bd35 Privacy Policy

bd35 is an online sports betting and casino platform operated under the brand name bd35 and accessible at bd35.io. For the purposes of this Privacy Policy, bd35 acts as the data controller in respect of all personal data collected from users of the bd35 platform, including visitors to the website, registered account holders, and any individual who communicates with bd35 through its customer support channels.

bd35 is designed and operated to serve the Bangladesh market. Our platform supports Bangladeshi Taka (BDT) transactions and integrates with payment providers widely used across Bangladesh, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. References in this policy to applicable law refer to the standards and expectations of responsible data handling applicable to platforms operating in the Bangladesh context.

This Privacy Policy applies to all personal data processed by bd35 in connection with the operation of the bd35 platform and its associated services. It covers:

• The bd35 website at bd35.io and all subpages, including game sections, account management pages, and promotional pages.
• Any bd35 mobile application or progressive web app (PWA) made available to users.
• All communications between bd35 and its users, including customer support interactions via email.
• Data collected from users during the account registration, identity verification, deposit, withdrawal, and responsible gaming processes.
• Automated data collected through cookies, server logs, and similar tracking technologies when a user visits or uses the platform.

This Privacy Policy does not apply to third-party websites, services, or platforms that may be linked to or referenced from the bd35 platform. bd35 is not responsible for the privacy practices of any third party. Where game content is provided by third-party studios — such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Ezugi — those providers operate under their own applicable data agreements as game technology suppliers to bd35.

bd35 collects the following categories of personal data from its users. The specific data collected from any individual user depends on the nature of their interaction with the platform.

3.1 Registration and Identity Data

• Full legal name as it appears on official government-issued identification.
• Date of birth (used to verify that you meet the minimum age requirement of 21 years).
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar) and postal code.
• Valid email address.
• Active Bangladeshi mobile phone number.
• Username and encrypted password chosen at registration.

3.2 Identity Verification Documents

• Copy of a government-issued photo ID (National Identity Card, passport, or driving licence).
• Proof of address documents (utility bill, bank statement, or equivalent issued within the past 3 months) where required for enhanced due diligence.
• Source-of-funds documentation where required under our anti-money laundering (AML) obligations.

3.3 Financial and Transaction Data

• Payment method identifiers associated with deposits and withdrawals, including bKash wallet numbers, Nagad account numbers, Rocket numbers, Upay IDs, or bank account details.
• Transaction amounts, timestamps, and reference numbers for all deposits, withdrawals, and bonus credits.
• Betting and gaming history, including all wager amounts, selections, outcomes, and account balance movements.

3.4 Technical and Usage Data

• IP address at the time of each login and each significant platform action.
• Device type, operating system, and browser version.
• Session duration, pages visited, games accessed, and click-path data.
• Geolocation data (country and city level, derived from IP address).
• Referral source (how you arrived at bd35.io, if determinable).

3.5 Communications Data

• The content of all emails and support messages you send to bd35, including any attachments.
• Records of customer support interactions, including the date, time, subject matter, and resolution of each support request.
• Responses to any voluntary surveys or feedback requests.

bd35 collects personal data through the following mechanisms:

• Directly from you: When you register for a bd35 account, complete your profile, submit identity verification documents, make deposits or withdrawals, place bets, or contact our support team, you provide data to us directly.
• Automatically through platform usage: When you visit or use the bd35 platform, our servers and analytics systems automatically record technical data including your IP address, browser type, device information, and session activity. This occurs whether or not you are a registered user.
• Through cookies and similar technologies: bd35 uses first-party cookies and similar web technologies to maintain session state, remember user preferences, and gather aggregated analytics on platform usage. See Section 8 for full details on our cookie practices.
• From payment processors: When you initiate a deposit or withdrawal, bd35 receives confirmation data from the relevant payment gateway (e.g., bKash, Nagad, Rocket, or a bank) sufficient to credit or debit your account correctly. bd35 does not store full payment credentials.
• From identity verification services: In cases where enhanced identity verification is required, bd35 may use automated document verification tools that process the images of identity documents you submit.

bd35 processes personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: The majority of data processing at bd35 is necessary to perform the contract between bd35 and a registered user — specifically, to provide an online betting and casino account, process deposits and withdrawals, settle bets, and deliver customer support. Without this processing, bd35 cannot provide its services.
• Legal obligation: bd35 processes identity verification data and transaction records in order to comply with its anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and responsible gaming duties, including age verification for the 21+ age restriction.
• Legitimate interests: bd35 processes technical and usage data on the basis of its legitimate interest in maintaining platform security, preventing fraud and abuse, improving the quality of its services, and understanding aggregate platform usage patterns. These interests do not override your individual privacy rights.
• Consent: Where bd35 sends you direct marketing communications about promotions, bonuses, or new features — beyond transactional notifications directly related to your account — we will seek your prior consent and provide a clear means to withdraw that consent at any time.

