Privacy Policy — bdbagg

When you use the bdbagg Platform, we collect the following categories of personal information:

• Registration data: Full name, date of birth, email address, mobile phone number, and residential address provided during account sign-up.
• Identity verification data: Copies of your National Identity Card (NID), passport, or other government-issued documents submitted as part of our KYC process.
• Financial data: Details of deposits and withdrawals, including transaction amounts, timestamps, and the mobile banking or bank account identifiers (e.g., bKash number, Nagad number, Rocket number, bank account name) associated with your transactions. We do not store full card numbers or banking passwords.
• Usage data: Pages visited, games played, bet amounts, session duration, login timestamps, and in-platform actions recorded for security, compliance, and service improvement purposes.
• Technical data: IP address, device type, operating system, browser type and version, and network provider information collected automatically when you access the Platform.
• Communication data: Records of any messages you send to our customer support team, including email correspondence and live chat transcripts.
• Responsible gaming data: Self-exclusion requests, deposit limit settings, and any voluntary disclosures you make in the context of our responsible gaming tools.

We collect this information directly from you when you register, deposit, play, or contact us, and automatically through cookies and server logs when you browse the Platform.

bdbagg processes personal data for the following specific purposes, each of which is supported by a lawful basis:

• Account management: To create, maintain, and administer your bdbagg account, including processing logins, password resets, and profile updates.
• Identity and age verification: To confirm that you are aged 21 or above and that the information you have provided is accurate, as required for safe platform operation.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels in Bangladeshi Taka (BDT).
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, underage gambling, account takeovers, and other prohibited activities.
• Regulatory compliance: To meet obligations under applicable Bangladeshi law, including anti-money-laundering (AML) requirements and any directives issued by relevant authorities.
• Service communications: To send you transactional notifications such as deposit confirmations, withdrawal updates, and security alerts. These messages are essential to service delivery and cannot be opted out of while your account is active.
• Marketing communications: To inform you of bonuses, promotions, and platform updates where you have provided explicit consent. You may withdraw marketing consent at any time by contacting [email protected].
• Responsible gaming: To monitor gameplay patterns that may indicate problem gambling behaviour and to apply the responsible gaming tools you have requested.
• Platform improvement: To analyse aggregated and anonymised usage data for the purpose of improving the user experience, game selection, and platform performance.

We rely on the following legal bases to process your personal data:

bdbagg does not sell, rent, or trade your personal data to any third party for commercial purposes. We share data only in the following strictly defined circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, and banking partners receive the transaction data required to process your deposits and withdrawals. Each provider operates under its own privacy policy and data security obligations.
• Identity verification providers: Third-party KYC and document verification services that assist us in confirming your identity and age may process the documents you submit. These providers are contractually bound to strict data confidentiality.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, and Microgaming may receive a pseudonymous player identifier and game session data to deliver their games and calculate results. They do not receive your full name, NID, or financial details.
• Fraud and security partners: Specialist fraud detection and risk management services may receive technical data (IP address, device fingerprint, session data) to assess transaction risk.
• Legal and regulatory authorities: We will disclose personal data to law enforcement agencies, courts, or regulatory bodies in Bangladesh when required by law, court order, or in connection with a lawful investigation. We will notify you of such disclosures where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the bdbagg business, user data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom we share personal data are required to implement appropriate technical and organisational security measures and to use the data solely for the purpose for which it was shared.

bdbagg uses cookies and similar tracking technologies to deliver a functional, personalised, and secure platform experience. The cookies we use fall into the following categories:

• Strictly necessary cookies: These are essential for the Platform to function. They manage your login session, maintain your account security, and remember your language and currency preferences. These cookies cannot be disabled.
• Performance and analytics cookies: These collect anonymised data about how users interact with the Platform — which pages are visited most, where users drop off, and how long sessions last. This data helps us improve the Platform. You may opt out of analytics cookies.
• Functional cookies: These remember preferences you have set, such as responsible gaming limit configurations, so that your settings persist across sessions.
• Security cookies: These help us detect suspicious activity, prevent cross-site request forgery (CSRF), and protect your account from unauthorised access.

Cookies set by bdbagg are first-party cookies. Some third-party game providers and payment processors may also set their own cookies when you interact with their embedded services. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent certain Platform features from functioning correctly.

We retain personal data for only as long as necessary to fulfil the purposes for which it was collected, subject to the following specific retention periods:

• Account and transaction records: Retained for a minimum of five years from account closure, in line with AML compliance best practices.
• KYC documentation: Retained for the duration of your account and for five years thereafter, or longer if required by applicable law.
• Customer support communications: Retained for three years from the date of the final message in a support thread.
• Marketing consent records: Retained until you withdraw consent, plus one year thereafter as evidence of the consent lifecycle.
• Technical and server log data: Retained for up to 12 months, after which it is either deleted or anonymised.

When retention periods expire, personal data is securely deleted using industry-standard erasure methods, or anonymised so that it can no longer be associated with any individual user.

bdbagg takes the security of your personal data seriously. We have implemented a layered set of technical and organisational measures to protect your information against unauthorised access, disclosure, alteration, and destruction:

• SSL/TLS encryption: All data in transit between your device and bdbagg servers is encrypted using current TLS standards.
• Encrypted data storage: Sensitive data at rest, including identity documents and financial records, is stored in encrypted form with access restricted to authorised personnel only.
• Access controls: Internal access to personal data is governed by role-based permissions. Staff members access only the data necessary for their specific job function.
• Password security: User passwords are stored using one-way cryptographic hashing. We never store or transmit your password in plain text.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users promptly.

While we take every reasonable precaution to safeguard your data, no digital platform can guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us immediately at [email protected] if you suspect any unauthorised activity on your account.

As a user of bdbagg, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with your full name, registered mobile number, and a clear description of your request:

• Right of access: You may request a copy of all personal data we hold about you. We will respond within 30 days of receiving a verified request.
• Right to rectification: If any data we hold about you is inaccurate or incomplete, you have the right to request a correction.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restrict processing: You may ask us to limit the way we use your data while a dispute or correction request is being resolved.
• Right to data portability: Where processing is based on your consent or contractual necessity, you may request a structured, machine-readable copy of data you have provided to us.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to processing based on legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

We will verify your identity before processing any data rights request to protect against unauthorised access. There is no charge for exercising your rights, though we reserve the right to charge a reasonable fee for manifestly unfounded or repetitive requests.

The bdbagg Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register an account or use the Platform in any capacity.

If we become aware that personal data has been collected from a user who is under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and — where applicable — report the matter in accordance with our safeguarding obligations. If you believe a minor may have registered on the Platform, please notify us immediately at [email protected].

bdbagg reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made, we will update the "Last Updated" date at the top of this page and, where the changes significantly affect your rights, we will notify you via your registered email address or through an in-platform notification.

We encourage you to review this Policy periodically. Continued use of the bdbagg Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should cease using the Platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about the way your personal data has been handled, please contact our data protection team using the details below. We aim to respond to all privacy-related enquiries within 10 business days.

If you are not satisfied with our response to your complaint, you may escalate the matter to the appropriate regulatory authority in Bangladesh. We remain committed to resolving all privacy concerns fairly and transparently.