Privacy Policy – cd22 Pakistan Online Gaming Platform

1. Who We Are

cd22 is an online gaming platform operating at cd22.link, serving registered players across Pakistan. When this Privacy Policy refers to "cd22," "we," "us" or "our," it means the entity responsible for operating the cd22 platform and all services associated with it. cd22 acts as the data controller for all personal information collected through the platform.

cd22 is committed to protecting the privacy of every person who interacts with the platform — whether as a registered player, a visitor to the website or someone contacting our support team. This Privacy Policy describes our practices in full. If you have any questions about how your data is handled, you can contact us directly at support@cd22.link.

2. Data We Collect

cd22 collects personal data only where it is necessary to provide the platform's services, comply with legal obligations or improve the user experience. Below is a full breakdown of the categories of data we collect:

2.1 Account & Identity Data

• Full legal name
• Date of birth (for age verification)
• Mobile number (Pakistan-registered)
• Email address (where provided)
• Username and encrypted password
• CNIC number or equivalent government-issued ID number (for KYC verification)
• Copies of identity documents submitted during KYC (stored in encrypted form)

2.2 Financial Data

• Easypaisa or JazzCash account number associated with your cd22 account
• NayaPay or SadaPay wallet identifiers (where applicable)
• Bank account number for IBFT transfers (masked, not stored in full)
• Visa or Mastercard debit card last four digits and expiry date (full card data is never stored on cd22 servers)
• Transaction history: deposit amounts, withdrawal requests, bonus claims and wagering records

2.3 Usage & Technical Data

• IP address and approximate geographic location at the time of login
• Device type, operating system version and browser type
• Session timestamps, login history and session duration
• Pages visited within the cd22 platform and click interaction data
• Game participation records: games played, bets placed, outcomes and tournament entries

2.4 Communication Data

• Messages sent through the cd22 live chat support system
• Email correspondence sent to cd22 support addresses
• Records of promotional notifications sent and whether they were opened or actioned

3. How We Collect Your Data

cd22 collects personal data through the following channels:

cd22 does not purchase personal data from third-party data brokers. All data collected originates directly from your interactions with the platform or from regulated payment processing partners who operate under their own strict privacy obligations.

4. Why We Use Your Data

Every piece of data cd22 collects is used for a specific, documented purpose. We do not collect data speculatively. The main purposes are:

• Account creation and management: To create and maintain your cd22 account, verify your identity, and enable secure login.
• Payment processing: To facilitate deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card payment partners.
• Age and identity verification (KYC): To confirm that every cd22 player is aged 18 or above and is who they say they are, in compliance with our operational obligations.
• Platform operation and game integrity: To run games fairly, detect cheating, collusion or fraudulent activity, and maintain the integrity of outcomes across all game categories.
• Promotions and bonuses: To apply welcome bonuses, cashback, reload offers and tournament rewards correctly to eligible accounts.
• Customer support: To respond to queries, investigate complaints and resolve disputes raised through the live chat or email channel.
• Legal compliance: To meet obligations under applicable Pakistani law, including anti-money-laundering (AML) requirements and any court orders or regulatory instructions received.
• Security and fraud prevention: To detect unusual login patterns, suspicious transaction behaviour or technical attacks on the platform.
• Platform improvement: Anonymised and aggregated usage data is analysed to improve platform performance, identify popular features and fix technical issues.

cd22 will never use your personal data for purposes beyond those listed above without first obtaining your explicit consent or being legally required to do so.

5. Legal Basis for Processing

cd22 processes your personal data on the following legal grounds, each of which applies to specific processing activities:

• Contractual necessity: Processing required to fulfil the Terms and Conditions you accepted when creating your cd22 account — including account operation, payment processing and game participation.
• Legal obligation: Processing necessary to comply with applicable law — such as identity verification, AML reporting obligations and responding to lawful authority requests.
• Legitimate interests: Processing where cd22 has a genuine operational interest that does not override your rights — such as fraud detection, platform security and anonymised analytics.
• Consent: Processing that relies on your voluntary agreement — such as receiving marketing notifications or promotional emails from cd22. You may withdraw consent at any time by updating your notification preferences in the account settings.

6. Data Sharing & Third Parties

cd22 does not sell your personal data to any third party. We share personal data only in the following limited and controlled circumstances:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay and banking partners receive the minimum financial identifiers necessary to process your deposit or withdrawal. These partners operate under their own privacy policies and are bound by applicable financial regulations in Pakistan.
• KYC verification services: Identity documents submitted for age and identity verification may be processed through a certified third-party KYC provider. This provider is contractually bound to process data solely for verification purposes.
• Technology and hosting infrastructure: cd22 uses third-party cloud infrastructure providers to host the platform. These providers have access to technical data for operational purposes only and are bound by strict data processing agreements.
• Legal authorities: Where cd22 receives a lawful request from a Pakistani court, law enforcement agency or regulatory body, we will comply with the legal obligation to disclose relevant data. We will notify affected players where the law permits us to do so.
• Fraud and integrity services: cd22 may use specialised fraud detection services that analyse transaction and login behaviour. These services process data under contract and may not use it for any other purpose.

