cr77 Privacy Policy

Introduction & Scope

This Privacy Policy ("Policy") sets out the basis on which cr77 ("cr77", "we", "us", "our") collects, processes, stores, and shares personal data about users ("you", "your") of the cr77 online sportsbook and casino platform, accessible at https://cr77.io, including any associated mobile applications, APIs, and sub-domains (collectively, "the Platform").

This Policy applies to all individuals who visit the Platform, register an account, place a wager, use any cr77 product or feature, or otherwise interact with us, regardless of the device or method used to access the Platform. It applies to personal data collected directly from you, generated through your use of the Platform, and obtained from third-party sources as described below.

This Policy should be read alongside our Terms & Conditions, which are available at /terms-conditions, and our Responsible Gaming Policy at /responsible-gaming. In the event of any conflict between this Policy and the Terms & Conditions with respect to data privacy, this Policy shall prevail.

Data Controller

For the purposes of applicable data protection law, cr77 acts as the data controller in respect of the personal data it collects and processes about you. As data controller, cr77 determines the purposes for which and the means by which your personal data is processed.

cr77 operates as an internationally licensed online gaming platform. While cr77 serves a significant user base in Bangladesh, the Platform is operated under an international framework and personal data may be processed by cr77's infrastructure in jurisdictions outside Bangladesh. Where such international transfers occur, cr77 applies appropriate safeguards as described in Section 13 of this Policy.

Data We Collect

cr77 collects the following categories of personal data in connection with the operation of the Platform and the provision of services to registered players:

cr77 does not intentionally collect special category data (such as health information, racial or ethnic origin, or political opinions) as part of its standard account registration or service delivery process. If such data is volunteered by a user in the context of a responsible gaming concern or support communication, it will be processed solely for the purpose for which it was provided and with appropriate additional safeguards applied.

How We Collect Data

cr77 collects personal data through the following channels and mechanisms:

• Direct registration: When you create a cr77 account, you provide identity and contact data directly through the registration form.
• Account activity: Your use of the Platform generates usage data, financial data, and technical data automatically as you browse, bet, and transact.
• KYC and verification submissions: When completing identity verification, you submit identity documents which cr77 processes to confirm your eligibility to use the Platform.
• Payment processors: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a bank partner, the relevant payment provider shares transaction-level data with cr77 necessary to process and reconcile the transaction.
• Customer support interactions: When you contact cr77 support — whether by email, live chat, or ticketing system — the content of those communications is collected and stored.
• Cookies and tracking technologies: cr77 uses cookies and similar technologies to collect technical and usage data as described in Section 10 of this Policy.
• Fraud prevention and third-party data sources: cr77 may receive data about you from third-party fraud prevention services, identity verification bureaus, and publicly available sources where this is necessary to protect the integrity of the Platform and comply with AML obligations.

How We Use Your Data

cr77 uses the personal data it collects for the following purposes:

• Account creation and management: To create, maintain, and administer your cr77 account, including verifying your identity and eligibility to use the Platform.
• Service delivery: To process your bets, casino game sessions, deposits, withdrawals, and all other transactions made through the Platform.
• KYC and regulatory compliance: To verify your identity and age in compliance with applicable anti-money laundering (AML) and know-your-customer (KYC) regulations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent, abusive, or illegal activity on the Platform, including the use of automated fraud detection systems.
• Responsible gaming: To monitor your gaming activity for indicators of problem gambling and to administer self-exclusion, deposit limit, time-out, and other responsible gaming tools you may activate. See our Responsible Gaming page for more information.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide assistance with account-related matters.
• Legal and regulatory obligations: To comply with applicable laws, regulatory directives, court orders, and requests from law enforcement or competent authorities.
• Service improvement: To analyse Platform usage patterns, identify technical issues, and improve the functionality, performance, and content of the Platform.
• Marketing communications: Where you have provided consent, to send you promotional offers, bonus notifications, and updates about new products and features available on cr77.

Legal Basis for Processing

cr77 processes your personal data only where a valid legal basis exists. The following table summarises the legal bases on which cr77 relies for each primary processing activity:

Where cr77 relies on legitimate interests as a legal basis, it has conducted a balancing assessment to confirm that its interests are not overridden by your fundamental rights and freedoms as a data subject.

Data Sharing & Disclosure

cr77 does not sell your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank — to process deposits and withdrawals and to fulfil AML obligations.
• Game technology suppliers: Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, Spribe, and other licensed game providers — to deliver game sessions and ensure fair play certification compliance.
• Identity verification and KYC providers: Third-party KYC and document verification services engaged by cr77 to verify player identity and age documents.
• Fraud prevention and security services: Third-party fraud detection platforms that analyse transactional and behavioural data to identify and prevent fraudulent activity.
• IT and cloud infrastructure providers: Hosting, database, and cloud service providers that store and process Platform data on cr77's behalf, under strict data processing agreements.
• Legal and regulatory authorities: Competent law enforcement agencies, financial intelligence units, regulatory bodies, and courts — where disclosure is required by applicable law, court order, or regulatory directive.
• Professional advisers: Lawyers, accountants, auditors, and insurers engaged by cr77 in the course of its normal business operations, where access to your data is necessary for the relevant professional service.

