Privacy Policy — bd2227

Section 1

1. Introduction and Scope

1.1 This Privacy Policy ("Policy") is published by bd2227 ("bd2227", "we", "us", "the Platform") and applies to all individuals who interact with the bd2227 website at bd2227.org, including registered players, visitors who browse the site without registering, and any other individuals whose personal data bd2227 processes in connection with the platform's operation.

1.2 This Policy describes the categories of personal data bd2227 collects, the purposes for which that data is processed, the legal basis for each processing activity, the third parties with whom data may be shared, the security measures in place to protect data, the retention periods applied, and the rights available to data subjects.

1.3 This Policy should be read alongside bd2227's Terms & Conditions, available at bd2227.org/terms-conditions. Where this Policy addresses a matter also covered by the Terms, the more specific document governs.

1.4 bd2227 may update this Policy from time to time. The most current version is always published at bd2227.org/privacy-policy with the effective date stated at the top of the document. Material changes will be communicated to registered players via account notification or email.

Section 2

2. Data Controller Identity

2.1 For the purposes of this Privacy Policy, the data controller — the entity that determines the purposes and means of processing your personal data — is bd2227, operating the platform at bd2227.org and targeting players located in Bangladesh.

2.2 All data-related queries, subject access requests, correction requests, deletion requests, and complaints should be directed to the bd2227 data contact at [email protected]. Please include "Privacy" or "Data Request" in the subject line of your communication to ensure prompt routing.

Section 3

3. Personal Data We Collect

3.1 bd2227 collects the following categories of personal data from players and platform users:

Data Category	Specific Data Points	Collection Stage
Identity Data	Full legal name, date of birth, National Identity Card (NID) number, passport number (where applicable)	Registration; verification request
Contact Data	Bangladesh mobile number, email address (if provided)	Registration
Account Data	Username, hashed password, account preferences, communication preferences, responsible gaming settings	Registration; ongoing account use
Financial Data	bKash / Nagad / Rocket / Upay wallet number, bank account details (for bank transfer withdrawals), deposit and withdrawal transaction records	Cashier use; verification
Betting and Gaming Data	Bet history, game session logs, wager amounts, winnings and losses, bonus activity, game preferences	Platform use
Technical Data	IP address, device type and operating system, browser type and version, session tokens, login timestamps	Automated collection during platform use
Communications Data	Support request content, dispute correspondence, verification communications	Support interactions
Verification Documents	Scanned or photographed copies of NID, passport, or other identity documents; utility bills or bank statements for address verification	KYC / AML verification process

3.2 Sensitive Data. bd2227 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health data, unless a player voluntarily discloses such information in the context of a responsible gaming support request (for example, disclosing a gambling addiction diagnosis). Where sensitive data is disclosed in this context, it is processed solely for the purpose of providing appropriate responsible gaming support and is not used for any other purpose.

3.3 Data You Choose Not to Provide. Where the provision of certain personal data is mandatory for a specific service (for example, identity documents required for withdrawal processing), failure to provide that data may prevent bd2227 from delivering that service. bd2227 will clearly indicate when data provision is mandatory versus optional at the point of collection.

Section 4

4. How We Collect Your Data

4.1 Directly from You. The majority of personal data bd2227 holds is provided directly by you during registration, account verification, cashier transactions, support communications, and responsible gaming tool activation.

4.2 Automatically During Platform Use. When you access the bd2227 platform, certain technical data is collected automatically by our servers and analytics systems, including your IP address, device identifiers, browser characteristics, session duration, pages visited, and click-path data. This data is collected to maintain platform security, detect fraud, and improve user experience.

4.3 From Payment Providers. When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a bank transfer, the relevant payment provider may share transaction confirmation data with bd2227 to allow us to credit or process your account balance. bd2227 does not receive your full payment account credentials from these providers; only the transaction reference, amount, and associated wallet or account identifier are shared.

4.4 From Identity Verification Partners. Where bd2227 uses a third-party identity verification service to assist with KYC (Know Your Customer) or AML (Anti-Money Laundering) checks, that service may return a verification result and a confidence score to bd2227. The underlying verification is performed in accordance with the verification partner's own privacy policy, which will be made available to you at the point the verification is initiated.

4.5 From Cookies and Similar Technologies. bd2227 uses cookies and similar technologies to collect technical and behavioural data. Full details are provided in Section 8 of this Policy.

