ec33 Privacy Policy

1 Data Controller

The data controller responsible for the personal data collected through ec33.io is the operator of the ec33 platform ("ec33" or "the Company"). As data controller, ec33 determines the purposes and means by which personal data is processed. For all data-related enquiries, including the exercise of your rights under this Policy, please contact us at [email protected] (plain text — not a clickable link).

ec33 is committed to operating a transparent, accountable data processing environment. Where ec33 engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual data processing agreements that require them to handle data only according to ec33's documented instructions.

2 Data We Collect

ec33 collects personal data across several categories depending on how you interact with the platform. The table below summarises the categories of personal data we may hold about you:

ec33 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly required for legally mandated identity verification. Where identity documents submitted for KYC contain such data incidentally, it is processed solely for verification purposes and is not used for any other purpose.

3 How We Collect Data

ec33 collects personal data through the following channels:

• Direct interactions: Data you provide when creating your account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or updating your account profile.
• Automated technologies: Technical data collected automatically when you access ec33.io, including cookies, server logs, device fingerprinting, and session analytics. See Section 9 for full details on our cookie practices.
• Payment processors: Transaction confirmation data shared with ec33 by bKash, Nagad, Rocket, Upay, and other supported payment partners when you initiate a deposit or withdrawal.
• Identity verification partners: KYC service providers may return verified identity data or risk-scoring outputs to ec33 as part of the account verification process.
• Fraud prevention services: Third-party fraud detection tools may cross-reference data with their databases and return risk indicators that inform ec33's account review decisions.

ec33 does not purchase personal data from data brokers or third-party list providers, and does not collect personal data about individuals who have not actively engaged with the ec33 platform.

4 Purpose & Legal Basis for Processing

ec33 processes personal data only where a valid legal basis exists. The following table sets out the primary purposes for which we process your data and the corresponding legal basis for each:

Where ec33 processes data on the basis of legitimate interests, we conduct a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. You may request information about any such balancing assessment by contacting [email protected].

5 Data Sharing

ec33 does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. We may share your personal data with the following categories of recipients only to the extent strictly necessary:

• Payment service providers (bKash, Nagad, Rocket, Upay, and partner banks) — to process deposits, withdrawals, and transaction confirmations.
• KYC and identity verification partners — to verify your identity, age, and source of funds in compliance with applicable regulations.
• Fraud prevention and security services — to detect, investigate, and prevent fraudulent activity, money laundering, and other financial crime.
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe) — limited technical data (such as player session tokens) necessary to deliver live casino and slot game content within the platform.
• IT infrastructure and hosting providers — cloud hosting and content delivery partners who store and serve the ec33 platform under strict data processing agreements.
• Legal and regulatory authorities — where ec33 is required by applicable law, court order, or a lawful request from a competent authority to disclose personal data.

All third-party service providers who process personal data on behalf of ec33 are subject to binding contractual obligations that restrict their use of your data solely to the purposes for which it was shared, and require them to implement appropriate technical and organisational security measures.

6 International Data Transfers

Some of ec33's service providers — including game studios and cloud infrastructure partners — are located outside Bangladesh. Where personal data is transferred internationally, ec33 takes steps to ensure an adequate level of protection is applied to that data, equivalent to the protections described in this Policy.

Safeguards applied to international transfers may include contractual data processing agreements that incorporate standard data protection clauses, or reliance on the recipient organisation's participation in a recognised privacy framework. You may request details of the specific safeguards applied to any international transfer by contacting us at [email protected].

7 Retention Periods

ec33 retains personal data for the period necessary to fulfil the purpose for which it was collected, and for any additional period required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the lifetime of the account and for a minimum of five (5) years following permanent account closure, in order to meet anti-money laundering record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of the transaction, or longer if required by applicable financial regulations.
• KYC verification documents: Retained for the duration of the account and for five (5) years post-closure.
• Customer support communications: Retained for three (3) years from the date of the interaction, or until a related dispute is fully resolved.
• Technical and gameplay data: Retained for up to two (2) years from collection for analytics and fraud prevention purposes, after which it is anonymised or deleted.
• Marketing preference records: Retained for the lifetime of the account or until consent is withdrawn, whichever is earlier.

When the applicable retention period expires, data is securely deleted or irreversibly anonymised such that it can no longer be associated with an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and business analysis purposes.

