22bdt Privacy Policy – How We Collect, Use, and Protect Your Personal Data

Introduction

22bdt ("the Platform", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the 22bdt platform at 22bdt.io. This Privacy Policy sets out, in clear and formal terms, the categories of personal data we collect from players based in Bangladesh, the purposes for which that data is processed, the legal basis for such processing, the measures we implement to safeguard your data, and the rights available to you in respect of your personal information.

22bdt operates exclusively in the English language and serves players located in Bangladesh. All personal data collected through the Platform is processed in accordance with this Privacy Policy and applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

This Privacy Policy should be read in conjunction with the 22bdt Terms and Conditions and the Responsible Gaming Policy, both of which are available on the Platform. Defined terms used in this Privacy Policy carry the same meanings as defined in the 22bdt Terms and Conditions unless otherwise stated here.

Data Controller

For the purposes of this Privacy Policy, 22bdt acts as the data controller in respect of all personal data collected through the Platform. As data controller, 22bdt determines the purposes and means by which personal data is processed and bears responsibility for ensuring that such processing complies with applicable data protection standards.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, you may contact the 22bdt data privacy team at the following address:

Please note that the email address above is provided as plain text for communication purposes only. It must be used by composing a new email in your own email client; it is not a clickable link.

Categories of Personal Data We Collect

22bdt collects only the personal data that is necessary and proportionate for the purposes described in this Privacy Policy. The categories of personal data we collect are set out in the table below.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information unless you voluntarily disclose such information in the context of a responsible gaming self-exclusion request, in which case that information is processed solely for the purpose of implementing the requested restriction.

How We Collect Personal Data

22bdt collects personal data through the following means:

4.1 Direct Collection

The majority of personal data we hold is provided directly by you when you register an account on the Platform, complete the KYC verification process, make a deposit or withdrawal request, contact our support team, submit a complaint or dispute, or respond to a promotional offer or survey.

4.2 Automated Collection

When you access and use the Platform, certain technical data is collected automatically through cookies, web beacons, and server log files. This includes your IP address, device identifiers, browser characteristics, and interaction data such as pages visited and time spent on each page. This data is collected to ensure the security and proper functioning of the Platform and to support fraud prevention processes.

4.3 Third-Party Sources

In limited circumstances, 22bdt may receive personal data about you from third-party sources, including:

• Identity verification service providers engaged to assist with KYC compliance.
• Payment processing partners (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and others listed in the Terms and Conditions) for the purpose of confirming transaction status and preventing fraud.
• Fraud prevention and anti-money laundering screening databases, where we have a legitimate interest in verifying the integrity of an account or a transaction.

In all cases where data is received from third parties, 22bdt ensures that such data is handled in accordance with this Privacy Policy and is used only for the purposes stated herein.

Purposes of Processing & Legal Basis

22bdt processes your personal data only for specific, explicit, and legitimate purposes. The primary purposes for which your data is processed, together with the legal basis for each, are described below.

• Account Registration and Management: Processing your identity and contact data to create and administer your 22bdt account. Legal basis: contractual necessity.
• Age Verification and KYC Compliance: Verifying that you are at least 21 years of age and confirming your identity in accordance with responsible gaming and anti-money laundering obligations. Legal basis: legal obligation and legitimate interests.
• Processing Financial Transactions: Facilitating deposits and withdrawals in BDT via your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer). Legal basis: contractual necessity.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, account takeover, money laundering, and other prohibited activities on the Platform. Legal basis: legitimate interests and legal obligation.
• Responsible Gaming Monitoring: Monitoring your wagering activity to identify patterns that may indicate problem gambling behaviour, and providing appropriate intervention, self-exclusion tools, or referrals. Legal basis: legal obligation and legitimate interests.
• Customer Support and Dispute Resolution: Using your account and communications data to resolve support queries, complaints, and disputes in a fair and timely manner. Legal basis: contractual necessity and legitimate interests.
• Service Improvement and Analytics: Using anonymised or aggregated usage data to understand how players interact with the Platform, improve game offerings, and optimise the user experience. Legal basis: legitimate interests.
• Marketing Communications: Sending you promotional offers, bonus notifications, and seasonal promotions (such as BPL season offers, Eid promotions, and Pohela Boishakh special events) where you have provided consent or where we have a legitimate interest in direct marketing to existing customers. Legal basis: consent or legitimate interests. You may withdraw consent at any time by contacting [email protected].

22bdt will not process your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.

Data Retention

22bdt retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The retention periods applicable to each category of data are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data cannot be immediately deleted due to technical constraints, it will be restricted from active processing until deletion is carried out.

Data Sharing & Third-Party Disclosure

22bdt does not sell, rent, or trade your personal data to any third party for their own independent marketing or commercial purposes. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and only for the purposes described in this Privacy Policy:

• Payment Processing Partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — solely for the purpose of processing your deposits and withdrawal requests in BDT.
• Identity Verification Providers: Third-party KYC and age verification service providers engaged to assist with confirming player identity and age in accordance with responsible gaming standards.
• Game Content Providers: Certified game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive technical session data (not personally identifiable financial data) necessary to deliver their games on the Platform.
• Fraud Prevention and AML Screening Services: Specialist third-party providers used to screen transactions and account activity against fraud and money laundering risk indicators.
• IT Infrastructure and Hosting Providers: Secure cloud infrastructure providers who host the Platform's servers and databases, operating under strict data processing agreements with 22bdt.
• Legal and Regulatory Authorities: Where required by applicable law, court order, or at the request of a competent regulatory or law enforcement authority, 22bdt may disclose personal data to the relevant body. We will notify you of such disclosure where we are legally permitted to do so.