Section 5

5. Legal Basis for Processing

5.1 bd2227 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity. Processing that is necessary to perform the contract between bd2227 and the player — including account creation, bet processing, payment handling, and account management — is carried out on the basis of contractual necessity.
• Legal Obligation. Processing required to comply with applicable law — including identity verification, AML transaction monitoring, and fraud reporting — is carried out on the basis of legal obligation.
• Legitimate Interests. Processing carried out for bd2227's legitimate business interests — including platform security, fraud detection, responsible gaming monitoring, and platform analytics — provided those interests are not overridden by the data subject's privacy interests.
• Consent. Where bd2227 relies on consent as the legal basis for processing (for example, sending optional promotional communications), consent will be sought explicitly and may be withdrawn by the player at any time by contacting [email protected] or updating account notification preferences.

Section 6

6. How We Use Your Data

6.1 bd2227 uses the personal data we collect for the following purposes:

• Account Management. Creating and maintaining your bd2227 account, authenticating your identity at login, enforcing account security policies, and processing account closure requests.
• Payment Processing. Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank transfer; verifying that payment methods are registered in your own name; detecting and preventing payment fraud.
• Identity Verification (KYC/AML). Verifying your age and identity in accordance with our responsible gaming obligations; conducting due diligence on large or unusual transactions; complying with anti-money laundering requirements applicable to online gaming platforms operating in Bangladesh.
• Service Delivery. Settling sports bets on cricket (BPL, IPL, T20 World Cup), football, kabaddi, and other markets; crediting casino game winnings; awarding jackpot prizes; applying bonus credits in accordance with promotional terms.
• Platform Security. Monitoring account activity for signs of unauthorised access, multi-accounting, collusion, bot usage, and other forms of prohibited conduct described in the bd2227 Terms & Conditions.
• Responsible Gaming. Monitoring player activity to identify patterns associated with problem gambling; applying self-exclusion, deposit limit, and cooling-off restrictions requested by players; facilitating responsible gaming support requests.
• Customer Support. Responding to account queries, processing dispute submissions, providing technical support, and handling complaints.
• Platform Improvement. Analysing aggregated, anonymised usage data to improve platform navigation, game selection, payment options, and overall user experience for players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and other regions of Bangladesh.
• Marketing Communications. Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. Players may opt out at any time.

6.2 bd2227 does not use automated decision-making in a manner that produces legal or similarly significant effects on players without human review. Where automated systems flag an account for investigation (for example, an AML alert or a fraud detection trigger), the outcome is reviewed by a human member of the compliance team before any account action is taken.

Section 7

7. Data Sharing and Third Parties

7.1 bd2227 does not sell personal data to third parties. Data may be shared with the following categories of third party solely to the extent necessary to deliver the services you use:

• Payment Service Providers. bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking partners including BRAC Bank, City Bank, Islami Bank, Sonali Bank, and Dutch-Bangla Bank — shared data is limited to transaction reference data necessary to process deposits and withdrawals.
• Game Providers. Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi — game session data (player ID, wager amount, game result) is shared with game providers to facilitate live game participation and jackpot prize verification.
• Identity Verification Services. Third-party KYC/AML verification platforms that assist bd2227 in verifying player identity and age. These services operate under contractual data processing agreements with bd2227.
• Cloud and Infrastructure Providers. Hosting, database, and CDN service providers that store and transmit bd2227 platform data under strict data processing agreements and security standards.
• Analytics Providers. Anonymised, aggregated usage analytics may be processed by third-party analytics platforms. Individual player data is not shared with analytics providers in an identifiable form.
• Law Enforcement and Regulatory Authorities. Where required by applicable law or a valid legal order, bd2227 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities in Bangladesh.

7.2 All third-party service providers with whom bd2227 shares personal data are required to process that data in accordance with applicable data protection standards and only for the specific purposes for which the data was shared. bd2227 maintains data processing agreements with all relevant third-party processors.

Section 8

8. Cookies and Tracking Technologies

8.1 bd2227 uses cookies — small text files stored on your device by your browser — and similar technologies including local storage and session tokens to support platform functionality, maintain your logged-in session, and collect usage analytics.

8.2 The following categories of cookies are used on the bd2227 platform:

• Strictly Necessary Cookies. Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without affecting your ability to use the platform.
• Functional Cookies. Used to remember your account preferences, language settings, and responsible gaming configurations between sessions.
• Analytics Cookies. Used to collect anonymised data about how players navigate and use the platform, helping bd2227 identify areas for improvement. Analytics data is aggregated and does not identify individual players.
• Security and Fraud Detection Cookies. Used by bd2227's fraud detection systems to identify suspicious access patterns, bot activity, and multi-accounting attempts.

8.3 You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will impair your ability to log in and use core platform features. Blocking functional or analytics cookies will not affect your ability to place bets or access games.

8.4 bd2227 does not use third-party advertising cookies or cross-site tracking cookies that follow your activity beyond the bd2227.org domain.

Section 9

9. Data Retention Periods

9.1 bd2227 retains personal data for the periods set out below. Where multiple retention periods could apply to the same data, the longer period applies.

