bbdk Privacy Policy — Your Data, Your Rights, Our Obligations

Introduction & Scope

This Privacy Policy ("Policy") sets out how bbdk ("we", "us", "our") collects, processes, stores, and protects personal data in connection with the operation of the bbdk online betting and casino platform, accessible at bbdk.io. This Policy applies to all users who visit, register with, or transact on the bbdk platform, including players based in Bangladesh and internationally.

bbdk is designed primarily for the Bangladeshi market and operates in English. All communications regarding personal data, including data subject rights requests, are handled in English. This Policy is written in formal English in accordance with internationally recognised data protection principles.

By registering an account with bbdk or by continuing to use the platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must cease using the bbdk platform and contact support to arrange account closure.

This Policy should be read alongside the bbdk Terms & Conditions and the bbdk Responsible Gaming Policy, both of which are incorporated by reference into the overall framework governing your relationship with bbdk.

Data Controller

For the purposes of this Policy, bbdk acts as the data controller in respect of the personal data of all registered account holders and platform visitors. As data controller, bbdk determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

All enquiries regarding this Policy or the processing of your personal data should be directed to the bbdk data support team at the contact details provided in Section 16 of this Policy. bbdk will respond to all legitimate data-related enquiries within a reasonable timeframe, typically within 30 calendar days of receipt.

What Personal Data We Collect

bbdk collects the following categories of personal data from users of the platform. The specific data collected will depend on the nature of your interaction with the platform:

bbdk does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information unless specifically required by legal obligation and with appropriate safeguards in place.

How We Collect Personal Data

bbdk collects personal data through the following channels and mechanisms:

• Direct submission by you: When you complete the account registration form, submit KYC verification documents, make a deposit or withdrawal request, complete your account profile, or contact bbdk support via live chat or email.
• Automated technical collection: When you access and navigate the bbdk platform, certain technical data (including your IP address, device identifiers, and browser information) is collected automatically by bbdk's servers and analytics systems. This occurs on every page visit regardless of whether you are logged in.
• Cookies and similar technologies: bbdk uses cookies and similar client-side tracking technologies to maintain session state, remember user preferences, and analyse platform usage patterns. Full details are provided in Section 8 of this Policy.
• Third-party verification services: Where bbdk uses third-party KYC or identity verification providers to assist in verifying the information you submit, those providers may return additional data points to bbdk as part of the verification result (for example, a confirmation of ID document authenticity).
• Payment processors: When you transact via bKash, Nagad, Rocket, Upay, or a linked bank account, the relevant payment processor confirms transaction status and certain payment reference details to bbdk's cashier system for reconciliation purposes.

Legal Basis for Processing

bbdk processes personal data only where a lawful basis for doing so exists. The primary legal bases on which bbdk relies are as follows:

• Performance of a contract: Processing your identity data, contact data, financial data, and account activity data is necessary to create and maintain your bbdk account, process your deposits and withdrawals in ৳ Taka, settle your bets, and provide you with access to the casino and sportsbook services you have contracted for.
• Compliance with a legal obligation: Processing verification documents, transaction records, and certain account history data is necessary for bbdk to comply with applicable anti-money laundering (AML) regulations, Know Your Customer (KYC) obligations, and record-keeping requirements imposed by law.
• Legitimate interests: Processing technical data and account activity data for the purposes of platform security, fraud detection, abuse prevention, responsible gaming monitoring, and service improvement is carried out on the basis of bbdk's legitimate interests, balanced against your privacy rights. Where these interests are relied upon, bbdk has assessed that they do not override your fundamental rights and freedoms.
• Consent: Where bbdk processes personal data for purposes that are not covered by the above bases — for example, sending you optional marketing communications about promotions — bbdk will seek your explicit consent and will provide a clear mechanism for you to withdraw that consent at any time.

How We Use Your Personal Data

bbdk uses the personal data it collects for the following purposes, each of which is aligned with the legal bases described in Section 5:

• Account creation and management: To create your bbdk account, verify your eligibility to use the platform (including age verification to confirm you are 21 years of age or older), and manage your ongoing account relationship with bbdk.
• Payment processing: To process your ৳ Taka deposits via bKash, Nagad, Rocket, Upay, or bank transfer, and to process your approved withdrawal requests to your verified payment method.
• Identity verification (KYC): To verify your identity, date of birth, and residential address in compliance with applicable anti-money laundering obligations and to prevent fraud and account takeover.
• Service delivery: To provide you with access to the bbdk sportsbook (including cricket BPL, IPL, T20 World Cup, and Bangladesh Tigers markets), casino games, live dealer games, and other platform features.
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and provide you with technical assistance via live chat or email.
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, multi-accounting, money laundering, and other prohibited conduct as defined in the bbdk Terms & Conditions.
• Responsible gaming compliance: To monitor account activity for signs of problem gambling, to apply deposit limits, cooling-off periods, and self-exclusion measures you request, and to flag accounts that may require responsible gaming intervention.
• Legal and regulatory compliance: To meet bbdk's obligations under applicable law including AML/KYC regulations and to respond to lawful requests from regulatory or law enforcement authorities.
• Platform improvement and analytics: To analyse aggregated, anonymised usage data for the purpose of improving the platform's features, performance, and user experience. Individual user data is not used for analytics in a way that identifies specific users.
• Communications: To send you transactional communications relating to your account (such as deposit confirmations, withdrawal status updates, and security alerts) and, where you have provided consent, optional promotional communications about bbdk offers and events.