All third parties with whom 22bdt shares personal data are contractually required to process that data only for the specified purpose, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection standards equivalent to those applied by 22bdt.

Cookies & Tracking Technologies

The 22bdt Platform uses cookies and similar tracking technologies to ensure the proper functioning of the site, to maintain your session security, and to gather analytics data that helps us improve the Platform experience for players in Bangladesh.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable you to navigate the site and use features such as account login, balance display, and game loading. These cookies cannot be disabled without affecting core Platform functionality.
• Security Cookies: Used to detect and prevent fraudulent activity, session hijacking, and other security threats. These cookies are mandatory for maintaining the integrity of your account.
• Analytics Cookies: Used to collect anonymised information about how players interact with the Platform, including which pages are visited most frequently, average session lengths, and game preferences. This data helps 22bdt improve the Platform on an ongoing basis.
• Preference Cookies: Store your Platform preferences such as language settings and display options so that they are retained across sessions.

8.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to refuse, delete, or selectively accept cookies. Please note that disabling strictly necessary or security cookies will impair the functionality of the Platform and may prevent you from accessing your account. For detailed guidance on managing cookies in your specific browser, please refer to your browser's help documentation.

Data Security Measures

22bdt takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect your information against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes the following measures:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 22bdt Platform is encrypted using industry-standard 256-bit SSL/TLS protocols, the same standard used by international banking institutions.
• Encrypted Data Storage: All sensitive personal data, including identity documents and financial records, is stored in encrypted form on secure servers with restricted physical and logical access controls.
• Salted Password Hashing: Account passwords are never stored in plain text. All passwords are processed using a salted cryptographic hashing algorithm, ensuring that even in the event of a data breach, passwords cannot be recovered in readable form.
• Access Control and Role-Based Permissions: Internal access to personal data is strictly limited to authorised personnel who require access to perform their legitimate job functions. All internal access is logged and subject to periodic audit.
• Intrusion Detection and Monitoring: 22bdt operates 24/7 automated security monitoring systems to detect and respond to suspicious activity, attempted breaches, and anomalous access patterns in real time.
• Regular Security Audits: The Platform undergoes periodic third-party security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.

Your Data Rights

As a player using the 22bdt Platform, you hold a number of rights in respect of the personal data we hold about you. These rights are set out below. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond to all rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of all personal data that 22bdt holds about you, together with information about how it is being processed. This is commonly referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request the deletion of your personal data. Please note that this right is subject to limitations where 22bdt is required to retain data by law (for example, financial transaction records and KYC documents held under AML obligations).
• Right to Restriction of Processing: You may request that 22bdt restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another data controller where technically feasible.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing. Where you object to marketing communications, we will cease such communications promptly.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

22bdt will not charge a fee for responding to a data rights request unless the request is manifestly unfounded, excessive, or repetitive. In such cases, a reasonable administrative fee may be charged or the request may be refused, with written explanation provided.

Children's Privacy & Age Restriction

Parents and guardians who believe that a minor in their care may have registered an account on the 22bdt Platform are encouraged to contact us immediately at [email protected] so that appropriate action can be taken without delay. 22bdt takes the protection of minors extremely seriously and enforces its age verification procedures rigorously at the point of registration and at any subsequent point where the age of a player comes into question.

Third-Party Services & External Links

The 22bdt Platform may integrate with third-party game content providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. When you launch a game provided by one of these studios, certain technical session data may be transmitted to the relevant provider's servers to enable the game to function. Each of these providers operates under their own privacy policies, which govern the processing of any data they receive directly.

22bdt does not control the data practices of third-party game providers and is not responsible for their privacy policies or data handling procedures beyond the data processing agreements in place between 22bdt and those providers. We recommend that players review the privacy policies of game providers where they have concerns about the handling of their data within individual game sessions.

Similarly, payment processing partners including bKash, Nagad, Rocket, Upay, and banking institutions operate their own data protection policies that govern the data exchanged directly between you and those providers when processing transactions. 22bdt receives only the transaction confirmation and relevant payment reference data necessary to credit or debit your account balance.

Updates to This Privacy Policy

22bdt reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. The effective date displayed at the top of this document will be updated whenever a new version is published.

Where changes to the Privacy Policy are material — meaning they significantly affect your rights or the way in which your data is processed — 22bdt will notify registered players via the email address associated with their account prior to the changes taking effect. For non-material updates, the revised Policy will be posted on the Platform and the updated effective date will serve as notice.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept any revised version of this Privacy Policy, you must cease using the Platform and request account closure by contacting [email protected].

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a concern about the handling of your personal data, please contact the 22bdt privacy team using the details below. All correspondence must be submitted in English.

The email address above is provided as plain text only and must not be treated as a clickable link. Please compose a new email in your own email application and send it to the address stated above.