Privacy Policy for 28bd9

When you register and use the 28bd9 platform, we collect personal data from you in several ways. This section describes the categories of data we collect, the specific data points within each category, and the primary reason for collecting them.

1.1 Registration and Account Data

When you create a 28bd9 account, we collect: your full legal name, date of birth, email address, mobile phone number (typically a Bangladeshi number), chosen username, and a hashed version of your password. This data is required to create and maintain your account and to verify that you meet our eligibility requirements, including the 18+ age restriction.

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer obligations and to prevent fraud and money laundering, we may collect copies of the following documents:

• National Identity Card (NID) or passport (front and back);
• Proof of address such as a utility bill, bank statement, or official government letter dated within three months;
• Selfie or live photo for biometric comparison with your ID document;
• Proof of payment method ownership (e.g., a screenshot of your bKash or Nagad account showing your name and number).

KYC documents are processed securely and retained only for the period required by applicable law.

1.3 Financial Transaction Data

We collect records of all financial transactions made through your 28bd9 account, including deposit amounts, withdrawal requests, bonus credits, wagering history, and the payment methods used (such as bKash, Nagad, Rocket, Upay, or bank transfer). We do not store full payment account credentials — only the masked identifiers necessary for transaction reconciliation.

1.4 Device and Technical Data

When you access 28bd9 via a browser or mobile device, we automatically collect certain technical data, including your IP address, device type and model, operating system and version, browser type and version, and screen resolution. This data is used to optimise platform performance and to detect suspicious or fraudulent access patterns.

1.5 Behavioural and Usage Data

We collect data about how you interact with the platform: pages visited, games played, bets placed, session duration, click patterns, and features accessed. This data is used in aggregate form to improve the platform experience and, at an individual level, to support responsible gaming monitoring.

1.6 Communications Data

If you contact our support team via live chat or email, we retain a record of those communications, including your name, email address, the content of your enquiry, and our response. This is used for quality assurance, dispute resolution, and compliance purposes.

28bd9 processes your personal data only for specific, legitimate purposes. Below is a summary of how each category of data is used and the legal basis on which we rely to process it.

Marketing Communications: We may send you promotional emails or in-platform notifications about bonuses, new games, and seasonal offers such as Eid promotions, BPL cricket specials, or Pohela Boishakh campaigns. You will only receive marketing communications if you opted in at registration or subsequently via your account settings. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting our support team.

Automated Decision-Making: 28bd9 uses automated systems to detect suspicious betting patterns, identify potential problem gambling behaviour, and flag accounts for fraud review. Where an automated decision has a significant effect on your account (for example, account suspension), you have the right to request a human review of that decision by contacting our support team.

28bd9 does not sell your personal data. We share data only with carefully selected third parties where it is necessary to deliver our services, meet legal requirements, or protect the integrity of the platform. All third-party partners are subject to contractual data processing agreements that bind them to the same standards of data security and confidentiality that we uphold.

The categories of third parties with whom we may share your data are as follows:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and other payment partners receive limited transaction data necessary to process your deposits and withdrawals. They do not receive your betting history or game activity;
• Identity verification providers: Third-party KYC and age verification services receive copies of your identity documents solely for the purpose of verifying your identity and age. These providers are contractually prohibited from using your data for any other purpose;
• Game providers: Our casino and sports betting content is supplied by game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive a session token and player identifier to facilitate game delivery, but do not receive your full personal profile;
• IT infrastructure and hosting providers: Our platform is hosted on secure servers. Infrastructure providers may have access to encrypted data as part of providing hosting, backup, and maintenance services;
• Analytics providers: We use privacy-respecting analytics tools to understand aggregate usage patterns on the platform. These tools receive anonymised or pseudonymised data only;
• Law enforcement and regulatory authorities: We may disclose personal data to Bangladeshi law enforcement agencies, financial intelligence units, or other authorities where we are legally obliged to do so — for example, in connection with a court order, anti-money laundering investigation, or underage gambling report.

We do not share your personal data with social media platforms, advertising networks, data brokers, or any entity for the purpose of targeted advertising. If this policy ever changes in this regard, we will notify you and seek your explicit consent before any such sharing takes place.

Cookies are small text files placed on your device when you visit 28bd9. We use cookies and similar technologies (such as local storage and session tokens) to keep the platform functioning correctly, remember your preferences, maintain your login session, and gather aggregated analytics about platform usage.

The following table describes the types of cookies used on the 28bd9 platform:

Managing Cookies: You can control and manage cookies through your browser settings. Most browsers allow you to block all cookies, accept only first-party cookies, or delete cookies after each session. Please note that disabling essential cookies will prevent you from logging in or using core platform features. Instructions for managing cookies in popular browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data;
• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data;
• Samsung Internet (common on Bangladeshi Android devices): Settings → Privacy → Cookies.

