Privacy Policy — cm444

cm444 processes personal data for specific, documented purposes. We do not use your data in ways that would conflict with those purposes or that you would not reasonably expect. The primary uses of your data are:

• Account creation and management: creating, operating, and maintaining your account, including processing logins, password resets, and account settings changes.
• Identity and age verification (KYC): verifying that you meet the minimum age requirement of 21 years and that your identity matches your account details, as required under responsible gaming and anti-money laundering obligations.
• Payment processing: processing deposits and withdrawals, reconciling transactions, and investigating any disputed or flagged payments.
• Platform security and fraud prevention: detecting, investigating, and preventing fraudulent activity, cheating, multi-accounting, and other prohibited behaviours that could harm the integrity of the Platform or other users.
• Customer support: responding to your queries, complaints, and requests, and maintaining a record of correspondence for quality and compliance purposes.
• Responsible gaming compliance: monitoring account activity patterns to identify players who may be experiencing gambling-related harm, and enabling responsible gaming tools such as deposit limits and self-exclusion.

We do not use personal data for automated decision-making that produces legal or similarly significant effects on your account without a human review process. Any account action with significant consequences (such as permanent closure) involves a manual review by an authorised team member.

cm444 does not sell your personal data. We may share your data with third parties only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard processors receive the minimum transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and data security standards.
• Identity verification providers: third-party KYC service providers receive identity document data solely for the purpose of verifying your age and identity. They are contractually prohibited from using this data for any other purpose.
• Legal and regulatory authorities: we may be required to disclose personal data to law enforcement, regulatory bodies, or courts where we receive a lawful and documented request. We will notify you of any such disclosure where we are legally permitted to do so.
• Business transfers: in the event of a merger, acquisition, or sale of all or part of the Platform's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy protections applicable to your data.

All third parties with whom we share data are required to maintain appropriate technical and organisational security measures and to process your data only as instructed by cm444. We do not permit our service partners to use your data for their own independent purposes.

cm444 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows: active account data is retained for the lifetime of the account plus 5 years after account closure, to satisfy anti-money laundering record-keeping obligations; KYC identity documents are retained for 5 years from the date of account closure or the date of the last transaction, whichever is later; transaction records are retained for 5 years from the transaction date; support correspondence is retained for 3 years from the date of the last communication in a thread.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and Platform improvement purposes.

cm444 implements a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include: SSL/TLS encryption for all data transmitted between your device and our servers; AES-256 encryption for sensitive data stored at rest; hashed and salted password storage using industry-standard algorithms; role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their role; regular security audits and vulnerability assessments; and secure data centre infrastructure with physical access controls.

Despite these measures, no internet-based system is completely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights and freedoms, cm444 will notify affected users without undue delay and will take all reasonable steps to contain and remediate the breach. You can help protect your account by using a strong, unique password, not sharing your login credentials with anyone, and logging out of your account after each session especially on shared devices.

cm444 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes, we will update the effective date at the top of this page and, where required, notify registered users via email or an in-platform notification before the changes take effect. We encourage you to review this Policy periodically so you remain informed about how we handle your personal data.

Your continued use of the Platform after a revised Privacy Policy has been posted constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you must stop using the Platform and may request account closure by contacting [email protected].