Data Sharing & Disclosure

bbdk does not sell, rent, or trade your personal data. Personal data is shared with third parties only in the following strictly defined circumstances:

• KYC and identity verification providers: bbdk works with trusted third-party identity verification service providers to assist in the KYC process. These providers receive the minimum data necessary to verify your identity and are contractually prohibited from using that data for any other purpose.
• Payment processors: bbdk shares necessary financial and identity data with bKash, Nagad, Rocket, Upay, and participating banks (including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank) for the sole purpose of processing your deposit and withdrawal transactions.
• Game content suppliers: Game providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive your account identifier (but not your full personal details) for the purpose of delivering game content and maintaining game session integrity. These providers are subject to their own data protection obligations.
• Platform technology providers: Providers of hosting, security, analytics, fraud detection, and customer support technology that underpin the bbdk platform may process personal data on bbdk's behalf as data processors. All such providers are subject to written data processing agreements that impose appropriate data protection standards.
• Regulatory and law enforcement authorities: bbdk may disclose personal data to competent authorities, regulators, courts, or law enforcement agencies where required to do so by applicable law, court order, or lawful regulatory request. bbdk will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event that bbdk undergoes a merger, acquisition, or sale of all or a substantial portion of its business assets, personal data held by bbdk may be transferred to the acquiring entity as part of that transaction. Users will be notified of any such transfer and the privacy policy applicable to their data following the transfer.

In all cases of data sharing, bbdk applies the principle of data minimisation — sharing only the minimum personal data necessary to achieve the specific purpose for which the sharing is taking place.

Cookies & Tracking Technologies

bbdk uses cookies and similar client-side technologies on the platform. Cookies are small text files placed on your device that allow the platform to recognise your browser across pages and sessions. The categories of cookies used by bbdk are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, preserve your account state as you navigate the platform, and enable the cashier and game-loading functions. These cookies cannot be disabled without breaking core platform functionality.
• Performance and analytics cookies: These cookies collect anonymised information about how users interact with the bbdk platform — for example, which pages are visited most frequently and whether any errors are encountered. This data is used solely to improve platform performance and is not linked to your personal identity.
• Functional cookies: These cookies remember your preferences — such as your preferred language setting, display preferences, and responsible gaming tool configurations — so that you do not need to re-enter them on each visit.
• Security cookies: These cookies support bbdk's fraud detection and account security systems by maintaining session integrity signals and detecting anomalous login patterns.

bbdk does not use third-party advertising cookies or behavioural tracking cookies for cross-site advertising purposes. You may adjust your browser's cookie settings to refuse certain categories of cookies, but please be aware that disabling strictly necessary cookies will prevent you from accessing core platform functions including your account and the cashier.

Data Security

bbdk implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The key security measures in place include:

• SSL/TLS encryption: All data transmitted between your device and bbdk's servers is encrypted using industry-standard SSL/TLS protocols. The bbdk platform is served exclusively over HTTPS.
• Access controls: Access to personal data within bbdk's systems is restricted on a need-to-know basis. Only authorised personnel whose roles require access to specific categories of personal data are granted that access, and all access is logged and audited.
• Password security: Account passwords are stored in hashed form using a cryptographically secure one-way hashing algorithm. bbdk support staff do not have access to your plain-text password under any circumstances. We recommend you use a strong, unique password for your bbdk account and enable SMS OTP two-factor authentication.
• Secure data storage: Personal data including KYC documents is stored in secured systems with appropriate logical and physical access controls. Payment card data (where applicable) is handled by PCI DSS-compliant payment processors and is not stored on bbdk's own infrastructure.
• Incident response: bbdk maintains an internal data security incident response process. In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected users, bbdk will notify affected users promptly and take all reasonable steps to contain and remediate the breach.

