ceston Privacy Policy

1. Data We Collect

1.1 Information You Provide Directly

When you register an account on ceston or interact with our services, you voluntarily provide us with certain personal information. This includes:

• Identity data: Full legal name, date of birth, gender, and nationality.
• Contact data: Email address, mobile phone number, and residential address (including city, district, and postal code).
• Account credentials: Username and password (passwords are stored in hashed form and are never accessible to ceston staff in plain text).
• Identity verification documents: Copies of your national ID card, passport, or utility bill where required to complete Know Your Customer (KYC) verification.
• Payment data: Mobile financial service account references (bKash, Nagad, Rocket, Upay) and bank account details where applicable for withdrawal processing. We do not store full payment credentials on our servers.
• Communications: The content of messages you send to our support team via live chat or email.

1.2 Information Collected Automatically

When you access the ceston platform, our systems automatically collect certain technical and behavioural data including:

• IP address, browser type and version, operating system, and device identifiers.
• Pages visited, time spent on each page, game sessions initiated, bets placed, and navigation paths.
• Session timestamps, login and logout times, and geographic location at the district level (derived from your IP address — not GPS data).
• Referring URLs (the webpage from which you arrived at ceston.net).

1.3 Information From Third Parties

In certain circumstances, ceston may receive information about you from third-party sources, including:

• Payment processors (transaction status and confirmation references from bKash, Nagad, Rocket, and Upay).
• Fraud prevention and identity verification service providers.
• Publicly available databases used for anti-money-laundering and sanctions screening.

2. How We Use Your Data

ceston processes your personal data only for specific, lawful purposes. The table below maps each processing activity to its legal basis and operational rationale.

3. Data Sharing & Disclosure

3.1 Service Providers

ceston works with a limited number of trusted third-party service providers who process personal data on our behalf strictly in order to deliver our services. These providers are contractually bound to process data only according to our documented instructions, to maintain appropriate security standards, and to refrain from using the data for any independent purpose. Categories of such providers include:

• Payment gateway operators (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank) for deposit and withdrawal processing.
• Identity verification and KYC technology providers.
• Fraud detection and cybersecurity firms.
• Cloud hosting and data centre providers that store the platform's infrastructure.
• Customer relationship management (CRM) software used by the support team.

3.2 Legal and Regulatory Disclosure

ceston may be required to disclose your personal data to competent authorities, law enforcement agencies, or regulatory bodies where such disclosure is mandated by applicable law, court order, or a lawful request from a governmental authority. In such circumstances, we will disclose only the minimum data required to satisfy the legal obligation and will notify you to the extent that we are legally permitted to do so.

3.3 Business Transfers

In the event that ceston undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the relevant successor entity as part of that transaction. You will be notified of any such transfer and the privacy practices that will apply to your data going forward, prior to the transfer taking effect where reasonably practicable.

3.4 What We Do Not Do

• We do not sell your personal data to any third party.
• We do not share your data with advertisers or data brokers.
• We do not transfer your data to unaffiliated companies for their own independent marketing purposes.

4. Cookies & Tracking

4.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function correctly, remember your preferences, and provide usage analytics to site operators. ceston uses cookies and comparable technologies (such as local storage and session tokens) across its platform.

4.2 Types of Cookies We Use

4.3 Managing Cookies

You can control and delete cookies through your web browser settings. Most modern browsers allow you to block all cookies, block only third-party cookies, or clear existing cookies. Please note that disabling strictly necessary cookies will prevent the ceston platform from functioning correctly — in particular, you will not be able to maintain a logged-in session. Disabling functional cookies means that your preferences will not be remembered between visits.

Instructions for managing cookies in the most common browsers are available through each browser's own help documentation (Chrome, Firefox, Safari, Edge, Opera). ceston does not collect analytics cookies beyond what is described in the table above.

