bdd9 Privacy Policy

bdd9 ("we", "us", "our") operates the online betting and casino platform accessible at bdd9.io and any associated mobile applications or sub-domains (collectively, the "Platform"). We are committed to protecting the privacy and security of the personal information that you provide to us when you register, access, or use the Platform.

This Privacy Policy describes how bdd9 collects, uses, stores, shares, and protects personal data relating to players and visitors ("you", "your") in accordance with applicable data protection principles. It also explains the rights you hold in relation to your personal data and how you may exercise those rights.

This Privacy Policy should be read alongside bdd9's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference and together form the full agreement governing your use of the Platform.

bdd9 is dedicated to maintaining the highest standards of data governance. We do not engage in the unauthorised sale or disclosure of personal data, and we apply strict internal access controls to ensure that your information is accessible only to those who genuinely need it to deliver or improve our services.

For the purposes of this Privacy Policy, bdd9 acts as the data controller in respect of personal data collected from players and visitors to the Platform. As data controller, bdd9 determines the purposes and means by which your personal data is processed.

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data bdd9 holds about you, please contact our Data Protection team using the contact details provided in Section 14 of this policy.

Where bdd9 engages third-party service providers (such as payment processors, identity verification services, or game software providers) to process personal data on its behalf, those providers act as data processors and are contractually bound to process your data only on bdd9's documented instructions and in accordance with applicable data protection obligations.

bdd9 collects the following categories of personal data from players and visitors to the Platform:

3.1 Identity & Registration Data

• Full legal name
• Date of birth
• Gender (optional)
• Username chosen at registration
• Government-issued identification document details (National ID number, Passport number, or Driving Licence number) — collected during KYC verification

3.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including district, city, and postal code)

3.3 Financial Data

• Payment method details (mobile banking account numbers for bKash, Nagad, Rocket, Upay; bank account details for Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank; card details for Visa and Mastercard transactions)
• Deposit and withdrawal transaction history
• Account Balance history
• Source of funds information (where collected as part of enhanced due diligence)

3.4 Gaming Activity Data

• Betting and wagering history (game type, stake amount, odds, outcome)
• Bonus and promotion usage records
• Session duration and login timestamps
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

3.5 Technical & Device Data

• IP address
• Device type, operating system, and browser type and version
• Unique device identifiers
• Geolocation data (country and city level, derived from IP address)
• Referring website or application

3.6 Communications Data

• Records of live chat conversations with bdd9 support agents
• Email correspondence sent to and from bdd9's support address
• Any other communications you initiate with bdd9 in connection with your Account or a complaint

bdd9 collects personal data through the following channels and means:

• Account Registration: You provide identity, contact, and credential data directly when you create a bdd9 Account.
• KYC Verification: You submit identity documents and proof of address as part of the verification process prior to withdrawal processing.
• Deposits & Withdrawals: Financial data is collected when you initiate payment transactions through the Platform.
• Platform Usage: Technical and gaming activity data is collected automatically as you browse the Platform, play games, and place wagers.
• Cookies & Similar Technologies: Tracking technologies placed on your device collect behavioural and technical data. See Section 7 for full details.
• Customer Support Interactions: Communications data is collected when you contact bdd9's support team via live chat or email.
• Third-Party Verification Services: Where bdd9 engages identity verification providers to validate documents submitted during KYC, those providers may return confirmation data to bdd9.
• Fraud & AML Screening Tools: bdd9 may receive risk-scoring or watchlist-screening data from third-party compliance service providers in connection with its anti-money-laundering obligations.

bdd9 processes your personal data only where it has a valid legal basis to do so. The table below sets out the primary purposes for which bdd9 processes personal data, the categories of data used for each purpose, and the corresponding legal basis.

Where bdd9 relies on legitimate interests as the legal basis for processing, it has conducted a balancing assessment to confirm that its interests do not override your fundamental rights and freedoms. You may request a copy of that assessment by contacting support.

Where bdd9 relies on your consent (for example, for sending promotional emails or SMS), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, update your communication preferences in your Account settings or contact support.

bdd9 does not sell your personal data. bdd9 shares personal data with third parties only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

6.1 Payment Processors

bdd9 shares financial and identity data with payment service providers (including bKash, Nagad, Rocket, Upay, and card-processing networks) to process your deposit and withdrawal transactions. These providers are contractually bound to use your data only for payment processing purposes.

6.2 Identity Verification & KYC Providers

bdd9 may share your identity document details and personal information with third-party KYC and age-verification service providers to fulfil its legal obligation to verify player identity and prevent underage gambling.

6.3 Game Software Providers

Where you access games supplied by third-party providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), bdd9 shares the minimum data required by those providers — typically a player session token and account identifier — to authenticate your session and record game outcomes. These providers do not receive your full identity profile.

6.4 Fraud & Compliance Services

bdd9 may share technical and financial data with anti-fraud and AML compliance technology providers to detect suspicious activity, screen against sanctions watchlists, and fulfil its legal reporting obligations.

6.5 Legal & Regulatory Authorities

bdd9 may disclose personal data to law enforcement agencies, regulators, or other government bodies where required by applicable law, court order, or where bdd9 reasonably believes that such disclosure is necessary to protect the safety of any person or to prevent illegal activity.

6.6 Business Transfers

In the event that bdd9 undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any resulting material change to how your data is processed.

bdd9 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and detect fraudulent activity. Cookies are small text files placed on your device when you visit the Platform.

