bd67 Privacy Policy

This Privacy Policy ("Policy") describes how bd67 ("the Platform", "we", "us", "our") collects, processes, stores, shares, and protects personal data relating to individuals ("Member", "User", "you", "your") who access or use the bd67 online casino and sports betting platform available at bd67.io and all associated subdomains and mobile-optimised versions thereof.

This Policy applies to all personal data processing activities carried out by bd67 in connection with the operation of the platform, including registration, identity verification, account management, deposit and withdrawal processing, customer support, fraud prevention, and marketing communications (where you have opted in). It applies to all members based in Bangladesh and to all other users who access the platform, regardless of geographic location.

This Policy should be read together with bd67's Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and bd67. By registering an account on the bd67 platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

bd67 collects personal data in the following categories. We collect only what is necessary for the stated purposes described in Section 04 of this Policy.

bd67 does not intentionally collect special category data (such as health, racial, political, or religious information) from members. If such data is inadvertently disclosed to us during a support interaction or complaint, it will be treated with the highest level of confidentiality and will not be processed for any purpose beyond resolving the specific matter for which it was shared.

bd67 collects your personal data through the following mechanisms:

• Direct collection: When you complete the registration form, submit identity verification documents, make a deposit or withdrawal request, contact our support team, or update your account profile, you provide data to us directly.
• Automated collection: When you access and use the bd67 platform, our servers automatically collect technical and usage data including your IP address, browser fingerprint, device identifiers, session timestamps, and gameplay activity logs.
• Cookies and similar technologies: bd67 uses first-party cookies and similar browser-based tracking technologies to maintain your login session, remember your preferences, and analyse platform performance. See Section 06 for full details on our cookie practices.
• Payment processors: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, our payment processing partners provide bd67 with transaction confirmation data, including the payment method reference and the amount. We do not receive or store full card numbers or mobile banking PINs.
• Identity verification providers: bd67 may use third-party identity verification services to assist with age and identity checks. These providers process the documents you submit and return a verification result to bd67.
• Fraud detection systems: Our automated fraud and risk management systems generate behavioural and transactional data signals that are processed internally to detect and prevent prohibited conduct.

bd67 processes your personal data only where a lawful basis exists for doing so. The primary purposes for which we process personal data, and the corresponding legal basis for each, are set out below:

• Account registration and management: Processing is necessary to perform our contract with you. We use your identity and contact data to create and maintain your account and to give you access to the platform's features.
• Age and identity verification (KYC): Processing is required to comply with legal obligations. bd67 must verify that all members are 21 years of age or older and that members are who they claim to be before allowing deposits or withdrawals.
• Payment processing: Processing is necessary to perform our contract with you. We use financial data to process deposits via bKash, Nagad, Rocket, Upay, and card networks, and to process withdrawal requests to verified payment methods.
• Fraud prevention and security: Processing is in our legitimate interests and may be required by law. We analyse technical and usage data to detect fraudulent activity, collusion, money laundering, and prohibited conduct.
• Customer support: Processing is necessary to perform our contract with you. We use your communications data to respond to queries, resolve disputes, and deliver account assistance.
• Responsible gaming monitoring: Processing is in our legitimate interests and serves our duty of care obligations. We analyse gameplay and financial data to identify patterns that may indicate problem gambling and to make responsible gaming tools available proactively.
• Promotional communications: Processing is based on your consent. We send marketing emails and messages only to members who have opted in to receive them. You may withdraw this consent at any time through your account settings or by contacting [email protected].
• Platform improvement and analytics: Processing is in our legitimate interests. Aggregated and anonymised usage data helps us improve game selection, platform performance, and user experience. Aggregated data cannot be used to identify any individual member.

bd67 does not sell, rent, or trade your personal data. We share personal data only in the following defined circumstances and only to the minimum extent necessary for the stated purpose:

