10cric Privacy Policy

1 Introduction

10cric is committed to protecting and respecting the privacy of every individual who uses its Platform. This Privacy Policy sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed by 10cric. It reflects our obligations to handle your data transparently, lawfully, and with appropriate security measures in place.

This policy should be read alongside the 10cric Terms and Conditions, which govern your use of the Platform. Terms not defined in this Privacy Policy carry the meanings assigned to them in the Terms and Conditions.

If you have any questions about how 10cric handles your personal data, you can contact us at any time by writing to [email protected]. We aim to respond to all privacy-related enquiries within five business days.

2 Data Controller

For the purposes of applicable data protection legislation, 10cric acts as the data controller in respect of personal data collected through the Platform. As data controller, 10cric determines the purposes and means by which your personal data is processed.

All data protection enquiries, access requests, and objections should be directed to the 10cric data contact point:

3 Personal Data We Collect

10cric collects different categories of personal data depending on the nature of your interaction with the Platform. The categories of data we collect are set out in the table below.

We do not collect any special categories of personal data (such as data concerning health, religion, ethnicity, or political opinions) unless such data is volunteered by you in the context of a responsible gaming request or support interaction, in which case it is handled with the highest level of confidentiality.

4 How We Collect Your Data

10cric collects your personal data through the following means:

4.1 Directly From You

• When you complete the registration form to open a 10cric account;
• When you submit KYC documentation for identity verification;
• When you make a deposit or request a withdrawal via the cashier;
• When you contact the support team via live chat or email;
• When you respond to a survey, promotion, or marketing communication;
• When you update your account settings or communication preferences.

4.2 Automatically

When you access and navigate the Platform, 10cric automatically collects Technical Data and Usage Data through cookies, log files, pixel tags, and similar tracking technologies. This data is collected to ensure the Platform functions correctly, to analyse performance, and to detect and prevent fraudulent activity. For more detail, please see the Cookies and Tracking section of this Privacy Policy.

4.3 From Third Parties

10cric may receive personal data about you from the following third-party sources:

• Payment processors — bKash, Nagad, Rocket, and Upay may share transaction confirmation data with us to validate deposits and withdrawals;
• Identity verification providers — third-party KYC service providers may share the results of document and biometric checks;
• Fraud prevention and AML screening services — we may receive risk signals or flags from services that help us comply with anti-money-laundering obligations;
• Analytics providers — aggregated and anonymised data from web analytics services to help us understand Platform usage trends.

5 How We Use Your Personal Data

10cric uses your personal data only for the purposes set out below. We do not use your data for any purpose that is incompatible with these stated purposes without first obtaining your explicit consent.

• Account administration — to create and maintain your registered account, verify your identity, and provide access to Platform features;
• Transaction processing — to process deposits and withdrawals in BDT, reconcile financial records, and prevent payment fraud;
• Legal and regulatory compliance — to fulfil our obligations under applicable anti-money-laundering (AML), know-your-customer (KYC), and counter-terrorism financing (CTF) requirements;
• Platform operation and security — to monitor Platform performance, detect and investigate suspicious activity, prevent fraud, and maintain the integrity of betting markets;
• Customer support — to respond to your enquiries, resolve disputes, and process complaints;
• Responsible gaming — to monitor gambling behaviour, apply self-exclusion requests, enforce deposit limits, and identify users who may be experiencing gambling-related harm;
• Personalisation — to tailor the Platform experience, including game recommendations and promotional offers, based on your usage history and preferences;
• Marketing communications — to send you promotional offers, bonus notifications, and Platform updates, where you have opted in to receive such communications. You may opt out at any time via your account settings;
• Analytics and product improvement — to analyse how users interact with the Platform and to improve our products, features, and services over time.

6 Legal Basis for Processing

10cric processes your personal data on the following legal grounds:

Where we rely on legitimate interests as the legal basis for processing, we have assessed that our interests are not overridden by your interests or fundamental rights. You have the right to object to processing carried out on the basis of legitimate interests; see the Your Privacy Rights section for details.