Types of Cookies Used by bdd9

• Strictly Necessary Cookies: These are essential to the operation of the Platform and cannot be disabled. They include session authentication cookies that keep you logged in, security tokens that protect your Account, and load-balancing cookies that ensure stable Platform performance.
• Functional Cookies: These cookies remember your preferences such as language settings, display preferences, and responsible gaming tool configurations, providing a more personalised experience.
• Analytics Cookies: bdd9 uses analytics cookies to understand how players navigate the Platform — which pages are visited most frequently, where users encounter difficulties, and how the Platform can be improved. Data collected is aggregated and does not identify individual players.
• Security & Fraud-Prevention Cookies: These cookies help bdd9 detect and prevent fraudulent account activity, including the identification of multiple accounts operated from the same device.

Managing Cookies

You may control cookie settings through your browser's privacy or settings menu. Disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from logging in or placing wagers. Disabling analytics or functional cookies will not affect your ability to use core Platform features but may result in a less personalised experience.

bdd9 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, bdd9 will securely delete or anonymise your personal data so that it can no longer be associated with you as an individual. Where data is anonymised rather than deleted, the anonymised data may be retained indefinitely for statistical or analytical purposes.

Subject to applicable law, you have the following rights in relation to the personal data bdd9 holds about you. To exercise any of these rights, please contact the bdd9 support team as described in Section 14. bdd9 will respond to all verified requests within 30 days of receipt.

Right of Access

You have the right to request a copy of the personal data bdd9 holds about you, together with information about how that data is being processed. bdd9 will provide this information in a clear, structured format free of charge, subject to verification of your identity.

Right to Rectification

If any personal data bdd9 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update most of your Account details directly through your Account settings; for changes to identity or KYC data, please contact support.

Right to Erasure

In certain circumstances, you have the right to request that bdd9 delete your personal data. This right is not absolute — bdd9 may be required to retain certain data to comply with its legal obligations (for example, AML retention requirements as set out in Section 8). Where erasure is possible, bdd9 will action it promptly.

Right to Restriction of Processing

You may request that bdd9 restrict the processing of your personal data in circumstances where you contest its accuracy, object to its processing, or require it to be retained for the purpose of legal claims even if bdd9 no longer needs it.

Right to Data Portability

Where processing is based on your consent or on contract performance, and is carried out by automated means, you have the right to receive a machine-readable copy of the personal data you have provided to bdd9, or to request that bdd9 transmit it directly to another controller.

Right to Object

You have the right to object to processing based on bdd9's legitimate interests. You also have an absolute right to object to direct marketing processing at any time, after which bdd9 will cease processing your data for that purpose without delay.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time through your Account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

bdd9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key measures include:

• SSL/TLS Encryption: All data transmitted between your browser or device and bdd9 servers is encrypted using industry-standard SSL/TLS protocols.
• Encrypted Data Storage: Sensitive personal data, including payment details and identity document information, is stored in encrypted form on secured servers.
• Access Controls: Access to personal data within bdd9's systems is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access control policies.
• Two-Factor Authentication: bdd9 supports two-factor authentication (2FA) for player accounts and requires it for all internal administrative access to production systems.
• Regular Security Audits: bdd9 conducts periodic internal security reviews and engages third-party specialists to perform vulnerability assessments and penetration testing on its Platform infrastructure.
• Secure Development Practices: All Platform software is developed in accordance with secure coding standards, with security requirements considered at every stage of the development lifecycle.

Despite these measures, no online platform can guarantee absolute security. You are responsible for keeping your Account credentials confidential. If you suspect that your Account has been accessed without your authorisation, contact bdd9 support immediately so that protective action can be taken.

The bdd9 Platform is strictly intended for adults aged 21 and above. bdd9 does not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not register an account, make a deposit, or use any service offered by bdd9.

If bdd9 discovers or has reason to believe that personal data has been collected from a person under 21, it will immediately suspend the relevant account, void any associated transactions, and securely delete the personal data of the underage individual as soon as it is practicable to do so, subject to any legal obligations that require temporary retention for reporting purposes.

Parents and guardians who believe that a minor in their care may have registered on bdd9 are encouraged to contact bdd9 support immediately at [email protected] so that the account can be investigated and closed without delay.

The bdd9 Platform may contain links to third-party websites or embed content from third-party game providers. This Privacy Policy applies only to bdd9.io and the personal data collected directly by bdd9. It does not cover the data practices of any third-party website or service provider.

When you interact with a third-party game interface embedded within the bdd9 Platform — for example, a live dealer game powered by Evolution Gaming or a slot game provided by Pragmatic Play — that provider's own privacy policy governs the data collected within their game engine. bdd9 recommends that you review the privacy policies of any third-party providers whose services you use through the Platform.

bdd9 accepts no responsibility for the privacy practices, content, or data security of any third-party website or service that is linked to or from the Platform.

bdd9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last Reviewed" date at the top of this page will be updated whenever a revision is made.

Where changes are material — meaning they significantly affect your rights or how bdd9 processes your personal data — bdd9 will notify you by email to your registered address and/or display a prominent notification when you next log in to the Platform, providing at least fourteen (14) days' advance notice before the changes take effect.

Minor or non-material changes (such as corrections of typographical errors or clarifications of existing provisions) may take effect immediately upon publication without advance notice. Continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated policy.

We encourage you to review this Privacy Policy periodically to stay informed about how bdd9 is protecting your personal information. If you have any concerns about a change to this policy, please contact the bdd9 support team before the effective date of the change.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a privacy-related concern, please contact bdd9 using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the bdd9 Platform. This is the fastest way to reach the support team for any privacy inquiry.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" or "Data Rights Request" to ensure your message is directed to the correct team. Response within 24 hours.
• Language: Privacy requests may be submitted in English or Bengali. Our data protection team handles queries in both languages.

When submitting a data rights request, please include your Account username and the email address registered to your Account so that bdd9 can verify your identity and locate your records efficiently.