bd97 Privacy Policy — How We Protect Your Personal Data

1. Introduction

1.1 bd97 ("we", "us", or "our") operates the online betting and casino platform accessible at https://bd97.io, including all associated sub-domains and mobile applications (collectively, the "Platform"). We are committed to protecting the personal data of every individual who accesses or uses the Platform.

1.2 This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by bd97. Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it.

1.3 This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. By registering an account on the bd97 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

1.4 This Privacy Policy applies to all players, visitors, and users of the bd97 Platform, regardless of how they access the Platform (desktop browser, mobile browser, or mobile application). It applies to data collected online through the Platform and, where relevant, data received from third-party payment processors, identity verification services, and analytics providers that support the operation of the Platform.

2. Data Controller

2.1 For the purposes of applicable data protection legislation, bd97 is the data controller responsible for your personal data. This means we determine the purposes for which and the manner in which your personal data is processed.

2.2 If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to contact our data protection officer, please reach out to us at: [email protected]. We aim to respond to all data-related enquiries within 30 days of receipt.

2.3 Where bd97 engages third-party service providers to process personal data on its behalf (for example, payment processors, KYC verification services, or cloud hosting providers), those third parties act as data processors and are bound by written data processing agreements that restrict them from using your data for any purpose other than the specific service they are providing to bd97.

3. Data We Collect

3.1 bd97 collects and processes the following categories of personal data, depending on how you interact with the Platform:

3.1 Identity Data

Full legal name, date of birth, gender, nationality, and government-issued identification document details (such as National ID card number, passport number, or driving licence number) collected during registration and KYC verification.

3.2 Contact Data

Email address, mobile phone number, and residential address, including city, district, and postal code. For players based in Bangladesh, this may include references to Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar as the player's registered city of residence.

3.3 Financial Data

Payment method details necessary to process deposits and withdrawals, including mobile banking account identifiers (bKash, Nagad, Rocket, Upay account numbers), bank account details for BRAC Bank, Dutch-Bangla Bank, City Bank, or other supported Bangladeshi banking institutions, and cryptocurrency wallet addresses for USDT and BTC transactions. bd97 does not store raw Visa or Mastercard numbers on its own servers — card payments are tokenised by our PCI-DSS compliant payment gateway partner.

3.4 Transaction Data

Records of all deposits, withdrawals, bets placed, games played, bonuses claimed, and any other financial transactions conducted through your bd97 account. Transaction records include timestamps (expressed in Bangladesh Standard Time, UTC+6), transaction reference numbers, amounts in BDT or cryptocurrency, and the outcome of each transaction.

3.5 Technical Data

IP address, browser type and version, device type and model, operating system, time zone setting, screen resolution, and other technical identifiers collected automatically when you access the Platform. This data is used for security monitoring, fraud detection, and ensuring the Platform functions correctly across different devices.

3.6 Usage Data

Information about how you use the Platform, including pages visited, games accessed, session duration, click paths, search queries entered, features used, and in-game activity. This data is used to personalise your experience and to improve the Platform's content and functionality.

3.7 Communications Data

Records of communications between you and bd97, including live chat transcripts, email correspondence, and support ticket logs. These records are retained to ensure quality of service and to resolve any disputes that may arise.

3.8 Marketing Preference Data

Your preferences regarding receipt of marketing communications from bd97, including which communication channels (email, SMS, push notification) you have opted into or out of, and any promotional codes or referral identifiers associated with your account registration.

4. How We Collect Your Data

4.1 Direct Collection. You provide data directly to bd97 when you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, participate in a promotion, or respond to a survey. This direct collection is the primary source of identity, contact, and financial data.

4.2 Automated Collection. Technical and usage data is collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access or interact with the Platform. See Section 8 (Cookies & Tracking) for full details.

4.3 Third-Party Sources. bd97 may receive data about you from third parties in the following circumstances: identity verification bureaus and KYC service providers that confirm your identity and age; payment processors that relay transaction status and fraud signals; fraud prevention and anti-money-laundering screening services; and analytics providers that aggregate anonymised usage statistics. Data received from third parties is combined with data you have provided directly to create a complete account record.

