criczo Privacy Policy

1. Introduction

This Privacy Policy ("Policy") applies to the criczo online casino and sports betting platform, accessible at criczo.org ("Platform"), and governs the collection, processing, storage, and disclosure of personal data relating to registered players and visitors ("you", "your").

criczo is committed to handling your personal information responsibly, transparently, and securely. We recognise that privacy is a fundamental right and that the trust you place in us when you share your personal data carries significant responsibility. This Policy is designed to give you clear, honest information about our data practices so you can make informed choices about your engagement with the Platform.

This Policy should be read alongside the criczo Terms & Conditions and Responsible Gaming Policy, each of which forms part of your agreement with criczo. Where any conflict exists between this Policy and those documents regarding the handling of personal data, this Policy shall prevail.

If you have any questions about this Policy or about how your data is handled, please contact the criczo Data Support team at [email protected] at any time.

2. Data We Collect

criczo collects personal data in several categories depending on the nature of your interaction with the Platform. The following table summarises the categories of data collected and the primary source of each:

2.1 Data You Choose Not to Provide. Where providing certain data is optional, you may decline. However, some data is required for the Platform to function correctly — for example, identity and contact data are mandatory for account registration, and financial data is required to process deposits and withdrawals. Declining to provide required data may limit your ability to use certain features of the Platform.

2.2 Sensitive Data. criczo does not intentionally collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data) except where strictly required for identity verification purposes (e.g., facial liveness checks to confirm that KYC documents belong to the account holder). Such data is processed solely for the purpose of verification and is not retained beyond what is necessary for that purpose.

3. How We Use Your Data

criczo uses the personal data it collects for the following purposes:

• Account Management: To create, maintain, and administer your player account, including processing registration, verifying your identity, and managing your account preferences.
• Transaction Processing: To process deposits, withdrawals, and bonus credits via your chosen payment method (bKash, Nagad, Rocket, Upay, or USDT), and to maintain accurate financial records of all transactions.
• KYC & Fraud Prevention: To verify your identity and age in compliance with our anti-money-laundering and responsible gaming obligations, and to detect, investigate, and prevent fraudulent, illegal, or abusive activity on the Platform.
• Platform Operations: To deliver the games, sportsbook markets, and other services you access through criczo, including personalising your experience based on your gaming history and preferences.
• Customer Support: To respond to your enquiries, complaints, and support requests in a timely and informed manner, and to maintain records of all communications for quality assurance purposes.
• Responsible Gaming: To monitor your gaming activity for signs of problematic behaviour, to enforce self-exclusion requests and deposit limits, and to comply with our Responsible Gaming Policy.
• Security: To protect the integrity of the Platform and the safety of all players by monitoring for unauthorised access, suspicious login attempts, and system vulnerabilities.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including responding to lawful requests from government authorities and maintaining financial records as required by law.
• Communications: To send you transactional communications (account notifications, deposit confirmations, withdrawal updates), operational alerts, and — where you have opted in — promotional communications about criczo offers relevant to Bangladesh players.
• Analytics & Improvement: To analyse aggregate, anonymised usage data to improve the Platform's performance, game offerings, and user experience.

criczo does not use automated decision-making or profiling in ways that produce significant legal or similarly significant effects on you without human oversight. Where automated processes are used (e.g., fraud scoring), material decisions are subject to human review upon request.

4. Legal Basis for Processing

criczo processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations to you under the criczo Terms & Conditions — including account management, transaction processing, and game delivery.
• Legitimate Interests: Processing conducted for purposes of fraud prevention, platform security, responsible gaming monitoring, and analytics, where these interests are not overridden by your rights and interests.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, age verification requirements, and financial record-keeping obligations.
• Consent: Processing for optional purposes, such as sending promotional communications. Where consent is the basis for processing, you have the right to withdraw that consent at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

5. Data Sharing & Disclosure

criczo does not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of third party only where strictly necessary and under appropriate contractual protections:

• Payment Processors: bKash, Nagad, Rocket, Upay, and USDT network partners require transaction-level data (amount, account reference, timestamp) to process your deposits and withdrawals. These processors operate under their own privacy policies and applicable financial regulations.
• KYC / Identity Verification Providers: Third-party KYC service providers are engaged to assist with identity and age verification. They receive only the data necessary for verification and are contractually prohibited from using it for any other purpose.
• Game Content Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session identifiers to facilitate game delivery and fair-play auditing. No personally identifiable data is shared with game providers beyond what is technically necessary for session management.
• IT Infrastructure & Security Providers: Hosting, cybersecurity, and platform monitoring providers may have access to technical data as part of their service delivery. All such providers are subject to binding data processing agreements.
• Legal & Regulatory Authorities: criczo may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law or in response to a lawful legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of criczo's assets, personal data held by criczo may be transferred to the successor entity, subject to equivalent privacy protections.

In all cases of third-party data sharing, criczo applies the principle of data minimisation — sharing only the minimum data necessary for the stated purpose.