28bd9 does not use third-party advertising cookies or cross-site tracking technologies. Our analytics data is processed in aggregate form only, and individual browsing records are not shared with any external party for profiling or advertising purposes.

28bd9 takes the security of your personal data very seriously. We implement a range of technical and organisational measures to protect your information against unauthorised access, accidental loss, destruction, or disclosure.

Technical Security Measures:

• All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS technology;
• Passwords are stored using industry-standard one-way cryptographic hashing — we cannot retrieve your password in plain text;
• Access to personal data within our organisation is restricted on a strict need-to-know basis, with role-based access controls enforced;
• Our servers are protected by firewalls, intrusion detection systems, and regular penetration testing;
• Payment credential data (e.g., bKash account numbers) is stored only in masked or tokenised form;
• Multi-factor authentication is available for player accounts and is mandatory for internal staff access to data systems.

Data Retention: We retain your personal data for the following periods:

• Active account data: Retained for the lifetime of your account plus five (5) years following permanent account closure;
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, as required by anti-money laundering regulations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• Support communications: Retained for three (3) years from the date of the last communication;
• Analytics and behavioural data: Retained in anonymised aggregate form for up to three (3) years; individual-level data deleted within twelve (12) months of collection.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised. Where deletion is not immediately possible due to backup schedules, the data is isolated and protected until deletion is complete.

Data Breach Response: In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, 28bd9 will notify affected players by email within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable data protection obligations. Our notification will include the nature of the breach, the data categories affected, the likely consequences, and the steps we are taking to address the situation.

As a player on the 28bd9 platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team via live chat or by emailing [email protected]. We will acknowledge your request within two business days and provide a full response within five business days.

• Right of Access: You may request a copy of all personal data that 28bd9 holds about you. We will provide this in a commonly used electronic format (such as PDF or CSV) at no charge, subject to verification of your identity;
• Right of Rectification: If any of your personal data held by 28bd9 is inaccurate or incomplete, you have the right to request that we correct or update it. You may also update basic account information (such as your email address or phone number) directly via your account settings;
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data. Please note that this right is subject to certain limitations — we may be required by law to retain certain data (such as financial records and KYC documents) for a defined period even after your account is closed;
• Right to Restrict Processing: You may request that we limit the way we process your data in certain circumstances — for example, while a dispute is being resolved or while we verify the accuracy of data you have challenged;
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, machine-readable format and to transmit it to another organisation where technically feasible;
• Right to Object: You may object to our processing of your personal data where we rely on legitimate interest as the legal basis. You also have an absolute right to opt out of direct marketing communications at any time;
• Rights Relating to Automated Decision-Making: Where an automated decision has a significant impact on your account, you may request human review of that decision and challenge the outcome.

We will not charge a fee for handling privacy rights requests unless they are manifestly unfounded or excessive. In such cases, we may charge a reasonable fee or decline to action the request, providing written reasons for our decision.

28bd9 has a zero-tolerance policy towards underage gambling and underage data collection. As part of our registration and KYC process, we verify the age of all players. If we become aware that a person under 18 has created an account or provided us with personal data, we will:

• Immediately suspend and permanently close the account;
• Void all bets and winnings associated with the account;
• Return any deposits made (where legally and technically possible) to the originating payment method;
• Permanently delete all personal data associated with the underage account as soon as legally permissible;
• Report the matter to relevant authorities where required by law.

If you are a parent or guardian and believe that your child has registered on 28bd9, please contact us immediately at [email protected]. We will investigate promptly and take all necessary action.

We strongly encourage parents and guardians of young people in Dhaka, Chittagong, Sylhet, Rajshahi, and across Bangladesh to use parental control software to restrict access to online gambling platforms. Resources for parental control tools are available from major internet service providers and device manufacturers.

28bd9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. When we make material changes to this policy, we will notify registered players by email and display a prominent notice on the platform at least seven (7) days before the changes take effect.

The date of the most recent revision will always be displayed at the top of this page. Your continued use of the 28bd9 platform after any changes to this policy constitutes your acceptance of the updated version. If you do not agree with any amendment, you must cease using the platform and may request account closure in accordance with our Terms & Conditions.

The current version of this Privacy Policy is effective as of 1 January 2026. Previous versions of this policy are available upon request by contacting our support team.

Data Controller Contact: For all privacy-related enquiries, data access requests, complaints, or questions about this policy, please contact the 28bd9 data protection team:

• Email: [email protected] (subject line: "Privacy Enquiry");
• Live Chat: Available 24/7 within the 28bd9 platform;
• Response Time: All privacy enquiries are acknowledged within two (2) business days and fully resolved within five (5) business days.

We are committed to resolving all privacy concerns fairly and transparently. If you are not satisfied with our response to a privacy complaint, you retain the right to escalate the matter to the appropriate data protection authority in your jurisdiction.