• Payment processing partners: We share the minimum necessary financial data with payment processors (such as bKash, Nagad, Rocket, Upay, Visa, and Mastercard) solely to execute deposit and withdrawal transactions you have authorised.
• Identity verification providers: We share identity documents with accredited third-party KYC service providers to facilitate age and identity verification checks. These providers process data solely on our behalf and under strict contractual confidentiality obligations.
• Game content providers: Game studios and providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive a session token or anonymised player identifier to initialise your game session. They do not receive your full name, financial data, or contact information.
• Fraud and AML compliance services: We may share transactional and behavioural data with specialist fraud detection and anti-money laundering compliance service providers who assist bd67 in meeting its obligations.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory authority, bd67 will disclose personal data as mandated. bd67 will take reasonable steps to notify you of such disclosures unless prohibited from doing so by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of bd67's assets, personal data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to this Policy that results from it.

All third parties with whom bd67 shares personal data are required to implement appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose other than the one for which it was shared.

bd67 uses cookies and similar browser-based technologies on the platform. A cookie is a small text file placed on your device by our servers when you visit the site. Cookies help the platform function correctly, maintain your login session, and allow us to understand how members use the platform so we can improve it.

bd67 uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the platform to operate. They maintain your login session, remember your security settings, and enable core functionality such as the cashier and game lobby. They cannot be disabled without breaking the platform experience.
• Functional cookies: These cookies remember your preferences — such as your preferred language, display settings, and last-visited game categories — so that you do not need to re-configure them on each visit.
• Analytics cookies: These cookies collect anonymised data about how members interact with the platform, including pages visited, session duration, and error events. This data is processed in aggregate form and cannot be used to identify individual members.
• Responsible gaming cookies: bd67 uses session cookies to track the duration of your current gaming session and to surface time-on-platform alerts to members who have enabled session reminders in their responsible gaming settings.

bd67 does not use third-party advertising or retargeting cookies. We do not allow external ad networks to place tracking technologies on the bd67 platform. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the platform.

bd67 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal, regulatory, and audit obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is either permanently deleted from bd67's systems or anonymised such that it can no longer be associated with any identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical and platform improvement purposes.

As a bd67 member, you have the following rights in relation to your personal data. These rights apply at all times while you hold an active account and for the duration of the applicable retention period following account closure:

• Right of access: You have the right to request a copy of all personal data that bd67 holds about you. We will provide this in a clear, portable format within a reasonable timeframe from receipt of your verified request.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held by bd67. You may update most profile information directly through your account settings; for data that cannot be self-corrected, contact our support team.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that this right is subject to our legal retention obligations — data we are required to retain by law cannot be deleted prior to the expiry of the mandatory retention period.
• Right to restriction: You have the right to request that bd67 temporarily restrict the processing of your personal data — for example, while the accuracy of the data is being verified or a complaint is being investigated.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that it be transmitted to another data controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data that is carried out on the basis of our legitimate interests, including profiling for fraud detection and responsible gaming monitoring. bd67 will assess your objection and cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (principally marketing communications), you may withdraw that consent at any time through your account settings or by contacting [email protected]. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact our Data Privacy team at [email protected] with the subject line "Data Privacy Request". We will verify your identity before processing any request. We aim to respond to all data rights requests within 30 days of receipt. Where a request is complex or voluminous, we may extend this period by up to an additional 60 days, and we will notify you of any such extension within the initial 30-day window.

bd67 takes the security of your personal data seriously and has implemented a layered set of technical and organisational controls to protect it against unauthorised access, accidental loss, destruction, and disclosure. Our security framework includes the following measures:

• Encryption in transit: All data exchanged between your device and bd67's platform is encrypted using 256-bit TLS (Transport Layer Security). This applies to login sessions, deposit and withdrawal flows, document uploads, and all other platform interactions.
• Encryption at rest: Sensitive data stored on bd67's servers — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within bd67's systems is restricted on a strict need-to-know basis. All staff with access to member data undergo background checks and receive regular data protection training. Access logs are maintained and reviewed periodically.
• Two-factor authentication: bd67 supports and encourages the use of two-factor authentication (2FA) on all member accounts. Members can enable 2FA through their account security settings.
• Intrusion detection and monitoring: bd67's infrastructure is monitored 24 hours a day for suspicious access patterns, anomalous data transfers, and potential security incidents.
• Penetration testing: bd67's platform undergoes periodic independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data security incident affecting your personal data, bd67 will notify affected members promptly via their registered email address and will publish clear guidance on any protective steps you should take.

