Privacy Policy — How cv11 Protects Your Personal Data

cv11 is an online casino and sports betting platform operating at cv11.io, serving players primarily across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. For the purposes of this Privacy Policy, references to "cv11", "we", "us", or "our" refer to the operator of the cv11 platform.

cv11 acts as the data controller in respect of personal data collected through the platform. This means we determine the purposes and means of processing your personal data and bear primary responsibility for that processing. Where we engage third-party service providers to process data on our behalf, those providers act as data processors under our instruction and are bound by contractual data protection obligations.

For all privacy-related enquiries, data access requests, or complaints, players may contact our data team at [email protected] with the subject line "Privacy Request". We will acknowledge all privacy requests within 5 business days and aim to resolve them within 30 days.

cv11 collects personal data across the following categories. Not all categories apply to every user — the data collected in respect of a specific individual depends on how they interact with the platform:

• Identity Data: Full legal name, date of birth, gender, National Identity Card (NID) number, passport number, or driving licence number provided during account registration or KYC verification.
• Contact Data: Mobile phone number, email address, and residential address (at city or district level — full street addresses are collected only if required for a specific verification purpose).
• Financial Data: Mobile financial service account numbers (bKash, Nagad, Rocket, Upay), the last four digits of Visa or Mastercard numbers, deposit and withdrawal transaction records, and account balance history.
• Technical Data: IP address, browser type and version, device type, operating system, device fingerprint, and session identifiers generated automatically when you access the cv11 platform.
• Usage Data: Games accessed, bets placed and settled, tournament participation, session start and end times, feature interactions, and navigation patterns within the platform.
• Communications Data: The content of messages sent to cv11 via live chat, email, or any support ticket system, including transcripts retained for quality assurance and dispute-resolution purposes.
• Marketing and Preference Data: Whether you have opted in or out of receiving promotional communications from cv11, your preferred communication channel, and any personalisation preferences you have set within your account.

cv11 collects personal data through the following channels:

3.1 Direct Collection. The majority of personal data we hold is provided directly by you during the account registration process, when completing identity verification, when making a deposit or withdrawal, when contacting support, or when responding to a promotional offer. You are always informed at the point of collection what data is being requested and why.

3.2 Automated Collection. When you access the cv11 platform — whether as a registered player or an anonymous visitor — our servers automatically collect certain technical data including your IP address, browser characteristics, device type, and session timing data. This collection is a standard function of web server operation and does not require any active input from you.

3.3 Cookies and Similar Technologies. cv11 uses first-party cookies and similar browser-based technologies to maintain your logged-in session, remember your preferences, and gather anonymised analytics data about platform usage patterns. See Section 5 of this Policy for full details of how cv11 uses cookies.

3.4 Third-Party Sources. In limited circumstances, cv11 may receive supplementary identity or fraud-risk data from third-party identity verification partners (such as KYC service providers) or fraud-detection databases in order to verify the accuracy of information you have provided. Such data is used only to validate your existing registration information and is not used to build marketing profiles.

3.5 Payment Providers. When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the payment provider may share transaction confirmation data with cv11 — including a transaction reference, the amount, and a tokenised identifier for the payment account. Full payment credentials are never transmitted to or stored by cv11's own servers.

cv11 uses the personal data we collect for the following purposes, each of which is supported by a defined lawful basis:

• Account Creation and Management: To register your account, authenticate your login, manage your account settings, and communicate essential account information to you. Lawful basis: contractual necessity.
• Identity and Age Verification: To confirm that you are the person you claim to be and that you meet the 21+ age requirement for using the cv11 platform. Lawful basis: legal obligation; contractual necessity.
• Payment Processing: To process deposits and withdrawals via your chosen payment method, maintain a transaction history, and reconcile financial records. Lawful basis: contractual necessity.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, money laundering, duplicate account creation, and other forms of platform abuse. This includes device fingerprinting and IP analysis. Lawful basis: legitimate interest; legal obligation.
• Responsible Gaming: To monitor account activity for patterns consistent with problem gambling behaviour, to enforce deposit limits and self-exclusion periods you have set, and to intervene where required under our responsible gaming obligations. Lawful basis: legal obligation; legitimate interest.
• Customer Support: To investigate and resolve your support requests, complaints, and disputes. Support communications are retained as evidence of the issue and its resolution. Lawful basis: contractual necessity; legitimate interest.
• Platform Improvement: To analyse aggregated, anonymised usage data in order to improve the design, performance, and game selection of the cv11 platform. Individual usage data is anonymised before being used for analytical purposes. Lawful basis: legitimate interest.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from competent authorities, and maintain records required under anti-money-laundering regulations. Lawful basis: legal obligation.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given explicit consent to receive such communications. You may withdraw marketing consent at any time. Lawful basis: consent.