• Active Account Data. Retained for the duration of the account relationship — from registration until account closure.
• Post-Closure Account Data. Following account closure, identity data, contact data, and account history are retained for a period of five (5) years to support AML compliance, dispute resolution, and legal obligations.
• Transaction Records. Deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years from the date of the transaction in accordance with standard financial recordkeeping obligations.
• Identity Verification Documents. Retained for the duration of the account relationship plus five (5) years post-closure, in accordance with AML due diligence requirements.
• Support and Dispute Communications. Retained for three (3) years from the date of the most recent communication in the relevant thread.
• Technical and Server Logs. IP address logs and server access logs are retained for up to twelve (12) months for platform security and fraud detection purposes, then deleted or anonymised.
• Analytics Data. Aggregated, anonymised analytics data is not subject to retention limits as it does not constitute personal data in identifiable form.

9.2 When a retention period expires, the relevant personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

Section 10

10. Data Security Measures

10.1 bd2227 implements the following technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure:

• Encryption in Transit. All data transmitted between your device and bd2227 servers is encrypted using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
• Encryption at Rest. Sensitive data fields including identity document records and financial data are encrypted at rest in the bd2227 database.
• Password Hashing. Account passwords are stored using a one-way cryptographic hashing algorithm. bd2227 staff cannot view, retrieve, or transmit player passwords in plain text.
• Access Controls. Access to player personal data within bd2227's internal systems is restricted on a need-to-know basis. Staff access is role-based and audit-logged.
• Intrusion Detection. bd2227's infrastructure is monitored for unauthorised access attempts, unusual traffic patterns, and security events on a continuous basis.
• Incident Response. bd2227 maintains a data breach incident response procedure. In the event of a data breach that poses a risk to player rights, bd2227 will notify affected players without undue delay.

10.2 While bd2227 applies industry-standard security measures, no online platform can guarantee absolute security against all possible threats. Players are also responsible for maintaining the security of their own devices and account credentials. bd2227 recommends using a strong, unique password for your bd2227 account and not sharing credentials with any third party.

Section 11

11. Your Rights as a Data Subject

11.1 As a player whose personal data is processed by bd2227, you have the following rights, which you may exercise by contacting [email protected]:

• Right of Access. You have the right to request a copy of the personal data bd2227 holds about you, along with information about how it is processed.
• Right to Rectification. You have the right to request correction of any inaccurate or incomplete personal data bd2227 holds about you.
• Right to Erasure. You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to bd2227's legal retention obligations — data we are required to retain for AML or legal compliance purposes cannot be deleted on request.
• Right to Restriction of Processing. You have the right to request that bd2227 restricts the processing of your personal data in certain circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability. You have the right to receive the personal data you have provided to bd2227 in a structured, commonly used, and machine-readable format, where the processing is based on consent or contract and is carried out by automated means.
• Right to Object. You have the right to object to processing carried out on the basis of legitimate interests. bd2227 will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent. Where bd2227 relies on your consent as the legal basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

11.2 bd2227 will respond to all verified data subject requests within 30 days of receipt. Where a request is complex or bd2227 receives a high volume of requests, the response period may be extended by a further 30 days, and you will be notified of the extension within the initial 30-day period.

11.3 bd2227 may ask you to verify your identity before processing a data subject request, to ensure that personal data is not disclosed to or acted upon at the request of an unauthorised third party.

Section 12

12. Children and Minors

12.1 The bd2227 platform is strictly for adults aged 18 years and over. bd2227 does not knowingly collect personal data from persons under the age of 18. If bd2227 discovers that personal data has been collected from a person under 18, that data will be deleted immediately and the associated account will be closed.

12.2 Parents and guardians who believe that a minor may have registered on the bd2227 platform should contact [email protected] immediately. bd2227 will investigate the report promptly and take appropriate action.

Section 13

13. Changes to This Policy

13.1 bd2227 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The updated Policy will be published at bd2227.org/privacy-policy with the revised effective date. Where changes are material, registered players will be notified via account message or the contact details held on their account.

13.2 Continued use of the bd2227 platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of and agreement to the revised Policy. If you do not accept the revised Policy, you should cease using the platform and may request account closure by contacting the support team.

Section 14

14. Contact and Data Queries

14.1 For any questions, concerns, or requests relating to this Privacy Policy or bd2227's data processing practices, please contact the bd2227 data team using the details below. All communications should be in English and include your registered account username and a clear description of your query or request.

Email: [email protected]

Website: bd2227.org

Support Hours: Seven days a week, Bangladesh Standard Time (BST, UTC+6)

Response Time: Within 30 days for data subject requests; within 24 hours for standard support queries.