CD22 Privacy Policy

This Privacy Policy applies to all services provided by CD22 through the website cd22.cash and any associated mobile interfaces. It describes how CD22 collects, uses, stores and shares personal information about players who register and use the CD22 platform, which offers online gaming, sports betting and esports betting services to players in Pakistan.

CD22 is the data controller in respect of all personal information collected through this platform. As data controller, CD22 determines the purposes and means of processing your personal data. If you have any questions about this policy or about how CD22 handles your data in practice, contact us at support@cd22.cash — a real person will respond.

By creating an account on CD22 and using the platform, you acknowledge that you have read this Privacy Policy and understand how your personal data will be handled. If you do not agree with any aspect of this policy, you should not use CD22's services. This policy should be read alongside the CD22 Terms and Conditions.

CD22 collects personal data through several channels: directly from you when you register and use the platform, automatically through your device and browser when you access the site, and from third parties such as identity verification services and payment processors. Here is a breakdown of what is collected and why.

Registration Information

When you create a CD22 account, we collect your full name, date of birth, Pakistani mobile number, email address and the password you set. This information is necessary to create and manage your account, verify your identity and communicate with you about your account activity. Without this information, we cannot provide you with a CD22 account.

Identity Verification (KYC)

Pakistani regulations require CD22 to verify the identity of players before processing withdrawals above certain thresholds. For this purpose, we may collect a copy of your Computerised National Identity Card (CNIC) or other government-issued identification, a selfie or live photograph and confirmation of your payment method. These documents are used exclusively for identity verification and are handled under strict access controls.

Payment Information

CD22 processes deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT bank transfers and Visa/Mastercard. We record transaction amounts, timestamps, payment method identifiers (such as your mobile wallet number or masked card number) and transaction status. Full payment credentials — such as card numbers or mobile banking PINs — are never stored by CD22. These are processed directly by our payment service providers using their own secure infrastructure.

Usage and Platform Data

When you use CD22, we automatically collect information about your sessions, including which games you play, betting history, session durations, wagering patterns and balance movements. This data is used to maintain your account records, detect unusual activity, fulfil responsible gaming obligations and improve the platform.

Technical Data

CD22 automatically receives technical information when you access the site, including your IP address, device type, browser version, operating system, referral URL and geographic location derived from your IP. This data is used to optimise the platform for your device, detect fraud, and analyse platform performance.

CD22 uses the personal data it collects for specific, clearly defined purposes. We do not use your data in ways that are incompatible with the purposes stated here.

• Account management: Creating and maintaining your CD22 account, processing your login sessions, managing your PKR balance and keeping your account records accurate and current.
• Processing transactions: Executing deposits, withdrawals and bonus credits correctly and in accordance with your instructions. Resolving transaction disputes where they arise.
• Identity verification and AML compliance: Verifying your identity in accordance with Know Your Customer (KYC) requirements and monitoring transactions for potential money laundering or fraud. These are legal obligations that CD22 must fulfil.
• Responsible gaming: Using your account activity data to identify potential signs of problem gambling and to enable the responsible gaming tools you have activated, such as deposit limits and self-exclusion.
• Platform improvement: Analysing aggregated, anonymised platform data to improve game selection, interface design, payment flows and overall player experience on CD22.
• Security and fraud prevention: Detecting and investigating suspicious account activity, multi-accounting, payment fraud and unauthorised access attempts.
• Customer support: Using your account history to resolve support queries accurately and efficiently.
• Marketing communications: Sending promotional emails and SMS messages where you have consented. You can withdraw consent at any time.

CD22 processes your personal data on the following legal grounds depending on the specific processing activity:

• Contractual necessity: Processing required to deliver the services you have signed up for — account management, transaction processing, game access. Without this processing, CD22 cannot operate your account.
• Legal obligation: KYC verification, AML monitoring and age verification are legal requirements. CD22 must process the relevant data to comply with applicable Pakistani financial crime prevention and consumer protection regulations.
• Legitimate interests: Security monitoring, fraud prevention and platform improvement are conducted under CD22's legitimate interest in running a secure and effective platform for all players, provided those interests do not override your individual privacy rights.
• Consent: Marketing communications — promotional emails and SMS — are sent only where you have provided explicit consent at registration or subsequently. Consent can be withdrawn at any time.

CD22 does not sell your personal data. Sharing is limited to what is operationally necessary and legally required. The following categories of third parties may receive your data in specified circumstances:

• Payment service providers: Easypaisa, JazzCash, NayaPay, SadaPay, IBFT-processing banks and card networks receive the minimum information necessary to process your transactions. These providers operate under their own privacy policies and security standards.
• Identity verification services: Third-party KYC providers may process your identity documents for verification purposes. CD22 uses only established, reputable services with appropriate data security certifications.
• Game software providers: CD22's game providers may receive anonymised session data necessary to deliver their games correctly. They do not receive your personally identifiable information for marketing or any other purpose.
• Regulatory and law enforcement bodies: CD22 is obligated to share information with Pakistani regulatory authorities, law enforcement agencies or financial intelligence units where required by law or court order. We cannot notify you in advance when disclosures of this nature are legally required to remain confidential.
• Professional advisers: Lawyers, auditors and compliance consultants who are contractually bound to maintain confidentiality may access data as necessary in the course of their professional services to CD22.

