bdt3 Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") is issued by bdt3 ("we", "us", "our", "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data relating to all individuals ("you", "your", "Player", "User") who access or use the bdt3 online betting platform available at bdt3.io, including all associated subdomains, mobile web interfaces, and any future bdt3 application environments.

bdt3 is an English-language online betting platform directed at the Bangladesh market. The personal data we process relates primarily to registered players located in Bangladesh. This Policy is written in English and the English version constitutes the authoritative governing text for all data protection matters.

By completing the bdt3 account registration process, you acknowledge that you have read and understood this Privacy Policy in full and that you consent to the collection and processing of your personal data in the manner described herein. This Policy is incorporated by reference into the bdt3 Terms and Conditions and should be read together with that document. If you do not agree with any aspect of this Policy, you must discontinue use of the bdt3 platform immediately and submit an account closure request to [email protected].

This Policy applies to all categories of personal data processed by bdt3 in connection with the operation of the platform, including data collected during registration, KYC identity verification, payment processing, gameplay, customer support interactions, and technical platform usage monitoring.

bdt3 collects personal data across several distinct categories depending on the nature of your interaction with the platform. The categories of personal data we collect are set out below.

Data Category	Examples	When Collected
Identity Data	Full name, date of birth, gender, NID number, passport number	Registration & KYC verification
Contact Data	Mobile phone number, email address, residential district (e.g., Dhaka, Chittagong)	Registration
Financial Data	bKash / Nagad / Rocket account number, bank account details, transaction history, deposit and withdrawal records	Deposits, withdrawals, KYC
Verification Documents	Scanned NID card, passport photo page, selfie with ID, proof of payment method ownership	KYC verification
Gameplay Data	Bets placed, games played, wagering history, bonus usage, session duration, win/loss records	Ongoing platform use
Technical Data	IP address, device type, operating system, browser type and version, screen resolution, time-zone (BST UTC+6)	Each platform session
Communications Data	Support ticket content, email correspondence, chat transcripts	Customer support interactions
Preference Data	Responsible gaming tool settings, deposit limit preferences, marketing consent status	Account settings updates

bdt3 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data, except where health or vulnerability-related data is voluntarily disclosed by a player in the context of a responsible gaming self-exclusion or support request, in which case that disclosure is handled with the utmost confidentiality and used solely for the purpose of providing appropriate player welfare support.

bdt3 collects personal data through the following means:

• Direct Submission: Data you enter directly into the platform during account registration, KYC document upload, payment method setup, support contact forms, or account settings updates.
• Automated Technical Collection: Data collected automatically when you access the bdt3 platform, including IP address logging, session cookies, browser fingerprinting for fraud prevention, and server access logs. This collection occurs on every platform visit regardless of whether you are logged in.
• Payment Processor Integration: Transaction reference data returned by mobile wallet operators (bKash, Nagad, Rocket, Upay) and banking partners when you initiate a deposit or withdrawal. bdt3 receives transaction confirmation data but does not store full payment credentials such as mobile wallet PINs or bank account passwords.
• Game Provider Feeds: Aggregated gameplay session data returned by third-party game studio providers (such as Pragmatic Play, Evolution Gaming, Spribe, and others) confirming bet amounts, outcomes, and session identifiers. This data is linked to your bdt3 account for wagering history purposes.
• Customer Support Channels: Any personal data you include in communications directed to the bdt3 support team at [email protected], including account details, dispute descriptions, and any attachments you choose to provide.

bdt3 processes your personal data only for specific, defined purposes and only where a valid legal basis for that processing exists. The table below summarises the primary processing purposes and the corresponding legal basis for each.

Processing Purpose	Legal Basis
Account creation and management	Contract performance
Processing deposits and withdrawals	Contract performance
KYC identity verification and age confirmation (21+)	Legal obligation / Contract performance
Anti-money laundering (AML) monitoring and reporting	Legal obligation
Fraud prevention and account security	Legitimate interests
Responsible gaming intervention and player welfare	Legitimate interests / Legal obligation
Customer support provision	Contract performance
Dispute resolution and bet settlement	Contract performance / Legitimate interests
Platform performance analytics and improvement	Legitimate interests
Promotional communications (where consented)	Consent
Legal claims and regulatory cooperation	Legal obligation / Legitimate interests

