bdtbb Privacy Policy — Your Data, Your Rights

Introduction

This Privacy Policy ("Policy") describes how bdtbb ("bdtbb", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("you", "your", "Player") who register an account on, access, or interact with the bdtbb platform at bdtbb.io and all associated sub-domains and services ("Platform").

bdtbb is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy is designed to give you clear and honest information about our data practices so that you can make informed decisions about your use of the Platform.

This Policy should be read alongside the Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference into our overall user agreement framework. By registering an account or using the Platform in any capacity, you acknowledge that you have read, understood, and agreed to this Privacy Policy.

Data Controller

For the purposes of this Policy, bdtbb is the data controller of the personal data collected through the Platform. As data controller, bdtbb determines the purposes for which, and the means by which, your personal data is processed. All queries, requests, and complaints relating to the processing of personal data under this Policy should be directed to bdtbb using the contact details set out in Section 16.

Where bdtbb engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification services, and analytics providers), those providers act as data processors under instruction from bdtbb and are bound by contractual obligations that restrict how they may use your data.

Data We Collect

bdtbb collects personal data in several categories, depending on how you interact with the Platform. The categories of personal data we collect include, but are not limited to, the following:

3.1 Identity Data

3.2 Contact Data

• Email address (used for account communications, password resets, and — where opted in — promotional messages)
• Mobile phone number (used for two-factor authentication and account security alerts)
• Residential city or district within Bangladesh (used for fraud prevention and geographic eligibility checks)

3.3 Financial Data

• Mobile financial service account details: bKash account number, Nagad account number, Rocket account number, or Upay account number — registered in the player's name
• Bank account details where applicable: account number, bank name (e.g., Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank), branch information
• Transaction history: deposit amounts, withdrawal amounts, dates, payment methods used, and transaction reference identifiers

3.4 Transactional & Gameplay Data

• Betting and wagering history: game type, stake amounts, odds, outcomes, winnings, and timestamps
• Account balance history and bonus credit/debit records
• Responsible gaming tool settings: deposit limits, session reminders, cooling-off periods, self-exclusion status

3.5 Technical & Device Data

• IP address (used for geographic eligibility verification and fraud detection)
• Device type, operating system, browser type and version
• Session timestamps, login history, and access logs
• Referring URL (the web page from which you arrived at bdtbb.io, if applicable)

3.6 Communications Data

• Content of messages exchanged with bdtbb customer support, including live chat transcripts, email correspondence, and any attachments submitted
• Feedback, complaints, and dispute submissions

How We Collect Your Data

bdtbb collects personal data through the following channels and mechanisms:

• Direct submission: Data you actively provide when registering an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or responding to a survey or promotion.
• Automated collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser metadata, session duration, pages visited, and cookies placed on your device. See Section 8 for full details on cookie use.
• Third-party sources: Where necessary for fraud prevention or KYC compliance, bdtbb may receive data from identity verification providers, credit reference agencies, and financial crime databases. Data received from third-party sources is handled with the same care as data collected directly.
• Payment processors: When you make a deposit or withdrawal, our payment processing partners (e.g., bKash, Nagad, Rocket, Upay, and bank partners) may share transaction confirmation data with bdtbb to reconcile payments and detect fraud.

Legal Basis for Processing

bdtbb processes personal data on the following legal bases, depending on the specific processing activity:

How We Use Your Data

bdtbb uses the personal data we collect for the following specific purposes:

• Account management: Creating, maintaining, and administering your bdtbb account, including processing login requests, password resets, and account setting changes.
• Identity verification: Confirming your identity and age as part of the KYC process to comply with our internal policies and applicable legal requirements, and to prevent underage gambling.
• Payment processing: Facilitating deposits from and withdrawals to your nominated bKash, Nagad, Rocket, Upay, or bank account; reconciling transactions; and resolving payment disputes.
• Fraud and AML compliance: Detecting, investigating, and preventing fraudulent activity, money laundering, match-fixing, bonus abuse, and other prohibited conduct as described in the Terms & Conditions.
• Customer support: Responding to your queries, complaints, and dispute submissions; improving the quality of our support team's responses; and maintaining records of support interactions for audit purposes.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling behaviour; enforcing deposit limits, cooling-off periods, and self-exclusion settings; and proactively reaching out to players who may be experiencing gambling-related harm.
• Platform improvement: Analysing aggregated and anonymised usage data to understand how players interact with the Platform, identify popular features, detect technical errors, and prioritise development improvements.
• Legal compliance: Meeting our obligations under applicable laws, responding to lawful requests from regulatory authorities, and maintaining records required by financial regulation.
• Marketing (with consent only): Sending promotional communications, personalised bonus offers, and seasonal promotions (such as Eid, Pohela Boishakh, and cricket season offers) to players who have opted in to marketing communications.