Data Retention

bbdk retains personal data for no longer than is necessary for the purposes for which it was collected, subject to overriding legal retention obligations. The general retention framework applied by bbdk is as follows:

• Active account data: Personal data associated with an active bbdk account is retained for the full duration of your account relationship with bbdk, plus a period of up to five (5) years following permanent account closure, in compliance with applicable AML record-keeping requirements.
• KYC verification documents: Identity verification documents submitted during the KYC process are retained for a minimum of five (5) years following account closure or the date of the last transaction on the account, whichever is later, in accordance with applicable anti-money laundering regulations.
• Transaction records: Financial transaction records (deposits and withdrawals in ৳ Taka) are retained for a minimum of five (5) years from the date of the transaction for AML compliance and dispute resolution purposes.
• Support communications: Records of customer support interactions are retained for two (2) years from the date of the final communication in the relevant support thread, or longer where a dispute or legal matter is ongoing.
• Technical and analytics data: Anonymised aggregated analytics data may be retained indefinitely as it does not constitute personal data. Non-anonymised technical data (such as IP logs) is retained for a maximum of twelve (12) months in standard circumstances.
• Marketing consent records: Records of marketing consent are retained for the duration of your account plus a period sufficient to demonstrate compliance with consent obligations in the event of a regulatory enquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with bbdk's internal data deletion procedures.

Your Rights as a Data Subject

Subject to applicable law and certain limited exceptions, you have the following rights in respect of your personal data held by bbdk:

• Right of access: You have the right to request a copy of the personal data that bbdk holds about you, along with information about how that data is being processed.
• Right to rectification: You have the right to request that bbdk corrects any inaccurate or incomplete personal data held about you. Where data can be corrected directly through your account dashboard, bbdk encourages you to do so without delay.
• Right to erasure ("right to be forgotten"): You have the right to request that bbdk deletes your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to bbdk's overriding legal obligations to retain certain data (such as KYC and transaction records) as described in Section 10.
• Right to restriction of processing: You have the right to request that bbdk restricts the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing and a determination is pending.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request that bbdk transmits that data to another controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data where that processing is based on bbdk's legitimate interests. bbdk will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent (for example, optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact bbdk using the details provided in Section 16 of this Policy. bbdk will respond to all data subject rights requests within 30 calendar days of receipt, subject to verification of your identity. In complex cases, this period may be extended by a further 60 days, in which case bbdk will notify you of the extension and the reasons for it.

Children & Minors

The bbdk platform is strictly intended for adults aged 21 years and above. bbdk does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and additional KYC checks are performed to confirm the age of all account holders.

If bbdk becomes aware that personal data has been collected from an individual under the age of 21, it will take immediate steps to delete that data and permanently close the associated account. Any balance in such an account will be handled in accordance with applicable law and the bbdk Terms & Conditions.

If you are a parent or guardian and believe that your child under the age of 21 has registered an account with bbdk or submitted personal data to the platform, please contact bbdk support immediately using the details in Section 16. bbdk will investigate and take prompt action.

International Data Transfers

The bbdk platform serves users primarily in Bangladesh. Personal data collected by bbdk may be processed by bbdk's technology infrastructure and third-party service providers located in jurisdictions outside Bangladesh. Where personal data is transferred internationally, bbdk ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy.

Appropriate safeguards for international transfers may include contractual clauses between bbdk and the relevant data recipient that impose data protection obligations on the recipient, or reliance on the data protection framework of the receiving jurisdiction where that framework has been assessed as providing an adequate level of protection.

You may request further information about the specific safeguards applied to international transfers of your personal data by contacting bbdk using the details provided in Section 16.

Third-Party Links

The bbdk platform does not include links to third-party websites as a general rule. Where any reference to a third-party service provider (such as a payment processor) appears in the platform's informational content, bbdk is not responsible for the privacy practices of that third party. Each third-party service provider operates under its own privacy policy, which governs the data that provider collects in the course of its own operations.

bbdk strongly encourages users to review the privacy policies of any third-party payment providers — including bKash, Nagad, Rocket, and Upay — to understand how those providers handle personal data submitted directly to their platforms during payment transactions.

Policy Updates

bbdk reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, bbdk's data processing practices, or the services offered on the platform. When material changes are made to this Policy, bbdk will publish the updated Policy on the platform with a revised effective date and will make reasonable efforts to notify registered users via their registered email address prior to the changes taking effect.

The effective date at the top of this Policy indicates when it was last updated. Your continued use of the bbdk platform following the effective date of any revised Policy constitutes your acknowledgement of the updated Policy. If you have any concerns about a change to this Policy, you should contact bbdk support before continuing to use the platform.

Contact Us — Data & Privacy Enquiries

All enquiries relating to this Privacy Policy, data subject rights requests, or any concern about the way bbdk processes your personal data should be directed to the bbdk support team using the following contact details:

When submitting a data subject rights request or privacy enquiry by email, please include your registered bbdk username, the email address associated with your account, and a clear description of your request or concern. This information is necessary to locate your account records and verify your identity before any action is taken.

bbdk is committed to resolving all privacy-related concerns in a fair, transparent, and timely manner. If you are not satisfied with bbdk's response to your enquiry, you may have the right to escalate your concern to a relevant data protection supervisory authority in your jurisdiction.