Where bdt3 relies on your consent as the legal basis for processing (such as for sending promotional communications about bonuses, seasonal offers, or BPL cricket betting promotions), you may withdraw that consent at any time by updating your communication preferences in your account settings or by notifying [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

bdt3 does not sell, rent, or trade your personal data to any third-party commercial entity for marketing purposes. Personal data is shared with third parties only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Processors: bKash, Nagad, Rocket, Upay, partner banks (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), Visa, and Mastercard receive the transaction data necessary to process your deposit or withdrawal request. Each payment partner operates under its own privacy and data protection terms.
• Identity Verification Services: Third-party KYC verification service providers may process scanned identity documents on bdt3's behalf to confirm document authenticity and conduct age verification. These providers act as data processors under contractual obligation to use your data solely for verification purposes.
• Game Content Providers: Third-party game studios (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming, and others) receive session identifiers and stake/result data necessary to deliver game content and confirm bet outcomes. They do not receive your full identity profile.
• Fraud and AML Screening Services: bdt3 may share transactional and identity data with third-party fraud detection and AML compliance screening providers to fulfil its legal obligations. These providers are contractually bound to strict data processing limitations.
• Law Enforcement and Regulatory Authorities: bdt3 will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by a valid legal order, warrant, or statutory obligation. bdt3 will not notify you of such disclosure where doing so would be prohibited by law or would compromise an investigation.
• Corporate Transactions: In the event of a merger, acquisition, asset sale, or restructuring involving bdt3, personal data held by the platform may be transferred to the acquiring or successor entity, subject to equivalent data protection commitments.

bdt3 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below represent bdt3's standard data retention schedule.

• Active Account Data: Retained for the full duration of your account's active status plus a minimum of 5 years following account closure. This extended retention period is maintained to satisfy AML record-keeping requirements and to enable resolution of any late-arising disputes.
• KYC Verification Documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Financial Transaction Records: All deposit, withdrawal, and bonus transaction records are retained for a minimum of 5 years from the transaction date.
• Customer Support Communications: Support ticket records, email correspondence, and chat transcripts are retained for 3 years from the date of the relevant interaction.
• Technical Access Logs: Server access logs and IP address records are retained for 12 months from the date of collection and then automatically purged, unless a specific log entry is flagged as relevant to an ongoing investigation or dispute.
• Marketing Consent Records: Records of consent grant and withdrawal are retained for 6 years from the date of the last consent action, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised such that it can no longer be linked to a specific individual. Anonymised aggregate statistical data may be retained indefinitely for platform analytics and reporting purposes.

bdt3 applies a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The key security controls in place are described below.

• Transport Encryption: All data transmitted between your device and the bdt3 platform is encrypted using TLS 1.2 or TLS 1.3 with 256-bit SSL certificates. This applies to all platform pages, login sessions, payment flows, and API communications.
• Password Hashing: Account passwords are stored using industry-standard one-way cryptographic hashing algorithms with salting. Plain-text passwords are never stored and are never accessible to bdt3 staff.
• Two-Factor Authentication: bdt3 provides SMS OTP two-factor authentication for all registered accounts. Players are strongly encouraged to enable this feature via their account security settings to add a second layer of protection against unauthorised login attempts.
• Access Controls: Access to personal data by bdt3 staff is restricted on a strict need-to-know basis. Customer support staff access only the account fields required to respond to your specific query. Database administrators access is logged and audited.
• Data Minimisation: bdt3 collects only the minimum personal data necessary for each specific processing purpose, in accordance with the data minimisation principle.
• Fraud Detection Systems: Automated fraud detection systems monitor account activity in real time for anomalous patterns such as unusual login geography, multiple rapid withdrawal requests, or velocity patterns inconsistent with normal player behaviour.
• Data Breach Response: bdt3 maintains an internal data breach response procedure. In the event of a confirmed personal data breach that poses a risk to affected players, bdt3 will notify the affected players via their registered email address within a reasonable timeframe, describing the nature of the breach and the remediation steps taken.

bdt3 uses cookies and similar tracking technologies to operate core platform functions, maintain session continuity, prevent fraud, and understand how players interact with the platform. The categories of cookies used by bdt3 are described below.

• Strictly Necessary Cookies: These cookies are essential for the bdt3 platform to function. They maintain your authenticated login session, store your language and currency preferences, and enable the secure transmission of form data. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your account preferences and settings between sessions, such as your responsible gaming tool configurations and notification preferences, so you do not need to re-enter them on each visit.
• Security and Fraud Prevention Cookies: These cookies support bdt3's fraud detection and AML monitoring systems by tracking session identifiers, device fingerprints, and access patterns. They are necessary for the security of your account and the integrity of the platform.
• Performance and Analytics Cookies: These cookies collect anonymised data about how players navigate and use the bdt3 platform — such as which pages are visited most frequently, average session duration, and which game categories are accessed most often. This data is used solely to improve platform performance and user experience. The data collected is aggregate and does not identify individual users.

bdt3 does not use third-party advertising or retargeting cookies. No cookies placed by bdt3 are shared with advertising networks or used to build cross-site behavioural profiles.