CD22 uses cookies and similar technologies to make the platform function correctly and to improve your experience. A cookie is a small text file stored on your device when you visit a website. Here is how CD22 uses them:

• Essential cookies: Required for the platform to function. These manage your login session, maintain your game state, remember your language preferences and keep your cart or bet slip active. You cannot opt out of essential cookies and continue using CD22, since they are technically necessary for the service to operate.
• Analytics cookies: CD22 uses analytics tools to understand how players navigate the platform — which pages are visited most, where players exit, how long sessions last. This data is aggregated and anonymised before analysis. It helps CD22 identify usability improvements and prioritise development work.
• Preference cookies: These store your display preferences, such as language settings and notification preferences, so you do not have to reset them every visit.

You can manage your cookie preferences through your browser settings. Blocking essential cookies will prevent you from using CD22. Blocking analytics or preference cookies will not affect your ability to play but may reduce the quality of your experience. CD22 does not use advertising or tracking cookies that follow you across third-party websites.

CD22 retains personal data for only as long as necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply:

• Account data (name, contact details, login history): Retained for the duration of the account and for five years following account closure.
• Transaction records (deposits, withdrawals, game stakes, winnings): Retained for seven years following each transaction to satisfy financial record-keeping obligations.
• KYC documents (CNIC copies, verification photographs): Retained for five years following account closure.
• Game session data (betting history, outcomes, session logs): Retained for five years following the relevant session date.
• Support communications (emails, chat transcripts): Retained for three years following the closure of each support case.
• Marketing consent records: Retained for as long as the consent is active plus three years following withdrawal of consent, in order to demonstrate compliance.

Following the expiry of the relevant retention period, CD22 will securely delete or anonymise the data in question. Anonymised data — from which no individual can be identified — may be retained indefinitely for statistical and platform improvement purposes.

CD22 implements technical and organisational security measures appropriate to the sensitivity of the data held and the risks involved. Security is a genuine operational priority, not a box-ticking exercise. The following measures are in place:

• TLS/SSL encryption on all data transmitted between your device and CD22's servers. Any data you send — login credentials, payment information, personal details — travels over an encrypted channel.
• Encrypted storage of sensitive data fields including passwords (stored as salted hashes, not in plaintext), CNIC copies and payment identifiers.
• Role-based access controls ensuring that only CD22 staff with a legitimate operational need can access personal data, and only at the level of detail their role requires.
• Regular security reviews including vulnerability assessments and penetration testing of CD22's platform infrastructure.
• Activity logging and monitoring to detect suspicious access patterns, unusual data queries or potential breaches in real time.

CD22 will notify affected players without undue delay in the event of a data breach that creates a real risk of harm to their rights and freedoms. We take such events seriously and have incident response procedures in place to minimise impact and recovery time.

CD22 respects your rights in relation to your personal data. As a registered CD22 player, you have the following rights, which you can exercise by contacting support@cd22.cash:

CD22 will respond to all data rights requests within 72 hours of verification of your identity. In complex cases, we may require up to 30 days. We will notify you of any extension and the reason for it. There is no charge for exercising your rights.

CD22 sends two types of communication: transactional and promotional. Transactional communications — deposit confirmations, withdrawal notifications, security alerts, responsible gaming reminders — are essential account communications and cannot be disabled. They are sent regardless of your marketing preferences.

Promotional communications — bonus offers, new game announcements, promotions and CD22 news — are sent only where you have provided explicit consent. You can provide or withdraw consent at any time through your account settings under Communication Preferences. You can also opt out of any marketing email by clicking the unsubscribe link included in every promotional message.

Withdrawing marketing consent will not affect your access to CD22 services in any way. Your account, balance and ability to play remain fully active regardless of your communication preferences.

CD22 is strictly an 18+ platform. The platform is not directed at persons under the age of 18 and we do not knowingly collect personal data from children. Age verification is carried out at registration and is enforced before first withdrawal. Any account found to belong to a person under 18 will be immediately and permanently closed.

If you believe a child has registered on CD22, please contact us immediately at support@cd22.cash. We will investigate and take appropriate action as a priority, including closing the account and returning any deposited funds to the originating payment method in line with applicable law.

CD22 may update this Privacy Policy from time to time to reflect changes in how we operate, changes in applicable law, or improvements in how we explain our practices. The date at the top of this page always reflects when the policy was last revised.

Where changes are material — meaning they significantly affect your privacy rights or how CD22 uses your data — we will notify you by email to your registered address and by a notice on the platform at least 7 days before the changes take effect. For minor clarifications or non-material updates, we may update the policy without advance notification beyond the revised date.

Continued use of CD22 following the effective date of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with a revised policy, you may close your account and request deletion of your data in accordance with Section 9.

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how CD22 has handled your personal information, please get in touch. Our team is available 24/7 and treats privacy queries as a priority.

When contacting CD22 about a privacy or data rights request, please include your registered mobile number or email address so we can verify your identity and process your request promptly. We do not require any additional personal information beyond what is necessary to confirm you are the account holder.