where no legal obligation requires its retention;
• Right to Restrict Processing: You may request a temporary halt to processing while accuracy or lawfulness is contested;
• Right to Data Portability: You may request a structured, machine-readable copy of data you have provided to us under contract or consent;
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.

14 Children's Privacy

14.1 cd222 is strictly an adults-only platform. Use of the platform by individuals under the age of 18 (or the higher minimum age required by the applicable operator or license jurisdiction) is prohibited.

14.2 cd222 does not knowingly collect, use or store personal data from minors. If we become aware that a minor has registered an account or submitted personal data, we will immediately suspend the account, delete the associated personal data and, where appropriate, report the incident to the relevant authority.

14.3 If you believe that a minor has submitted personal data to cd222, please contact us immediately at support@cd222.cam.

15 Third-Party Links & Services

15.1 The cd222 platform may reference third-party payment providers (including Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah) as familiar payment options for Pakistani users. Each of these providers operates under its own privacy policy. cd222 is not responsible for the data practices of any third-party payment provider, and users should review the relevant provider's privacy documentation independently.

15.2 Any game content provided by third-party technology studios on the cd222 platform is subject to the respective studio's data processing arrangements. cd222 contractually requires all game providers to comply with applicable data protection standards.

16 Amendments to This Policy

16.1 cd222 reserves the right to amend, update or replace this Privacy Policy at any time. Where material changes are made, registered Users will be notified via the email address associated with their account and/or by a prominent notice on the platform.

16.2 The effective date at the top of this Policy indicates when the current version came into force. Continued use of the platform following notification of a Policy update constitutes acceptance of the revised terms.

16.3 If you do not accept any amendment to this Policy, you should cease using the platform and contact support to close your account and exercise any applicable data rights.

17 Contact Us

For all privacy-related queries, data rights requests or concerns about how cd222 handles your personal data, please contact our support team:

For questions relating to account terms and conditions, please refer to our Terms & Conditions. For responsible gambling support, please visit our Responsible Gambling page.