Data Sharing

bdtbb does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. We share personal data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

bdtbb engages trusted third-party companies to provide services that are integral to the operation of the Platform. These providers act as data processors and are permitted to use your data only for the specific purpose for which they were engaged, under contractual obligations that mirror the protections in this Policy. Categories of service providers include:

• Payment processing partners (bKash, Nagad, Rocket, Upay, and partner banks) — for transaction execution and reconciliation
• Identity verification and KYC providers — for document verification and liveness checking
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others) — for delivering game content; these providers may process limited session data to operate their games
• Fraud prevention and anti-money laundering screening services
• Customer support platform providers (for managing support ticket systems and chat infrastructure)
• Analytics and performance monitoring providers (receiving only aggregated, anonymised data)

7.2 Legal and Regulatory Disclosure

bdtbb may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other government bodies where we are legally required or compelled to do so, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of bdtbb, its players, or the public. Where possible and legally permitted, bdtbb will notify you of such a disclosure request.

7.3 Business Transfers

In the event that bdtbb undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material changes to the privacy practices that apply to your data before the transfer takes effect.

Cookies & Tracking Technologies

bdtbb uses cookies and similar technologies (such as web beacons and local storage) on the Platform. Cookies are small text files stored on your device when you visit a website. They serve a variety of functions as described below.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies on a site-by-site basis. Please note that disabling strictly necessary or security cookies will impair your ability to use the Platform. bdtbb does not use third-party advertising cookies or cross-site tracking cookies.

Data Retention

bdtbb retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account data and identity verification records: Retained for the duration of your account and for a minimum of 5 years following account closure, to meet anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, in accordance with financial regulation requirements.
• Customer support records: Retained for 3 years from the date of the last interaction, to support dispute resolution and service quality auditing.
• Marketing consent records: Retained for the duration of your consent and for 2 years after consent is withdrawn, to evidence compliance with consent obligations.
• Technical access logs: Retained for 12 months on a rolling basis, primarily for fraud detection and security incident investigation purposes.

When personal data is no longer required and the applicable retention period has expired, bdtbb will securely delete or anonymise that data. Anonymised data (which can no longer be linked to any individual) may be retained indefinitely for statistical and analytical purposes.

Data Security

bdtbb implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the bdtbb servers, ensuring that payment data, login credentials, and personal information cannot be intercepted in transit.
• Encryption at rest for sensitive stored data, including identity documents and financial account details, using AES-256 encryption standards.
• Access controls that restrict access to personal data to bdtbb staff and service providers who have a genuine operational need to access it, with role-based permission systems and multi-factor authentication enforced for all staff accounts.
• Regular security audits and penetration testing conducted by independent security professionals to identify and remediate vulnerabilities in the Platform.
• Incident response procedures including a defined process for detecting, containing, and notifying affected individuals of personal data breaches within legally required timeframes.

Your Rights as a Data Subject

Subject to applicable data protection law and certain limited exceptions, you have the following rights with respect to the personal data bdtbb holds about you:

• Right of access: You have the right to request a copy of the personal data bdtbb holds about you, along with information about how it is processed. We will respond to verified access requests within 30 days.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you. Corrections to core account data (name, date of birth) may require supporting documentation for KYC integrity purposes.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. This right is subject to our legal obligation to retain certain records for the periods set out in Section 9.
• Right to restrict processing: You may request that bdtbb restricts the processing of your data in certain circumstances — for example, while you dispute the accuracy of data we hold.
• Right to data portability: You have the right to receive a copy of personal data you have provided to bdtbb in a structured, commonly used, machine-readable format, and to request that we transmit that data directly to another data controller where technically feasible.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. You may also object at any time to the processing of your personal data for direct marketing purposes.
• Rights related to automated decision-making: Where bdtbb makes decisions that significantly affect you based solely on automated processing (for example, automated account suspension triggered by fraud detection systems), you have the right to request human review of that decision.