cv11 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where such processing is explicitly required for fraud detection or regulatory compliance purposes, in which case you have the right to request human review of any automated decision affecting your account.

cv11 uses cookies — small text files stored on your device by your browser — and similar tracking technologies to operate essential platform functions and gather anonymised analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Required to maintain your authenticated session, remember your login state, apply your account settings, and process in-game actions. Without these cookies the platform cannot function. These cookies expire at the end of your browser session or after a defined period of inactivity.
• Performance and Analytics Cookies: Used to collect anonymised data about how players navigate the cv11 platform — which pages are visited most, where sessions begin and end, and which features are used. This data is aggregated and cannot identify any individual player. Retention: up to 13 months.
• Functionality Cookies: Used to remember preferences you have set — such as your preferred language, display settings, or game lobby filters — so that you do not need to re-configure them on each visit. Retention: up to 12 months.
• Security Cookies: Used to detect and prevent fraudulent activity, identify unusual access patterns, and protect against cross-site request forgery (CSRF) and session hijacking attacks. These cookies do not track behaviour across third-party sites.

cv11 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the cv11.io platform. Your browsing activity on cv11.io is not shared with advertising networks.

You may control cookie behaviour through your browser settings. Most modern browsers allow you to view, delete, and block cookies. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

cv11 does not sell your personal data. We share personal data only in the following limited circumstances, and only to the minimum extent necessary:

6.1 Payment Service Providers. Transaction data is shared with bKash, Nagad, Rocket, Upay, and card network processors (Visa, Mastercard) solely for the purpose of processing your deposit or withdrawal instructions. These providers operate under their own privacy policies and are independent data controllers in respect of the data they receive.

6.2 Identity Verification Partners. Where KYC verification is required, cv11 may share identity documents and biographic data with third-party verification service providers under data processing agreements that prohibit those providers from using your data for any purpose other than completing the verification requested by cv11.

6.3 Fraud Prevention Services. cv11 participates in industry fraud-prevention programmes. Device fingerprint data, IP data, and account behaviour patterns may be cross-referenced with fraud-detection databases to identify known fraudulent actors. No individually identifiable personal data is shared without a legitimate fraud-investigation basis.

6.4 Legal and Regulatory Authorities. cv11 will disclose personal data to competent law enforcement or regulatory authorities where required by law, where necessary to comply with a binding legal obligation, or where cv11 determines in good faith that disclosure is necessary to protect the safety of users or the integrity of the platform.

6.5 Business Transfers. In the event of a merger, acquisition, or sale of all or part of cv11's business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and of any material change to the privacy terms that results from it.

6.6 Game Content Providers. Game providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive a session token and anonymised player identifier in order to initialise and operate game sessions. These providers do not receive your name, contact details, financial data, or any other directly identifying personal information.

cv11 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and for as long as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of the active account relationship, plus a minimum of 5 years following permanent account closure, in compliance with anti-money-laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of the transaction, in accordance with financial record-keeping obligations.
• KYC Verification Documents: Retained for the duration of the account relationship plus 5 years post-closure. Documents will not be retained beyond this period unless required by an ongoing legal investigation or regulatory enquiry.
• Support Communications: Retained for 3 years from the date of the last communication in a support thread, or longer if the communication relates to an unresolved formal dispute.
• Technical and Usage Data: Retained in identifiable form for up to 24 months. Data older than 24 months is anonymised and may be retained indefinitely in aggregated form for statistical purposes.
• Marketing Consent Records: Retained for the duration of your account plus 3 years post-closure, as evidence of the consent basis for any marketing communications sent during that period.

Where there is no legal obligation requiring retention, cv11 will securely delete or irreversibly anonymise personal data once the purpose for which it was collected has been fulfilled. Deletion requests from players will be processed subject to any applicable legal retention obligations that may override the request.

cv11 implements a layered, defence-in-depth security architecture to protect the personal and financial data of all players. The following technical and organisational measures are in place:

• Encryption in Transit: All communications between your device and cv11 servers are encrypted using TLS 1.2 or higher with 256-bit AES encryption. HTTP connections are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive personal data fields — including identity document references, payment account identifiers, and KYC records — are encrypted at rest within cv11's database infrastructure using AES-256 encryption.
• Access Controls: Access to player personal data within cv11's internal systems is governed by a strict role-based access control (RBAC) policy. Only personnel whose job function requires access to a specific data category are granted that access. All internal data access is logged and audited.
• Password Security: Player passwords are stored as salted cryptographic hashes using bcrypt. Plaintext passwords are never stored or transmitted. cv11 cannot retrieve your password — only reset it via a verified mobile number.
• Fraud Detection Systems: Automated systems monitor account activity in real time for anomalous patterns indicative of account compromise, fraudulent deposits, or coordinated abuse. Alerts trigger immediate security review.
• Penetration Testing: cv11 conducts periodic security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

While cv11 employs industry-standard security practices, no online system can guarantee absolute security against all possible threats. In the event of a data breach that poses a material risk to players, cv11 will notify affected individuals through available contact methods without undue delay.