5. Data Security

ceston implements a layered, defence-in-depth approach to data security. The measures we maintain include, but are not limited to, the following:

• SSL/TLS encryption: All data transmitted between your browser or app and the ceston servers is encrypted using TLS 1.2 or higher, preventing interception of your data in transit.
• Encrypted data storage: Sensitive personal data — including identity verification documents and payment references — is stored using AES-256 encryption at rest.
• Password hashing: Passwords are never stored in plain text. They are processed through a one-way cryptographic hashing algorithm (bcrypt with a randomised salt) before storage.
• Access controls: Access to personal data within ceston's internal systems is restricted to staff who have a documented, role-based need to access that data. All access events are logged and subject to periodic audit.
• Two-factor authentication (2FA): ceston offers optional 2FA on player accounts to provide an additional layer of security against unauthorised login attempts.
• Regular security assessments: The platform undergoes periodic technical security reviews to identify and remediate vulnerabilities before they can be exploited.
• Incident response: ceston maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to affected individuals, ceston will notify affected players within a reasonable timeframe consistent with its obligations.

6. Data Retention

ceston retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, while also ensuring compliance with legal and regulatory retention obligations. The general retention periods that apply to different categories of data are as follows:

Once the applicable retention period has elapsed, personal data is either permanently deleted from ceston's systems or rendered irreversibly anonymous (so that it can no longer be linked back to an identifiable individual). Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

7. Your Privacy Rights

As a player on the ceston platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the ceston support team at [email protected]. We will acknowledge your request within 2 business days and provide a substantive response within 5 business days.

7.1 Right of Access

You have the right to request a copy of all personal data that ceston holds about you. Upon a verified request, we will provide a structured summary of your data in a commonly used, readable format.

7.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (such as updating your email address or phone number), you can make changes directly within your account settings. For corrections to identity data, please contact support with the relevant documentation.

7.3 Right to Erasure

You may request that ceston delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where the data has been processed unlawfully. Please note that this right is subject to our legal obligations — we are not able to delete data that we are required to retain under AML or financial record-keeping laws.

7.4 Right to Restrict Processing

You have the right to request that ceston restrict the processing of your personal data in certain circumstances — for example, while a dispute about its accuracy is being resolved, or while an objection to processing is being considered.

7.5 Right to Withdraw Consent

Where ceston processes your data on the basis of your consent (for example, for promotional communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal. To stop receiving promotional emails or SMS messages, use the unsubscribe link in any such message or contact support directly.

7.6 Right to Object

You have the right to object to processing of your personal data where ceston relies on a legitimate interest as its legal basis, including profiling based on legitimate interests. ceston will assess your objection and cease the relevant processing unless we can demonstrate a compelling legitimate ground that overrides your interests.

8. Policy Updates & Contact

8.1 Changes to This Policy

ceston reviews and updates this Privacy Policy periodically to reflect changes in our data practices, technology, or applicable legal requirements. When material changes are made, we will update the "Last Updated" date at the top of this page. For significant changes that materially affect how we process your personal data, we will endeavour to provide notice through a visible announcement within the platform or by email to your registered address, at least 7 days before the changes take effect.

Your continued use of the ceston platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. We encourage you to review this page periodically to stay informed about how we protect your data.

8.2 Children's Privacy

ceston's services are strictly for adults aged 18 years and above. We do not knowingly collect personal data from any person under the age of 18. If we become aware that a person under 18 has provided us with personal data or has registered an account, we will immediately close the account, delete the associated personal data, and — where relevant — report the matter through appropriate channels. If you believe a minor has registered on ceston, please notify us at [email protected] without delay.

8.3 Third-Party Links

The ceston platform does not include links to external third-party websites. This Privacy Policy applies solely to data processed by ceston in connection with the ceston.net platform and does not extend to any third-party service, application, or payment provider's own data practices. We encourage you to review the privacy policies of any third-party services you use in connection with your ceston account, such as bKash or Nagad.

8.4 Contact Information

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the ceston privacy team:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 inside the ceston platform
• Response time: Acknowledgement within 2 business days; full response within 5 business days