7 Sharing Your Personal Data

10cric does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment service providers — bKash, Nagad, Rocket, Upay, Visa, and Mastercard, solely for the purpose of processing your deposits and withdrawals;
• Identity verification and KYC providers — third-party services that assist with document verification and biometric checks in connection with our compliance obligations;
• Fraud prevention and AML screening services — to screen transactions and account activity against sanction lists and fraud databases;
• Game content providers — Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe, and other studio partners receive the minimum data necessary to deliver game content and verify session integrity. These providers operate under their own data protection frameworks;
• IT infrastructure and cloud service providers — hosting, database management, and security monitoring services that process data on our behalf under strict data processing agreements;
• Legal and regulatory authorities — where required by applicable law, court order, or regulatory direction, 10cric may disclose personal data to law enforcement agencies or financial regulators without prior notice to the affected user;
• Professional advisers — legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

8 Data Retention

10cric retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Account and identity data — retained for the duration of your account registration and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements;
• Transaction and financial records — retained for a minimum of five (5) years from the date of each transaction;
• KYC documentation — retained for a minimum of five (5) years following account closure or the completion of the last transaction, whichever is later;
• Support communications — retained for a minimum of two (2) years from the date of the last interaction;
• Marketing preference data — retained until you withdraw consent, after which it is deleted within thirty (30) days;
• Technical and usage data (logs) — typically retained for twelve (12) months for security monitoring purposes, then anonymised or deleted.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes without restriction.

9 Data Security

10cric takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 10cric Platform;
• Encryption of sensitive data fields (including payment credentials and identity document data) at rest in our databases;
• Strict role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their role;
• Regular internal security reviews, vulnerability assessments, and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for administrative access to systems holding personal data;
• Automated fraud monitoring and anomaly detection systems that flag unusual account activity in real time.

Whilst 10cric implements robust security measures, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. You are responsible for keeping your own account credentials confidential and for notifying us promptly at [email protected] if you suspect any unauthorised access to your account.

10 Cookies and Tracking Technologies

The 10cric Platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain session continuity, and gather analytics data. The categories of cookies we use are described below.

You can control non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of the Platform. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate securely.

11 Your Privacy Rights

Subject to applicable law and verification of your identity, you hold the following rights in relation to your personal data held by 10cric:

• Right of Access — you have the right to request a copy of the personal data we hold about you and information about how it is processed;
• Right to Rectification — you have the right to request correction of any inaccurate or incomplete personal data we hold about you;
• Right to Erasure — you have the right to request deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected. Note that this right may be limited by our legal obligations to retain records under AML and KYC regulations;
• Right to Restrict Processing — you have the right to request that we restrict processing of your personal data in certain circumstances, for example whilst a dispute about the accuracy of the data is resolved;
• Right to Data Portability — where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, machine-readable format;
• Right to Object — you have the right to object to processing of your personal data based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing communications), you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request". We will respond within thirty (30) calendar days. We may ask you to verify your identity before processing your request.

12 Minors and Age Restriction

If you believe that a person under the age of 18 has registered on the 10cric Platform, please notify us immediately at [email protected]. We take all such reports seriously and will investigate promptly.

13 International Data Transfers

As an offshore online platform serving the Bangladesh market, 10cric may transfer your personal data to and process it in countries outside Bangladesh. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that which it would receive in its country of origin.

Specifically, international transfers are conducted only:

• To countries or organisations that provide an adequate level of data protection as recognised by applicable data protection standards;
• Under the protection of appropriate contractual clauses or data processing agreements that impose obligations on the recipient equivalent to those applicable to 10cric; or
• Where the transfer is necessary for the performance of your contract with 10cric (e.g., processing a payment via an international card network such as Visa or Mastercard).

Game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may process limited user session data in their respective operating jurisdictions as part of delivering live and digital game content. These providers operate under their own data protection certifications and are contractually bound to handle data securely.

14 Changes to This Privacy Policy

10cric may update this Privacy Policy from time to time to reflect changes in our data practices, operational requirements, or applicable law. When we make material changes, we will notify registered users via email or a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is always shown at the top of this document. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any update constitutes your acceptance of the revised policy. If you do not agree with the updated Privacy Policy, you must cease using the Platform and may request account closure by contacting our support team.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 10cric handles your personal data, please contact us using the details below. We treat all privacy enquiries as a priority and aim to provide a substantive response within five business days.

For responsible gaming concerns or self-exclusion requests, please visit our Responsible Gaming page, which contains dedicated self-exclusion tools and support resources available to all registered users.