Data Retention

cr77 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account data and KYC documents: Retained for a minimum of 5 years from the date of account closure, or longer where required by AML regulations applicable to the jurisdiction of operation.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, in accordance with standard financial recordkeeping requirements.
• Betting and gaming activity records: Retained for a minimum of 3 years from the date of the relevant activity, or longer where required by applicable gaming regulation.
• Customer support communications: Retained for 3 years from the date of the last communication, to facilitate dispute resolution and regulatory audit.
• Marketing consent records: Retained for the duration of your account plus 3 years, to provide an auditable record of consent given and withdrawn.
• Technical and usage logs: Retained for up to 12 months in active form, after which they may be anonymised and retained in aggregate form for analytical purposes.

Data Security

cr77 takes the security of your personal data seriously and has implemented a range of technical and organisational security measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption in transit: All data exchanged between your device and the cr77 Platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Encryption at rest: Sensitive personal data stored in cr77's databases — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to systems containing personal data is restricted to authorised cr77 personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Intrusion detection: cr77's infrastructure is monitored around the clock by automated intrusion detection systems. Security events are logged and reviewed by our security operations team.
• Penetration testing: cr77 commissions independent security audits and penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Staff training: All cr77 personnel with access to personal data receive regular data protection and security awareness training.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, cr77 will notify affected players without undue delay, in accordance with applicable data breach notification obligations.

Cookies & Tracking

cr77 uses cookies and similar tracking technologies (including pixel tags and local storage) to enhance your experience on the Platform, ensure Platform security, and collect usage analytics. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function correctly — including session management, authentication tokens, and security features. These cannot be disabled without severely impairing Platform functionality.
• Functional cookies: Used to remember your preferences, language settings, and personalisation options within the Platform.
• Analytics cookies: Used to collect aggregated information about how players use the Platform — such as which pages are visited most frequently and how long sessions last. This data helps cr77 improve the Platform experience. Analytics data is anonymised or pseudonymised wherever possible.
• Security cookies: Used to detect fraudulent activity, bot behaviour, and unusual login patterns to protect your account.

cr77 does not use advertising tracking cookies or third-party retargeting pixels that would allow external advertising networks to build profiles of you across the internet.

Your Privacy Rights

Depending on the data protection laws applicable to your circumstances, you may have some or all of the following rights in respect of the personal data cr77 holds about you:

• Right of access: You may request a copy of all personal data cr77 holds about you (commonly referred to as a Subject Access Request or SAR). cr77 will respond within 30 days of receiving a valid request.
• Right to rectification: You may request that cr77 correct any personal data about you that is inaccurate, outdated, or incomplete.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where it has been unlawfully processed — subject to applicable legal retention requirements.
• Right to restriction of processing: You may request that cr77 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over deletion.
• Right to data portability: Where processing is based on contract or consent and is carried out by automated means, you may request that cr77 provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on cr77's legitimate interests or for direct marketing purposes. cr77 will cease the relevant processing unless compelling legitimate grounds exist that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, submit a written request to [email protected] (plain text — not a clickable link), including your full name, registered email address, and a clear description of the right you wish to exercise. cr77 may request proof of identity before processing your request to protect against unauthorised access to your data.

Minors & Age Verification

The cr77 Platform is strictly for adults aged 21 and above. cr77 does not knowingly collect or process personal data of individuals under the age of 21. All players are required to complete age verification as part of the KYC process before they may make a deposit or place a wager on the Platform.

cr77 strongly encourages parents and guardians to make use of parental control software to prevent minors from accessing online gambling platforms. If you believe a minor has registered on or is using the cr77 Platform, please contact us immediately at [email protected] (plain text — not a clickable link).

International Data Transfers

cr77 operates as an international platform and may transfer your personal data to, and process it in, countries other than Bangladesh where cr77's infrastructure providers, technology partners, and game suppliers are located. Some of these countries may not have data protection laws equivalent to those in Bangladesh or the European Union.

Where personal data is transferred outside Bangladesh to a country that does not provide an equivalent level of data protection, cr77 implements appropriate transfer safeguards, which may include:

• Standard contractual clauses (SCCs) approved by applicable data protection authorities, incorporated into contracts with the relevant data importers.
• Binding corporate rules applicable to cr77's corporate group entities.
• Adequacy decisions or equivalent certifications applicable to the destination country or recipient.

Changes to This Policy

cr77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The date of the most recent revision is always displayed in the "Last Updated" field at the top of this Policy.

Where a change to this Policy is material — meaning it significantly affects your privacy rights or how your personal data is processed — cr77 will notify you in advance by email to your registered address and/or via a prominent notice on the Platform, providing you with sufficient time to review the change before it takes effect.

Minor amendments — such as typographical corrections or clarifications that do not alter the substantive meaning of any provision — may be made without advance notice and will take effect upon publication. Your continued use of the Platform following any update to this Policy constitutes your acceptance of the revised Policy.

Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the personal data cr77 holds about you, please contact us using the details below:

• Data Protection Contact Email: [email protected] (plain text — not a clickable link)
• Response commitment: cr77 acknowledges all privacy-related communications within 5 business days and aims to provide a substantive response within 30 days of receiving a valid, complete request.
• Verification requirement: To protect against unauthorised access to your data, cr77 may require you to verify your identity before processing any data access, correction, or deletion request.

This Privacy Policy is written in English and the English version shall prevail in all circumstances. cr77 operates the Platform in English as its operational language, serving Bangladesh's English-speaking online gaming community.