bd22w Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") describes how bd22w ("bd22w", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of users ("you", "your", "Player") who access or use the bd22w website and online betting and casino platform (the "Platform"). This Policy forms part of our Terms & Conditions, which are incorporated herein by reference. By creating an account or using any part of the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

bd22w is an online betting and casino platform serving players in Bangladesh. We are committed to handling your personal data responsibly, transparently, and securely. This Policy applies to all users of the Platform, including registered players, visitors who browse without registering, and individuals who contact our support team.

This Policy covers all personal data processing activities across the Platform, including data collected through the website, mobile-optimised web interface, customer support channels, and payment processing interactions. It does not cover data practices of third-party game providers or payment processors whose services you access through the Platform — those entities operate under their own privacy policies.

We encourage you to read this Policy in full. If you have any questions about how your data is handled, please contact us at the details provided in Section 15.

For the purposes of this Policy, bd22w is the data controller responsible for your personal data. The data controller determines the purposes and means of processing personal data collected through the Platform.

As data controller, bd22w is responsible for ensuring that your personal data is collected and processed in accordance with applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

If you have any questions, requests, or concerns related to your personal data, you may contact our data protection team at: [email protected]. Please include "Privacy Request" in the subject line of your message to ensure it is routed to the appropriate team promptly.

bd22w collects the following categories of personal data in connection with your use of the Platform:

• Identity Data: Your full legal name, date of birth, national identity card (NID) number or other government-issued identification number, and any selfie or document photograph submitted during identity verification.
• Contact Data: Your mobile phone number and email address as provided during registration or at any subsequent point when you update your account profile.
• Financial Data: References to the mobile banking accounts (bKash, Nagad, Rocket, Upay) or bank accounts used to make deposits or receive withdrawals, along with transaction amounts, dates, references, and balance history on the Platform. We do not store full mobile banking PINs, bank account passwords, or card numbers.
• Technical Data: Your IP address, device type (mobile or desktop), operating system, browser type and version, session start and end timestamps, and geolocation data derived from your IP address.
• Usage Data: Records of games played, bets placed and their outcomes, session duration, pages visited on the Platform, and interactions with promotional materials.
• Communication Data: The content of messages exchanged with our support team via email or any in-platform messaging function, including complaint records and resolution notes.
• Responsible Gaming Data: Records of any deposit limits, loss limits, session time reminders, cooling-off periods, or self-exclusion requests you have set on your account.
• Verification Documents: Copies of identity documents, proof of address, and any other supporting documentation submitted during the KYC (Know Your Customer) process.

bd22w collects personal data through the following channels:

• Direct Collection: Data you provide directly when creating an account, completing identity verification, making a deposit or withdrawal, contacting support, or responding to a survey or promotion.
• Automated Collection: Technical and usage data collected automatically as you browse and interact with the Platform, including through server logs, session tracking, and analytics tools operated by bd22w.
• Payment Provider Data: Transaction confirmation data received from mobile banking providers (bKash, Nagad, Rocket, Upay) and banking partners when you initiate deposits or withdrawals. This data is limited to what the payment provider shares with us as part of the transaction confirmation process.
• Identity Verification Services: Where bd22w uses third-party identity verification services to assist with KYC compliance, we may receive data outputs from those services — such as a verification pass/fail status and document authenticity score — in addition to the documents you submit directly.

bd22w uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your bd22w player account, including processing login requests, password resets, and profile updates.
• Identity Verification: To verify your identity and age (minimum 21 years) during account registration and at any subsequent point when verification is required, in compliance with responsible gaming and anti-money laundering (AML) obligations.
• Payment Processing: To process your deposit and withdrawal requests, reconcile transactions, and maintain accurate financial records for your account.
• Platform Delivery: To provide you with access to games, betting markets, live casino services, promotions, and all other features of the Platform.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, multi-accounting, and other prohibited conduct on the Platform.
• Responsible Gaming: To monitor your gaming behaviour for patterns that may indicate problem gambling, to enforce the deposit limits, loss limits, and self-exclusion measures you have set, and to reach out proactively where our systems flag a concern.
• Customer Support: To respond to your support requests, complaints, and queries, and to maintain records of our communications with you for quality assurance and dispute resolution purposes.
• Legal and Regulatory Compliance: To comply with any applicable legal obligations, respond to lawful requests from competent authorities, and maintain records required by law.
• Platform Improvement: To analyse aggregate usage data (in anonymised or pseudonymised form where possible) to improve the Platform's performance, user experience, and game offering.
• Marketing Communications: To send you promotional emails or platform notifications about bonuses, new games, and special offers — but only where you have provided consent to receive such communications. You may opt out at any time by contacting [email protected].

bd22w processes your personal data on the following legal bases:

• Contractual Necessity: Processing your identity data, contact data, and financial data is necessary for us to perform our contract with you — specifically, to provide you with a registered player account, process your financial transactions, and deliver access to the Platform.
• Legitimate Interests: Processing technical data and usage data for fraud detection, security monitoring, and platform performance improvement is in our legitimate interests as an online platform operator, provided those interests are not overridden by your privacy rights.
• Legal Obligation: Processing identity and financial data for KYC/AML compliance, record-keeping, and responding to lawful authority requests is required by applicable law and regulation.
• Consent: Processing your data for direct marketing communications is based on your consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

bd22w does not sell your personal data to any third party. We share personal data only in the following limited circumstances:

• Service Providers: We share data with third-party service providers who support the operation of the Platform, including payment processors (bKash, Nagad, Rocket, Upay, bank partners), identity verification services, fraud detection providers, cloud hosting providers, and customer support tools. All service providers are required to process your data only on our documented instructions and to maintain appropriate security standards.
• Game Providers: Game content on the Platform is supplied by third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive limited technical data (such as session tokens and game round results) necessary to deliver and certify their games. They are contractually prohibited from using this data for any other purpose.
• Legal Authorities: We may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by a lawful court order, regulatory request, or other legal obligation. We will notify you of any such disclosure to the extent permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

Some of bd22w's service providers and game technology partners operate servers and infrastructure outside Bangladesh. As a result, your personal data may be transferred to and stored in jurisdictions outside your country of residence. Where such transfers occur, bd22w ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Safeguards for international transfers may include contractual data protection clauses agreed with service providers, the use of providers who have certified compliance with recognised international data protection frameworks, and technical encryption measures applied to data both in transit and at rest.

If you would like further information about international data transfers or the safeguards applied, please contact us at [email protected].

bd22w uses cookies and similar technologies (including local storage and session tokens) on the Platform for the following purposes:

• Essential Cookies: These are strictly necessary for the Platform to function. They maintain your logged-in session, store your language and display preferences, and enable core features like balance display and game loading. Essential cookies cannot be disabled without breaking core Platform functionality.
• Analytics Cookies: We use first-party analytics tools to collect aggregate, anonymised data about how users navigate the Platform — including which pages are visited most frequently, how long sessions last, and where users encounter errors. This data helps us improve the Platform experience. No individual player is identified from analytics data.
• Security Cookies: Certain cookies support fraud detection and account security functions, such as identifying unusual login patterns or detecting the use of automated software.

bd22w does not use third-party advertising cookies or cross-site tracking technologies. We do not participate in any advertising networks or retargeting programmes that track your behaviour across other websites.

Most web browsers allow you to control cookie settings through their privacy or settings menus. You can choose to block or delete cookies at any time. However, disabling essential cookies will prevent you from logging in and using the Platform. Disabling analytics cookies will not affect your ability to use the Platform.

bd22w respects your rights in relation to your personal data. You may exercise the following rights by contacting us at [email protected] with the subject line "Privacy Request":

• Right of Access: You have the right to request a copy of the personal data bd22w holds about you. We will provide this in a clear, readable format within a reasonable timeframe following identity verification.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You can update basic profile information (such as email address or phone number) directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (for consent-based processing), or where the data has been unlawfully processed. This right is subject to our legal obligations to retain certain data (such as financial transaction records) for minimum statutory retention periods.
• Right to Restriction: You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while a correction request is being verified, or where you have objected to processing and we are assessing the grounds.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on consent (such as marketing communications), you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

bd22w will respond to all verified privacy requests within 30 days of receipt. In complex cases, the response period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it. We may need to verify your identity before processing any privacy request to ensure we do not disclose or alter data belonging to another person.

bd22w implements a range of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption of personal data and financial records stored in our databases at rest.
• Role-based access controls ensuring that only authorised bd22w personnel can access personal data, and only to the extent necessary for their role.
• Regular security assessments and vulnerability testing of our platform infrastructure.
• Secure, audited logging of all access to systems containing personal data.
• Staff training on data protection obligations and secure data handling practices.
• Incident response procedures to detect, contain, and notify affected users of any data breach in a timely manner.

While we take all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect that your account has been compromised, please contact us immediately at [email protected].

bd22w retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to resolve disputes and enforce our agreements. The specific retention periods applicable to each data category are summarised in the table provided earlier in this Policy.

As a general principle, we retain account and identity data for the duration of your active account plus a period of up to 5 years after account closure, to meet our KYC/AML record-keeping obligations. Financial transaction records are retained for up to 7 years after account closure in line with standard financial record-keeping requirements. Technical and usage data is retained for shorter periods, typically between 12 months and 2 years, depending on the specific data category.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with any individual. Anonymised and aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

As part of our registration and KYC process, bd22w requires all players to verify their age and identity before their account is fully activated and before any deposit or withdrawal can be processed. This verification requirement is a fundamental safeguard against underage gambling.

If bd22w becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to suspend the relevant account, delete the personal data in question, and reverse any financial transactions associated with that account. If you are a parent or guardian and believe your child may have created an account on the Platform, please contact us immediately at [email protected] with the subject line "Underage Account" so we can investigate and act without delay.

We strongly encourage parents and guardians to make use of parental control software and internet filtering tools to prevent underage individuals from accessing online gambling platforms. The Platform is designed for adult recreational use only.

bd22w reserves the right to update or modify this Privacy Policy at any time. We will post the revised Policy on this page with an updated "Last Updated" date at the top of the document. Where changes are material — meaning they significantly affect how we collect, use, or share your personal data — we will notify you directly via the email address or mobile number associated with your account, or via a prominent notice on the Platform, at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to the Policy, you should cease using the Platform and may request account closure by contacting [email protected]. Closing your account does not affect our obligation to retain your data for the minimum statutory retention periods described in Section 12.

We recommend that you review this Privacy Policy periodically to stay informed about how we handle your personal data. The most current version of the Policy will always be available at bd22w.io/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bd22w handles your personal data, please contact our data protection team using the details below. We aim to respond to all privacy-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6).

Please note that for security purposes, all data-related requests require identity verification before we can act on them. We will confirm receipt of your request by email and advise you of the verification steps required. We will not charge any fee for handling a legitimate privacy request, unless the request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or decline to act on the request.

If you are not satisfied with our response to your privacy request, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. We encourage you to contact us first so we can try to resolve your concern directly.