ct77 Privacy Policy

This Privacy Policy ("Policy") describes how ct77 ("ct77", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the ct77 website at https://ct77.io and all associated services, games, and features (collectively, the "Platform").

ct77 is an offshore online betting and casino platform serving adult players primarily in Bangladesh. We are committed to processing your personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. This Policy applies to all personal data collected through the Platform, including data provided during registration, identity verification, deposits, withdrawals, and general use of our services.

This Policy should be read alongside the ct77 Terms & Conditions and Responsible Gaming Policy. Defined terms used but not defined in this Policy carry the meanings given to them in the Terms & Conditions.

ct77 acts as the data controller for all personal data collected through the Platform. As data controller, ct77 determines the purposes and means of processing your personal data. Where ct77 engages third-party service providers to process data on its behalf, those parties act as data processors and are bound by contractual obligations to process data only on ct77's instructions and in accordance with this Policy.

For all data-related enquiries, corrections, deletion requests, or complaints, you may contact our designated data protection contact at [email protected] with the subject line "Data Privacy Request".

ct77 collects the following categories of personal data:

3.1 Registration & Identity Data

• Full legal name
• Date of birth
• Email address
• Mobile phone number (including bKash/Nagad/Rocket/Upay-registered numbers)
• Residential address (city, district, postal code)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (National ID card, passport, driving licence)
• Proof of address documentation (utility bill, bank statement)
• Payment method ownership evidence (mobile banking screenshots)
• Facial image data (where submitted as part of document verification)

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and methods
• Mobile banking account numbers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank)
• Bank account details where bank transfer is used
• Transaction reference numbers

3.4 Usage & Technical Data

• IP address and approximate geolocation (country/city level)
• Device type, operating system, and browser type
• Session timestamps and duration
• Pages visited, games played, and bet history
• Cookies and similar tracking identifiers (see Section 9)

3.5 Communications Data

• Live chat transcripts with ct77 support agents
• Email correspondence with ct77
• Feedback and survey responses

ct77 collects personal data through the following channels:

• Directly from you: when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey.
• Automatically: through cookies, server logs, and analytics tools as you navigate and interact with the Platform.
• From third-party identity verification providers: when we use automated KYC services to cross-reference the documents you submit against official data sources.
• From payment processors: transaction confirmation data received when you complete a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or card payment gateways.
• From fraud prevention and security services: risk-scoring data and device fingerprinting signals used to detect suspicious activity.

ct77 processes your personal data for the following purposes and on the following legal bases:

• Contract performance: Processing your registration data, verifying your identity, crediting your account balance, and processing deposits and withdrawals are all necessary to deliver the service you contracted for when you created a ct77 account.
• Legal obligation: ct77 is required to collect and retain certain personal data to comply with anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and financial record-keeping rules applicable to offshore gaming operators.
• Legitimate interests: ct77 processes usage and technical data to improve platform performance, detect and prevent fraud, maintain security, and analyse player behaviour in aggregate to enhance the gaming experience. These interests are balanced against your privacy rights and do not override them.
• Consent: Where ct77 sends you promotional communications about bonuses, new games, or seasonal offers (such as Eid or Pohela Boishakh specials), this is done on the basis of your consent, which you may withdraw at any time by contacting support or adjusting your communication preferences in account settings.
• Responsible gaming obligations: ct77 processes data about your gaming activity (bet amounts, session duration, frequency of play) to identify patterns that may indicate problem gambling, and to apply protective measures such as deposit limits or self-exclusion as described in our Responsible Gaming Policy.

ct77 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share personal data only in the following limited circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard payment networks receive only the transaction data necessary to process your deposit or withdrawal. No additional personal data is shared with payment partners beyond what is required for the transaction.
• Identity verification providers: Third-party KYC and AML screening services receive the identity documents you submit. These providers are contractually bound to use your data exclusively for the purpose of verifying your identity on behalf of ct77.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier to facilitate game session management. These providers do not receive your full identity data.
• Cloud and hosting infrastructure: ct77's platform is hosted on third-party cloud infrastructure. Data stored on these servers is subject to the same encryption and security standards described in Section 8.
• Law enforcement and regulatory authorities: ct77 will disclose personal data to competent authorities where required by law, court order, or where ct77 has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or serious harm.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of ct77's business, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

ct77 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and to comply with applicable legal, regulatory, and financial record-keeping obligations. The following retention periods apply:

• Account and identity data: Retained for a minimum of 5 years following permanent account closure, in line with standard AML record-keeping requirements.
• KYC documentation: Retained for a minimum of 5 years from the date of submission, or 5 years from account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Communications data (live chat, email): Retained for up to 3 years from the date of the last interaction for dispute resolution and quality assurance purposes.
• Usage and technical data: Retained in anonymised or aggregated form indefinitely for analytics purposes. Raw identifiable usage logs are retained for up to 12 months.
• Marketing preferences: Retained until you withdraw consent or close your account, whichever is earlier.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

ct77 implements a multi-layered approach to data security. The technical and organisational measures we have in place include:

• Transport-layer encryption: All data in transit is protected by 256-bit SSL/TLS encryption. The ct77 website enforces HTTPS at all times; unencrypted HTTP connections are automatically redirected.
• At-rest encryption: Personal data and identity documents stored on ct77's servers are encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted to ct77 personnel and contractors who require it to perform their job functions. All access is logged and subject to periodic review.
• Password security: Player passwords are stored as salted hashes using a modern key-derivation function. Plain-text passwords are never stored or transmitted by ct77.
• Fraud detection: ct77 operates continuous automated monitoring for suspicious login patterns, unusual transaction behaviour, and device anomalies.
• Penetration testing: ct77's platform undergoes periodic security assessments to identify and remediate vulnerabilities.

While ct77 takes all reasonable steps to protect your data, no internet-based service can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights, ct77 will notify affected players without undue delay and will take immediate steps to contain the breach and mitigate its effects.

ct77 uses cookies and similar technologies (such as local storage and session storage) to operate and improve the Platform. The following categories of cookies are in use:

• Strictly necessary cookies: Required for core platform functionality such as maintaining your logged-in session, storing your language preference, and processing transactions. These cookies cannot be disabled without impairing your ability to use the Platform.
• Analytics cookies: Used to collect anonymised information about how players use the Platform — such as which pages are visited most frequently and how long sessions last. This data helps ct77 improve the user experience. Analytics data is not linked to your personal identity.
• Security cookies: Used to detect fraud, prevent cross-site request forgery (CSRF), and identify unusual device behaviour. These cookies are essential for keeping your account secure.

ct77 does not deploy third-party advertising cookies or retargeting pixels. You will not receive ct77 advertisements on other websites as a result of visiting our platform.

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may affect your ability to log in and use certain Platform features. Detailed instructions for managing cookies in major browsers are available through the browser's help documentation.

As a player whose personal data is processed by ct77, you hold the following rights with respect to your personal information:

• Right of access: You may request a copy of all personal data ct77 holds about you. We will provide this within 30 days of a verified request.
• Right to rectification: If any personal data ct77 holds about you is inaccurate or incomplete, you may request that it be corrected. Corrections to core identity data may require re-submission of supporting documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data. This right is subject to legal retention obligations — data that ct77 is required by law to retain cannot be deleted before the end of the mandatory retention period.
• Right to restriction of processing: You may request that ct77 temporarily stop processing your data in certain circumstances, such as while a correction request is under review.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to ct77, where technically feasible.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
• Right to object: You may object to processing carried out on the basis of ct77's legitimate interests. ct77 will assess whether its legitimate interests override your objection on a case-by-case basis.

To exercise any of these rights, contact ct77 support at [email protected] with the subject line "Data Privacy Request". We will acknowledge receipt within 5 business days and provide a substantive response within 30 days. ct77 may request proof of identity before processing a data rights request.

The ct77 Platform is strictly intended for adults aged 21 and above. ct77 does not knowingly collect personal data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has registered on the ct77 Platform or submitted personal data without your consent, please contact us immediately at [email protected]. ct77 will take prompt action to close the account and delete the associated data upon verification of the report.

ct77 employs age verification controls at the point of registration and during KYC review to prevent underage access. Players who cannot demonstrate that they meet the 21+ age requirement will have their accounts suspended and any pending withdrawal requests held pending investigation.

ct77 is an offshore platform and its infrastructure, data processing systems, and third-party service providers may be located in jurisdictions outside Bangladesh. When your personal data is transferred outside Bangladesh, ct77 takes steps to ensure that an equivalent level of protection is applied, including by entering into data processing agreements with service providers that incorporate internationally recognised contractual protections.

By registering and using the ct77 Platform, you acknowledge that your personal data may be processed in countries other than Bangladesh. ct77 will not transfer your data to a third country without ensuring that appropriate safeguards are in place.

ct77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made, ct77 will notify registered players by email at the address on file and will display a prominent notice on the Platform for at least 14 days before the changes take effect.

The effective date at the top of this document indicates when the current version was last revised. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you must stop using the Platform and may request account closure through ct77 support.

If you have questions, concerns, or requests relating to this Privacy Policy or ct77's handling of your personal data, please contact us through the following channels:

• Email: [email protected] — use subject line "Data Privacy Request" for all data-related enquiries (plain text — not a clickable link)
• Live Chat: Available 24/7 via the ct77 Platform, including all public holidays in Bangladesh
• WhatsApp: +880 1700 000000 (plain text — not a clickable link)

ct77 will acknowledge all data-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6) and will aim to provide a full response within 30 days.

Effective Date: 1 January 2026  |  Version: 1.0