7. Cookies & Tracking Technologies

cd22 uses cookies and similar technologies to keep the platform functioning correctly, maintain your session while you are logged in, and understand how the platform is used so we can make it better. The types of cookies used on cd22 are as follows:

• Essential cookies: Required for the platform to function. These maintain your login session, store your language preference and enable the shopping cart equivalent for bonus claims. Without these, cd22 cannot work. You cannot opt out of essential cookies while using the platform.
• Analytics cookies: Used to collect anonymised and aggregated data about how visitors use the cd22 platform — such as which pages are most visited and how long sessions typically last. This data does not identify you personally and is used solely to improve the platform.
• Preference cookies: Remember your display preferences and settings so you do not have to reconfigure them each visit.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity and other security threats.

Most browsers allow you to control cookies through their settings. Disabling certain cookies may affect the functionality of the cd22 platform — in particular, disabling essential session cookies will prevent you from staying logged in.

8. Data Security

cd22 takes the security of your personal data seriously and applies industry-standard technical and organisational measures to protect it from unauthorised access, disclosure, alteration or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the cd22 platform.
• Encrypted storage for sensitive personal data including KYC documents and financial identifiers, using AES-256 encryption at rest.
• PCI-DSS compliant payment processing — card data is processed exclusively through certified payment gateways and is never stored on cd22 servers.
• Access controls: Access to personal data by cd22 staff is restricted to those who need it for their specific job function. Access is logged and audited regularly.
• Regular security audits and penetration testing of the cd22 platform to identify and remediate vulnerabilities before they can be exploited.
• Incident response procedures: In the event of a data breach that affects your rights, cd22 will notify affected players within 72 hours of becoming aware of the breach.

9. Data Retention

cd22 retains your personal data only for as long as it is necessary for the purposes described in this Policy or required by applicable law. The following retention periods apply:

• Active account data: Retained for the duration of your cd22 account plus up to 5 years after closure, to satisfy financial record-keeping and AML legal requirements.
• KYC documents: Retained for a minimum of 5 years after the account closure date in accordance with applicable anti-money-laundering regulations.
• Transaction records: Retained for 5 years from the date of the transaction, as required for financial audit purposes.
• Support communications: Retained for 2 years from the date of the last interaction to assist in dispute resolution.
• Analytics data: Anonymised and aggregated — not subject to a fixed retention limit as it cannot identify individuals.
• Marketing consent records: Retained until consent is withdrawn, plus 2 years to evidence the consent history.

When data is no longer required and no legal obligation mandates its retention, cd22 securely deletes or anonymises it so that it can no longer be linked back to you.

10. Your Data Rights

As a cd22 player, you have the following rights over your personal data. These rights are genuine and exercisable — not procedural formalities. To exercise any of these rights, contact cd22 support at support@cd22.link with the subject line "Data Rights Request – [Your Account ID]."

11. Minors & Under-18 Protection

cd22 is strictly a platform for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If it comes to our attention that a minor has successfully created an account on cd22, we will immediately close that account, void any associated transactions and securely delete the personal data collected, except where legal obligations require temporary retention for investigation purposes.

If you believe a minor has created an account on cd22, please contact us immediately at support@cd22.link so we can take action without delay.

12. Third-Party Links

The cd22 platform does not contain links to third-party websites for commercial purposes. Where references to third-party payment providers (Easypaisa, JazzCash etc.) appear in informational content, these are named for your guidance only and do not constitute endorsements. cd22 is not responsible for the privacy practices of any third-party service provider, including payment partners. We encourage you to review the privacy policy of any service you use alongside cd22.

13. Changes to This Privacy Policy

cd22 may update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements to our platform. When a material change is made — one that meaningfully affects how your personal data is used — cd22 will notify registered players via the account notification inbox and, where appropriate, via the mobile number registered to the account.

The revised Policy will be published on this page with an updated "Last Updated" date at the top. We recommend checking this page periodically. Your continued use of cd22 after any update to this Policy constitutes your acceptance of the revised version. If you do not agree with a material change, you are entitled to request account closure before the change takes effect.

14. Contact Us & Privacy Complaints

If you have any questions about this Privacy Policy, want to exercise your data rights, or wish to make a formal privacy complaint, please contact cd22 using the details below. All privacy-related queries are handled in both English and Urdu.

• Email: support@cd22.link — please use the subject line "Privacy Query – [Your Account ID]"
• Live Chat: Available 24/7 via the chat widget on the cd22 platform
• Response time: cd22 will acknowledge your privacy request within 24 hours and aim to resolve it within 30 calendar days

If you are not satisfied with how cd22 handles your privacy complaint after following our internal process, you may refer the matter to the appropriate regulatory authority in Pakistan.