8 Security Measures

ec33 implements a comprehensive set of technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the ec33 platform.
• Encryption at rest for sensitive data fields including payment details, identity documents, and authentication credentials.
• Access controls — personal data is accessible only to ec33 personnel with a legitimate need to process it for their specific role. Access is logged and reviewed regularly.
• Penetration testing and vulnerability assessments conducted periodically to identify and remediate security weaknesses in the platform infrastructure.
• Secure password storage using industry-standard hashing algorithms. ec33 does not store passwords in plain text under any circumstances.
• Incident response procedures — in the event of a data breach that poses a risk to your rights and freedoms, ec33 will notify affected players and relevant authorities as required by applicable data protection law.

While ec33 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is 100% secure. You are encouraged to use a strong, unique password for your ec33 account and to notify us immediately at [email protected] if you suspect that your account credentials have been compromised.

9 Cookies & Tracking Technologies

ec33 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. Cookies allow ec33 to recognise your device, maintain your session, and personalise your experience.

The types of cookies used on ec33.io include:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a session. These cookies cannot be disabled.
• Functional cookies: Used to remember your preferences, such as responsible gaming settings and display preferences, so you do not have to re-enter them on each visit.
• Analytics cookies: Used to collect aggregated, anonymised information about how players use ec33.io — for example, which pages are visited most frequently and how long sessions last. This data helps ec33 improve the platform experience.
• Security cookies: Used to support fraud detection, bot detection, and account security monitoring.

ec33 does not use third-party advertising or retargeting cookies that track your browsing activity across unrelated external websites. You may configure your browser to refuse cookies; however, doing so may affect the functionality of the ec33 platform, including the ability to maintain a logged-in session.

10 Your Rights

As a player whose personal data is processed by ec33, you have the following rights, which you may exercise at any time by contacting [email protected]:

• Right of access: You may request a copy of the personal data ec33 holds about you, along with information about how it is processed.
• Right to rectification: You may request that inaccurate or incomplete personal data held about you be corrected or updated.
• Right to erasure: In certain circumstances, you may request that ec33 delete your personal data. This right is subject to legal retention obligations — ec33 may be required to retain certain data even after an account is closed.
• Right to restriction: You may request that ec33 restrict the processing of your personal data in certain circumstances, for example while a dispute about accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or the performance of a contract, you may request a copy of your personal data in a structured, machine-readable format.
• Right to object: You may object to the processing of your personal data where ec33 relies on legitimate interests as the legal basis, including profiling for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

ec33 will respond to all verified rights requests within thirty (30) days of receipt. Where a request is complex or numerous, ec33 may extend this period by a further thirty (30) days, and will notify you of the extension and the reason within the initial thirty-day window. ec33 will not charge a fee for processing a rights request unless it is manifestly unfounded or excessive.

11 Children & Minors

ec33 strictly prohibits the use of its platform by individuals under the age of 21 years. ec33 does not knowingly collect or process personal data relating to persons under 21. If ec33 discovers that personal data belonging to a person under 21 has been collected — whether through a false declaration at registration or any other means — that data will be deleted immediately and the associated account permanently closed.

If you are a parent or guardian and believe that a minor in your care has registered an account on ec33, please contact [email protected] immediately with details, and ec33 will investigate and act promptly.

12 Marketing Communications

ec33 sends promotional communications — including bonus offers, game announcements, and seasonal promotions — only to players who have opted in to receive such communications. Marketing communications are sent by email and/or SMS to the contact details registered on your account.

You may withdraw your consent to receive marketing communications at any time by:

• Using the unsubscribe link included in any marketing email;
• Updating your communication preferences in your ec33 account settings; or
• Contacting our support team at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent will be processed within five (5) business days. Please note that withdrawing marketing consent does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal processing updates, and account security alerts — which are sent on the basis of contract performance and cannot be opted out of while your account remains active.

13 Changes to This Policy

ec33 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. When material changes are made — that is, changes that meaningfully affect how your personal data is used or your rights in relation to it — ec33 will provide advance notice by posting a prominent notice on the ec33.io homepage and, where possible, by direct notification to your registered account email address.

The "Last updated" date at the top of the legal document section reflects the date on which the most recent version of this Policy became effective. We encourage you to review this Privacy Policy periodically to remain informed about how ec33 protects your data. Continued use of the ec33 platform after the effective date of a revised Policy constitutes your acknowledgement of the updated terms.

14 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how ec33 has handled your personal data, please contact us using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Response time: Within 24 hours for general enquiries; rights requests responded to within 30 days
• Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6)
• Language: English

ec33 takes all privacy complaints seriously. Upon receiving your complaint, we will acknowledge receipt, investigate the matter thoroughly, and provide a written response. If you are not satisfied with our response, you may escalate the matter to the appropriate data protection authority in your jurisdiction.