As a cv11 player, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our data team at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data cv11 holds about you. We will provide this in a structured, readable format within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Corrections to identity-sensitive fields (name, date of birth) may require supporting documentation.
• Right to Erasure: You may request that cv11 delete your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there are no overriding legitimate grounds. This right is subject to legal retention obligations that may require certain data to be kept for a defined period.
• Right to Restrict Processing: You may request that cv11 restrict the processing of your data — meaning we store it but do not actively use it — while a dispute about its accuracy or the lawfulness of its processing is being investigated.
• Right to Data Portability: For data you have provided directly to cv11 and which is processed on the basis of consent or contractual necessity, you may request that we provide it in a machine-readable format suitable for transfer to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interest grounds, including profiling for fraud prevention purposes. cv11 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent — such as marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal. To opt out of marketing communications, reply "STOP" to any cv11 promotional message or contact [email protected].

cv11 will not charge a fee for processing data rights requests in ordinary circumstances. If a request is manifestly unfounded or excessive, cv11 reserves the right to charge a reasonable administrative fee or decline to act on the request, providing written reasons for that decision.

The cv11 platform is strictly prohibited for use by persons under the age of 21. cv11 does not knowingly collect personal data from individuals under 21 years of age. If we become aware that a player account has been registered by or on behalf of a minor, that account will be immediately suspended, all funds will be withheld pending investigation, and any personal data associated with the minor will be securely deleted in accordance with this Policy.

If you are a parent or guardian and believe that a minor in your household has registered an account on the cv11 platform, please contact our support team immediately at [email protected]. We will investigate and act within 48 hours of receiving a credible report.

cv11 supports parental control tools and encourages households to deploy appropriate filtering software to prevent minors from accessing online gambling platforms. Age verification at the point of account registration and prior to first withdrawal is a mandatory requirement on the cv11 platform.

cv11 sends promotional communications — including bonus offers, tournament announcements, and seasonal promotions tied to events such as the BPL, IPL, T20 World Cup, Eid, and Pohela Boishakh — only to players who have explicitly opted in to receive such communications at the time of account registration or through their account settings.

Marketing messages are sent via SMS to the mobile number on file and/or via email where an email address has been provided. cv11 does not send unsolicited marketing messages to non-opted-in players.

You may opt out of all marketing communications at any time by:

• Replying "STOP" to any cv11 promotional SMS;
• Updating your communication preferences in your cv11 account settings; or
• Contacting [email protected] with the subject line "Marketing Opt-Out".

Opt-out requests will be processed within 5 business days. Note that even after opting out of marketing communications, you will continue to receive essential transactional messages relating to your account, such as deposit confirmations, withdrawal notifications, and security alerts.

The cv11 platform may contain references to, or integrate content from, third-party game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game powered by a third-party provider, a game session is established between your browser and the provider's game server. In this context, the game provider may receive technical session data necessary to run the game.

cv11 is not responsible for the privacy practices of third-party game providers. Players who have concerns about how a specific game provider handles session data are encouraged to review that provider's own privacy documentation. cv11 contractually requires game providers to handle any player-session data they receive in a manner consistent with industry data-protection standards.

The cv11 platform does not contain links to external websites outside of its own domain. This Policy does not apply to any third-party website, application, or service that is not directly operated by cv11.

cv11 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. When material changes are made, the "Last Updated" date at the top of this page will be revised, and where practicable, registered players will be notified via SMS or the contact email on file.

Your continued use of the cv11 platform after the publication of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with a material change to this Policy, you should close your account and cease using the platform before the effective date of the change.

We recommend that registered players review this Privacy Policy periodically to stay informed about how cv11 protects their personal data. The current version of this Policy is always accessible at cv11.io/privacy-policy.

For all privacy-related matters — including data access requests, deletion requests, marketing opt-outs, or general questions about this Policy — please contact our data protection team using the details below. All enquiries are handled exclusively in English.

When submitting a data rights request, please include your registered mobile number and a brief description of your request so that we can verify your identity and respond accurately. cv11 will not process data rights requests from unverified senders in order to protect against unauthorised access to player data.