5. Purposes of Processing

5.1 bd97 processes your personal data for the following purposes:

Purpose	Data Categories Used
Account registration and management	Identity, Contact
Processing deposits and withdrawals	Identity, Financial, Transaction
KYC and age verification (21+ compliance)	Identity, Contact, Financial
Fraud prevention and security monitoring	Identity, Technical, Transaction, Usage
Responsible gaming tools and self-exclusion	Identity, Transaction, Usage
Customer support and dispute resolution	Identity, Contact, Communications
Personalising your gaming experience	Usage, Marketing Preference
Sending promotional offers and bonuses (where consented)	Contact, Marketing Preference
Platform analytics and product improvement	Technical, Usage
Legal and regulatory compliance	All categories as required

6. Legal Basis for Processing

6.1 bd97 processes your personal data on the following legal bases:

• Performance of a contract: Processing that is necessary to create and manage your bd97 account, process your deposits and withdrawals, deliver the games and services you have requested, and fulfil our obligations under the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, KYC obligations, responsible gaming requirements, and any other legal or regulatory duty to which bd97 is subject.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform analytics, and product improvement, where such processing is necessary for bd97's legitimate business interests and does not override your fundamental privacy rights.
• Consent: Processing of your data for marketing communications, personalised promotional offers, and non-essential cookies, in each case only where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

7. Data Sharing and Disclosure

7.1 bd97 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the following limited circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, and our card payment gateway and cryptocurrency processing partners receive the minimum financial data necessary to process your transactions. These partners are contractually bound to process your data solely for payment fulfilment purposes.
• KYC and identity verification providers: Third-party identity verification services receive copies of your KYC documents (government ID, proof of address) solely for the purpose of verifying your identity and age in compliance with our responsible gaming obligations.
• Game providers: Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and Evolution Gaming may receive anonymised session and gameplay data to facilitate delivery of their games on the bd97 Platform. These providers do not receive your identity or financial data except where required for regulatory compliance in the jurisdiction in which they operate.
• Analytics providers: Anonymised and aggregated usage data may be shared with analytics service providers to help bd97 understand how the Platform is used and to improve its products and services. No personally identifiable information is shared with analytics providers.
• Legal and regulatory authorities: bd97 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory direction. bd97 will notify you of any such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bd97's business assets, your personal data may be transferred to the acquiring entity, subject to the acquiring entity assuming the same data protection obligations described in this Privacy Policy.

8. Cookies & Tracking Technologies

8.1 bd97 uses cookies, web beacons, pixel tags, and similar tracking technologies to operate the Platform, personalise your experience, and analyse usage patterns. A cookie is a small text file placed on your device by your web browser when you visit the bd97 Platform.

8.2 bd97 uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be disabled. They include session management cookies that keep you logged in during a session, security tokens that protect against cross-site request forgery, and load-balancing cookies. No personal data is shared with third parties through strictly necessary cookies.
• Functional cookies: These cookies remember your preferences, such as your preferred game category, language setting (English), and any responsible gaming limits you have set, so that you do not need to re-enter them on each visit. Disabling functional cookies may affect your Platform experience.
• Analytics cookies: These cookies collect anonymised information about how visitors use the Platform — such as which pages are visited most frequently and whether users encounter error messages — to help bd97 improve the Platform. bd97 uses privacy-respecting analytics tools that do not identify individual users.
• Marketing cookies: These cookies are used only where you have provided explicit consent and are used to track whether a promotional campaign led to your registration, to attribute bonuses correctly, and to deliver personalised promotional content within the Platform. You may opt out of marketing cookies at any time via your account settings.

8.3 You may control and manage cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and be notified when a new cookie is set. Please note that restricting strictly necessary cookies may prevent certain features of the Platform from functioning correctly.

9. Data Retention

9.1 bd97 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, as described in Section 5, or as required by applicable legal and regulatory obligations.

9.2 The following indicative retention periods apply to the main categories of personal data held by bd97:

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 5 years after closure	Legal and regulatory compliance
KYC documents	Duration of account + 5 years after closure	Anti-money-laundering obligations
Transaction records	Duration of account + 7 years after closure	Financial record-keeping requirements
Support communications	3 years from the date of the communication	Dispute resolution and quality assurance
Technical and usage data	13 months from collection	Analytics and fraud prevention
Marketing preference data	Until you withdraw consent or close your account	Consent-based processing

9.3 At the end of the applicable retention period, bd97 will securely delete or anonymise your personal data in accordance with industry-standard data destruction procedures. Anonymised data that cannot reasonably be used to identify you may be retained indefinitely for statistical and analytical purposes.

10. Data Security

10.1 bd97 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bd97's servers.
• AES-256 encryption for personal data stored in bd97's databases, including KYC documents and financial records.
• Role-based access controls that restrict employee access to personal data on a strict need-to-know basis, with all access logged and auditable.
• Multi-factor authentication requirements for all bd97 internal systems that hold personal data.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists.
• A documented incident response plan that includes procedures for identifying, containing, and reporting data breaches within 72 hours of discovery.
• Firewall, intrusion detection, and DDoS mitigation systems protecting bd97's hosting infrastructure.

10.2 While bd97 takes data security very seriously and applies industry-leading protective measures, no system is entirely immune from security incidents. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bd97 will notify you as soon as reasonably practicable and will provide guidance on any protective steps you should take.