To exercise any of the above rights, please contact the bdtbb data protection team at the email address in Section 16. We may need to verify your identity before processing your request. There is no charge for exercising your rights under this Policy.

International Data Transfers

The bdtbb Platform serves players in Bangladesh, and our primary data processing operations are oriented toward serving this market. However, some of the third-party service providers we engage — including game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may process data on servers located outside Bangladesh.

Where personal data is transferred internationally, bdtbb takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy. Such safeguards may include contractual clauses that bind the recipient to data protection obligations consistent with our own, or reliance on the recipient's adherence to internationally recognised data protection frameworks.

If you have questions about specific international transfers of your data, you may contact bdtbb at the details provided in Section 16.

Under-21 Policy

The bdtbb platform is strictly intended for individuals who are 21 years of age or older. bdtbb does not knowingly collect, store, or process personal data from any individual under the age of 21. Our registration process requires all applicants to declare their date of birth, and KYC verification procedures are in place to confirm age eligibility before any account is fully activated.

If bdtbb becomes aware or has reasonable grounds to suspect that a registered account belongs to a person under the age of 21, the following steps will be taken immediately:

• The account will be suspended pending investigation and subsequently closed if the age concern is confirmed.
• Any deposits made will be returned to the originating payment method where technically and legally possible.
• All personal data associated with the underage account will be securely deleted in accordance with the retention schedule in Section 9, except where retention is required to satisfy legal reporting obligations.
• The matter may be reported to relevant authorities where required by applicable law or where bdtbb considers it appropriate in the public interest.

If you have reason to believe that a person under the age of 21 has registered an account on the bdtbb platform, please contact our support team immediately at the details provided in Section 16. We treat reports of underage gambling with the highest level of seriousness and will act on any credible report without delay.

Marketing Communications

bdtbb may send you promotional communications, including bonus offers, seasonal promotions, and platform news, where you have provided your informed consent to receive such communications at the time of account registration or subsequently through your account settings.

Marketing communications from bdtbb may be delivered by the following channels, subject to your consent preferences:

• Email to the address registered on your bdtbb account
• SMS to the mobile number registered on your bdtbb account
• In-platform notifications displayed when you are logged in to the Platform

You retain the right to withdraw your consent to marketing communications at any time, with immediate effect, by any of the following methods:

• Clicking the "unsubscribe" link included in every marketing email sent by bdtbb
• Replying "STOP" to any marketing SMS message received from bdtbb
• Updating your communication preferences in the notification settings section of your bdtbb account
• Contacting bdtbb customer support at the email address in Section 16 and requesting removal from all marketing lists

Please note that withdrawing consent to marketing communications does not affect the legal basis for processing your data for other purposes (such as account management, payment processing, or legal compliance), and it does not constitute a request to close your account. Transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and support responses — will continue to be sent regardless of marketing consent, as they are necessary for the performance of the contract between you and bdtbb.

Changes to This Privacy Policy

bdtbb reserves the right to amend, update, or replace this Privacy Policy at any time in response to changes in applicable law, evolving data protection standards, changes to the services we offer, or changes to our internal data processing practices. The most current version of this Policy will always be accessible at bdtbb.io/privacy-policy.

Where we make a material change to this Policy — meaning a change that substantively affects your rights, the categories of data we collect, or the purposes for which we process your data — we will notify registered players by email to the address on their account at least 14 days before the change takes effect. Continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

For non-material changes (such as minor clarifications of language, corrections of typographical errors, or reorganisation of content that does not affect the substance of the Policy), we may update this page without individual notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. We recommend reviewing this Policy periodically to stay informed of how bdtbb protects your data.

Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bdtbb processes your personal data, please contact our data protection team using the following details:

• Email: [email protected]
• Subject line: "Privacy Request — [Your Username]"
• Support hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)
• Response time: We aim to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 days of receipt.

Please include your registered account username and a clear description of your query or request in all correspondence to allow our team to locate your records and respond as efficiently as possible.

Filing a Complaint

If you are dissatisfied with our handling of a privacy matter after raising it with bdtbb directly, you have the right to escalate your complaint through our formal dispute resolution process as described in the Terms & Conditions. bdtbb takes all data protection complaints seriously and will conduct a thorough internal review of any escalated matter within 14 business days.