While bd67 takes all reasonable steps to protect your data, no system is entirely immune to risk. You play an important role in keeping your account secure: use a strong, unique password, enable 2FA, do not share your credentials, and contact our support team immediately at [email protected] if you suspect any unauthorised access to your account.

The bd67 platform is strictly intended for adults aged 21 years and above. bd67 does not knowingly collect, store, or process personal data relating to any person under the age of 21.

If bd67 becomes aware or has reasonable grounds to believe that personal data belonging to a person under 21 has been collected — whether through misrepresentation at registration or any other means — we will immediately close the relevant account, delete or anonymise the associated personal data to the extent permitted by legal retention obligations, return any deposited funds to the originating payment method, and void any winnings generated.

If you are a parent or guardian and believe that a person under 21 in your household has registered an account on bd67, please contact our support team immediately at [email protected] with the subject line "Minor Account Report". We take all such reports seriously and will act promptly upon receipt of a verified report.

bd67 operates an online platform that may involve the transfer of personal data to servers and service providers located in jurisdictions outside Bangladesh. Where such transfers occur, bd67 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that which it receives within Bangladesh.

Safeguards applied to international data transfers include:

• Contractual data processing agreements with all third-party processors that include binding data protection obligations consistent with recognised international privacy standards.
• Technical security controls — including encryption in transit and at rest — that apply regardless of the geographic location of the processing infrastructure.
• Restriction of international transfers to service providers that have demonstrated compliance with internationally recognised information security frameworks (such as ISO 27001 or SOC 2 Type II).

By using the bd67 platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to international service providers as described in this section, subject to the safeguards outlined above.

bd67 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or our internal data processing practices. The date at the top of this Policy ("Last updated") will always reflect the date on which the most recent version became effective.

Where a change to this Policy is material — meaning it significantly affects the way in which we collect, use, or share your personal data, or materially reduces your rights — bd67 will notify you in advance of the change taking effect. Notification will be provided via the email address registered to your account and, where appropriate, via a prominent notice displayed within the platform. Minor or administrative changes (such as correcting typographical errors or clarifying existing language without altering its meaning) may be made without prior notice.

Your continued use of the bd67 platform following the effective date of any updated version of this Policy constitutes your acknowledgement of the updated terms. If you do not agree with the updated Policy, you must cease using the platform and may request account closure by contacting [email protected]. We recommend that you review this Policy periodically to stay informed of how we are protecting your personal data.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which bd67 processes your personal data, or if you wish to exercise any of your data rights as described in Section 08, please contact our Data Privacy team using the details below.

• Email (Data Privacy Requests): [email protected] — please use the subject line "Data Privacy Request" or "Privacy Policy Enquiry" so your message is routed to the correct team promptly.
• Email (Responsible Gaming & Account Security): [email protected] — please use the subject line "Responsible Gaming Request" or "Account Security" as appropriate.
• Response time: bd67 aims to acknowledge all privacy-related communications within 5 business days (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days of receipt.
• Identity verification: To protect your privacy and the integrity of your account, bd67 will require you to verify your identity before actioning any data access, deletion, portability, or correction request. This typically involves confirming information already associated with your account.

bd67 is committed to resolving all privacy concerns in a fair, transparent, and timely manner. If you are not satisfied with the outcome of your complaint or request, you have the right to escalate the matter through appropriate legal channels available in your jurisdiction.