10.3 You are also responsible for maintaining the security of your own bd97 account. We strongly recommend using a unique, strong password for your bd97 account, enabling any available two-factor authentication, and logging out of your account when using a shared or public device.

11. Your Data Rights

11.1 Subject to applicable law, you have the following rights in relation to your personal data held by bd97:

• Right of access: You may request a copy of all personal data bd97 holds about you. bd97 will provide this information within 30 days of receiving a valid request, free of charge.
• Right to rectification: You may request that bd97 correct any inaccurate or incomplete personal data held about you. You may also update certain account details directly through your account settings page.
• Right to erasure: You may request that bd97 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing and there is no overriding legitimate interest. Please note that bd97 may be required to retain certain data to comply with legal obligations, even following a deletion request.
• Right to restriction of processing: You may request that bd97 restrict the processing of your personal data in certain circumstances, such as while a dispute about its accuracy is being resolved.
• Right to data portability: You may request that bd97 provide your personal data in a structured, commonly used, and machine-readable format, and transmit that data to another data controller where technically feasible.
• Right to object: You may object to bd97's processing of your personal data for direct marketing purposes at any time, and to processing based on legitimate interests where you believe your fundamental rights and freedoms override those interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

11.2 To exercise any of the above rights, please contact bd97's data protection team at [email protected] with the subject line "Data Rights Request". bd97 will verify your identity before processing any data rights request to ensure the security of your personal information.

12. Children's Privacy

12.1 The bd97 Platform is strictly intended for adults aged 21 years and above. bd97 does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account, deposit funds, or use the bd97 Platform in any capacity.

12.2 If bd97 becomes aware that it has inadvertently collected personal data from an individual under the age of 21, bd97 will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe your child has registered a bd97 account, please contact us immediately at [email protected].

12.3 bd97 encourages parents and guardians to use reputable parental control software to prevent minors from accessing online gambling platforms, including bd97.io.

13. International Data Transfers

13.1 bd97's primary servers and data storage infrastructure are located in data centres that apply industry-standard physical and cyber security controls. In the course of operating the Platform, your personal data may be processed by service providers located outside of Bangladesh, including cloud infrastructure providers, payment processing partners, and game content delivery networks.

13.2 Where personal data is transferred to a jurisdiction that may not provide the same level of data protection as Bangladesh, bd97 ensures that appropriate safeguards are in place before any such transfer occurs. These safeguards include binding contractual clauses that require the recipient to protect your personal data to a standard equivalent to that applied by bd97, and where available, reliance on adequacy determinations or equivalent frameworks recognised under applicable data protection law.

13.3 By using the bd97 Platform, you acknowledge and consent to the transfer of your personal data to the locations described above, subject to the safeguards described in this Section 13.

14. Third-Party Links

14.1 The bd97 Platform may contain references to or display content from third-party game providers (Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, Evolution Gaming). While bd97 exercises care in selecting its game provider partners, bd97 is not responsible for the privacy practices of these third-party providers in relation to data processed directly by their own gaming systems.

14.2 This Privacy Policy applies solely to data collected and processed by bd97 through the bd97 Platform. bd97 encourages you to review the privacy policies of any third-party service providers whose content you access through the Platform, particularly in relation to any data that may be processed directly by those providers' gaming engines or delivery networks.

15. Changes to This Privacy Policy

15.1 bd97 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or business operations. The "Effective Date" at the top of this Privacy Policy indicates when the current version came into force.

15.2 Where a change is material — meaning it significantly affects how we process your personal data or reduces your privacy rights — bd97 will notify registered players via email and an in-platform notification at least 7 days before the updated Privacy Policy takes effect. For minor, non-material changes (such as typographical corrections or clarifications that do not alter the substance of our practices), bd97 may update the Privacy Policy without prior notice.

15.3 Your continued use of the bd97 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must cease using the Platform and close your account by contacting [email protected] prior to the effective date of the amendment.

16. Contact Us

16.1 If you have any questions, concerns, or complaints regarding this Privacy Policy or bd97's data processing practices, please contact our data protection team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.

16.2 Email: [email protected] (subject line: "Privacy Policy Enquiry" or "Data Rights Request")

16.3 bd97 aims to respond to all privacy-related enquiries within 30 days of receipt. For complex requests involving multiple data categories or requiring extensive internal review, bd97 may extend this response period by a further 30 days, in which case you will be notified of the extension and the reason for the delay within the initial 30-day period.

16.4 This Privacy Policy is available in English and the English version governs in all circumstances. This Privacy Policy is published at bd97.io/privacy-policy and may be downloaded or printed for your personal records at any time.