6. Cookies & Tracking Technologies

6.1 What Are Cookies. Cookies are small text files stored on your device when you visit a website. criczo uses cookies and similar tracking technologies (such as local storage and session tokens) to maintain your login session, remember your preferences, and understand how players use the Platform in aggregate.

6.2 Types of Cookies Used. criczo uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security tokens that protect your account. These cannot be disabled without affecting core functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred game categories, and display options. These improve your experience but are not essential.
• Analytics Cookies: Used to collect anonymised, aggregate data about how players navigate and use the Platform. This data helps criczo identify areas for improvement. No personally identifiable information is transmitted through analytics cookies.

6.3 What criczo Does Not Use. criczo does not deploy third-party advertising cookies, cross-site tracking pixels, or social media tracking widgets on the Platform. Your browsing activity on criczo is not shared with advertising networks.

6.4 Managing Cookies. You may control cookie behaviour through your browser settings. Most browsers allow you to view, block, or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

7. Data Security

criczo implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS Encryption: All data in transit between your device and the criczo Platform is encrypted using TLS 1.2 or higher, providing end-to-end protection for all communications.
• Encryption at Rest: Sensitive data fields — including identity documents, financial account references, and KYC materials — are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within criczo's internal systems is restricted to authorised personnel on a strict need-to-know basis. All staff with data access undergo regular security training.
• Intrusion Detection: criczo's infrastructure is monitored 24/7 for suspicious activity, with automated alerting and incident response protocols in place.
• Regular Security Audits: The Platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Password Hashing: Player passwords are never stored in plain text. Passwords are hashed using a secure one-way cryptographic algorithm (bcrypt or equivalent) with individual salting.

While criczo takes all reasonable steps to protect your data, no online system is entirely immune to risk. You are encouraged to use a strong, unique password for your criczo account and to notify us immediately at [email protected] if you suspect any unauthorised access to your account.

8. Data Retention

criczo retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction. Where data is anonymised rather than deleted, the resulting data set cannot be used to identify you and is no longer subject to this Privacy Policy.

9. Your Rights

As a player whose personal data is processed by criczo, you have the following rights in relation to your data:

• Right of Access: You have the right to request a copy of the personal data that criczo holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update basic account information directly through your account dashboard; for corrections to identity or KYC data, please contact [email protected].
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and no other legal basis applies. This right is subject to criczo's legal obligations to retain certain records.
• Right to Restriction: You have the right to request that processing of your personal data be restricted in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate interests.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on criczo's legitimate interests. criczo will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., receipt of marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of the above rights, please submit a written request to [email protected], including your full name, registered email address, and a clear description of the right you wish to exercise. criczo will respond to all verified requests within thirty (30) days of receipt. Where a request is particularly complex or numerous, this period may be extended by a further sixty (60) days, with advance notice provided.

criczo will not charge a fee for responding to data rights requests unless requests are manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply.

10. Children's Privacy

The criczo Platform is strictly intended for individuals aged 18 years and above. criczo does not knowingly collect or process personal data relating to individuals under the age of 18. If you believe that a person under the age of 18 has created an account or provided personal data to criczo, please notify us immediately at [email protected]. Upon receiving and verifying such a report, criczo will take prompt action to close the relevant account and delete the associated personal data.

criczo employs age verification measures as part of the registration process and during KYC verification to minimise the risk of underage registration. Parents and guardians are encouraged to use parental control tools to restrict access to online gambling platforms from devices used by minors.

11. Third-Party Services

The criczo Platform integrates third-party services, including game content from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, as well as payment processing services from bKash, Nagad, Rocket, and Upay. Each of these third parties operates under its own privacy policy and terms of service.

While criczo takes care to engage only reputable partners and requires them to maintain appropriate data protection standards, criczo is not responsible for the privacy practices of third-party services accessed through or in connection with the Platform. We encourage you to review the privacy policies of any third-party service provider whose services you use in connection with criczo.

Where criczo engages third-party data processors, it does so under written data processing agreements that require those processors to handle your data only on criczo's documented instructions, to implement appropriate security measures, and to assist criczo in responding to data rights requests.

12. Policy Updates

criczo reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, criczo will notify registered Players via the email address associated with their account at least seven (7) days before the revised Policy takes effect. For minor or administrative changes, the updated Policy will be published on this page with a revised "Last Updated" date, effective immediately.

We encourage you to review this Privacy Policy periodically to stay informed about how your personal data is handled. Your continued use of the criczo Platform following notification of any update constitutes your acceptance of the revised Privacy Policy.

The version history of this Policy is maintained internally. If you wish to obtain a copy of a prior version of this Policy, please contact [email protected] with your request.

13. Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the criczo Data Support team using the following channel:

criczo aims to acknowledge all privacy-related enquiries within 24 hours (BST) and to provide a substantive response within thirty (30) days. This Privacy Policy was last reviewed and updated on 1 January 2026 and is effective from that date.