You may manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary or security cookies may prevent you from logging in or using key platform features. To clear existing cookies stored by bdt3, use the cookie or site data management tools available in your browser's privacy or settings menu.

As a registered player on the bdt3 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address, clearly stating the right you wish to exercise and providing sufficient account identification for us to verify your identity.

• Right of Access: You have the right to request a copy of the personal data bdt3 holds about you. bdt3 will provide a structured summary of your personal data within 30 days of receiving a verified access request.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. Minor contact detail updates (such as email address or mobile number changes) can be made directly via your account settings.
• Right to Erasure: You may request deletion of your personal data where the data is no longer necessary for the purpose for which it was collected and no overriding legal retention obligation applies. Note that bdt3 is required by AML regulations to retain certain financial and identity records for a minimum of 5 years from account closure, regardless of an erasure request. Data subject to a mandatory legal retention period cannot be deleted until that period expires.
• Right to Restrict Processing: You may request that bdt3 restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data while bdt3 verifies the correction, or where you have objected to processing pending the outcome of that objection.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) for the data you provided to bdt3 directly and which bdt3 processes on the basis of your consent or a contract. Contact [email protected] to request a data export.
• Right to Object: You have the right to object to processing of your personal data where bdt3 relies on legitimate interests as the legal basis. bdt3 will stop that processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without detriment to your account status. Withdrawal takes effect promptly but does not affect any processing lawfully carried out prior to withdrawal.

bdt3 aims to respond to all data rights requests within 30 calendar days of receipt of a complete, verified request. Where a request is particularly complex or a high volume of requests has been received simultaneously, bdt3 may extend this period by a further 30 days and will notify you of the extension and the reason for it within the initial 30-day window.

The bdt3 platform integrates with a number of third-party service providers to deliver its full range of betting and gaming features. While bdt3 selects these providers carefully and requires them to maintain adequate data protection standards, each provider operates under its own privacy terms for the data it processes in its own right.

bdt3's primary third-party integration categories include: payment gateway operators (bKash, Nagad, Rocket, Upay, partner banks, Visa and Mastercard network processors); game content providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming, and other licensed studios integrated into the bdt3 game library); KYC and identity verification technology providers; fraud screening and AML monitoring service providers; and platform infrastructure and hosting providers.

When you interact with a third-party game provider's content embedded within the bdt3 platform, that provider may independently collect technical session data such as your device type and session duration. bdt3 does not control this third-party data collection beyond the contractual obligations imposed on providers in bdt3's supplier agreements. You are encouraged to review the relevant provider's own privacy documentation if you have specific concerns about their data practices.

The bdt3 platform does not contain links to external third-party websites. Where third-party service logos or brand names appear on the bdt3 platform (such as payment method icons), these are presented for informational purposes only and do not constitute endorsement links or navigation to external sites.

bdt3 enforces a strict minimum age policy of 21 years for all registered players. The bdt3 platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. Registration by persons under the age of 21 is strictly prohibited and constitutes a material breach of the bdt3 Terms and Conditions.

As part of the bdt3 KYC verification process, all players are required to submit a government-issued photographic identity document confirming their date of birth. Any account found to belong to a person under the age of 21 will be immediately closed, all pending transactions will be reversed, any bonus funds will be forfeited, and the matter may be reported to the appropriate authorities.

If bdt3 becomes aware that it has inadvertently collected personal data from a person under the age of 21, that data will be deleted as promptly as operationally possible after the discovery is confirmed. If you are a parent or guardian and believe a minor has registered an account on the bdt3 platform, please contact [email protected] immediately with full details so that the account can be identified, closed, and the associated data purged without delay.

bdt3 reserves the right to update or revise this Privacy Policy at any time to reflect changes in platform features, data processing practices, legal obligations, or regulatory guidance. Material changes to this Policy — meaning changes that substantively affect your rights or the way bdt3 processes your personal data — will be communicated to registered players via email notification to the registered address at least 7 days before the change takes effect.

Non-material changes, such as typographic corrections, clarifications of existing practices, or formatting updates that do not alter the substantive content of the Policy, may be made without prior notice. The "Effective Date" displayed at the top of this document and in the hero section above will be updated to reflect the date on which the most recent revision took effect.

Continued use of the bdt3 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the platform and submit an account closure request to [email protected] before the revised Policy takes effect.

For any questions, concerns, or formal notices relating to this Privacy Policy or bdt3's data processing practices, please contact the bdt3 data protection team in writing at: [email protected]. Please include your registered account details, a clear description of your query or concern, and the specific section of this Policy to which your enquiry relates. bdt3 aims to respond to all privacy-related correspondence within 5 business days.