bd35 uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, verify your identity, authenticate your logins via two-factor authentication (2FA), and maintain accurate account records denominated in Bangladeshi Taka (BDT).
• Age and eligibility verification: To confirm that you are at least 21 years of age and legally eligible to use the bd35 platform, in accordance with bd35's strict 21+ age policy.
• Payment processing: To facilitate deposits from and withdrawals to your verified Bangladeshi payment accounts, including bKash, Nagad, Rocket, Upay, and bank accounts. Transaction data is retained for reconciliation, dispute resolution, and AML compliance.
• Bet and game settlement: To record, process, and settle all bets placed on sports markets (including BPL, IPL, T20 World Cup, and Bangladesh Tigers cricket matches) and all casino game sessions.
• Responsible gaming: To monitor account activity for signs of problem gambling behaviour, enforce any deposit limits, time-out periods, or self-exclusion requests you have applied, and to proactively reach out if your usage patterns suggest a need for support.
• Fraud prevention and AML compliance: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and other prohibited activities as described in the bd35 Terms & Conditions.
• Customer support: To respond to your enquiries, resolve account disputes, and maintain a record of support interactions for quality assurance and continuity purposes.
• Platform security and improvement: To identify and remediate security vulnerabilities, monitor for unusual access patterns, and use aggregated, anonymised usage analytics to improve platform performance and user experience.
• Legal and regulatory compliance: To satisfy any legal obligation to retain or report data, including in response to a lawful request from a competent authority.
• Marketing communications: To send you relevant promotional offers and notifications about new features or games where you have provided explicit consent to receive such communications.

bd35 does not sell, rent, or trade your personal data to any unaffiliated third party for commercial purposes. Personal data is shared with third parties only in the following strictly defined circumstances:

• Payment processors: To facilitate deposits and withdrawals, bd35 shares the minimum necessary transaction data with payment gateway providers including bKash, Nagad, Rocket, Upay, and banking partners. These providers process data solely for payment facilitation and are contractually bound to confidentiality.
• Identity verification providers: Where automated KYC document verification is used, your submitted identity documents may be processed by a specialist identity verification service acting as a data processor on bd35's behalf.
• Game content providers: Game studios such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi provide live and RNG game content to the bd35 platform. These providers may receive technical session data necessary to operate their games within the bd35 environment. They do not receive your identity or financial data.
• IT and platform infrastructure providers: Cloud hosting, content delivery, and cybersecurity service providers that support the technical operation of the bd35 platform may process technical and usage data in the course of providing their services. All such providers are engaged under data processing agreements.
• Legal and regulatory authorities: bd35 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by applicable law, court order, or regulatory obligation, or where bd35 reasonably believes disclosure is necessary to protect the rights, property, or safety of bd35 or others.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of bd35's assets, personal data held by bd35 may be transferred to the successor entity. Affected users will be notified via email prior to any such transfer taking effect.

bd35 uses cookies and similar web storage technologies to operate certain essential platform functions and to gather anonymous, aggregated analytics data. The following categories of cookies are used on the bd35 platform:

• Strictly necessary cookies: These cookies are essential for the bd35 platform to function. They maintain your authenticated session, preserve your account preferences within a single visit, and enable security features such as CSRF protection. Strictly necessary cookies cannot be disabled without disrupting core platform functionality.
• Functional cookies: These cookies remember your preferences across sessions, such as your preferred language setting (English) and display preferences. They improve your experience but are not strictly required for the platform to operate.
• Analytics cookies: bd35 uses privacy-respecting, first-party analytics to understand aggregate patterns of platform usage — for example, which game categories are most popular, how users navigate between pages, and where technical errors occur. Analytics data is anonymised and is never used to profile individual users for marketing.
• Security cookies: Certain cookies are set to detect and prevent fraudulent login attempts, account takeovers, and other security threats. These operate silently in the background and are not visible to users.

bd35 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. bd35 does not participate in any advertising network that would allow third parties to track your behaviour across other websites based on your visit to bd35.io.

You may control cookie behaviour through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the bd35 platform.

bd35 applies a comprehensive, layered approach to data security. The following technical and organisational measures are in place to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the bd35 platform is encrypted in transit using industry-standard 256-bit SSL/TLS. The bd35.io domain enforces HTTPS on all connections.
• Encrypted data storage: Sensitive data fields — including passwords (stored as salted cryptographic hashes), payment method identifiers, and identity document data — are encrypted at rest using strong symmetric encryption.
• Two-factor authentication (2FA): All bd35 account logins and sensitive account actions require OTP verification to the mobile number registered on your account, providing a second layer of protection against unauthorised access.
• Access controls: Access to personal data within bd35's internal systems is restricted on a strict need-to-know basis. Employee access is governed by role-based access controls, and all access to sensitive data is logged and audited.
• Penetration testing and security audits: The bd35 platform undergoes regular independent security assessments to identify and address potential vulnerabilities before they can be exploited.
• Incident response: bd35 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in harm to affected users, bd35 will notify affected users promptly via email to their registered address.

bd35 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of personal data:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

As a user of the bd35 platform, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address. bd35 will acknowledge your request within 2 business days and aim to fulfil it within 30 calendar days.

• Right of access: You have the right to request a copy of all personal data that bd35 holds about you, together with information about how it is being used, who it has been shared with, and how long it will be retained.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data that bd35 holds about you. Where a correction request relates to identity data, you may be asked to provide documentary evidence of the correct information.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data in circumstances where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that bd35 may be required to retain certain data for a defined period to comply with AML and KYC legal obligations — in such cases, bd35 will inform you of the applicable retention period.
• Right to restriction of processing: You may request that bd35 restrict the processing of your data (i.e., store it but not actively use it) while a correction or erasure request is being assessed, or where you have objected to processing and the basis for processing is being reviewed.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to have it transmitted to another controller where technically feasible.
• Right to object: You have the right to object at any time to the processing of your personal data on the basis of bd35's legitimate interests. bd35 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

The bd35 platform is strictly intended for adults aged 21 years and above. bd35 does not knowingly collect, process, or retain personal data from any person under the age of 21. The registration process requires users to declare their date of birth, and identity verification procedures are used to confirm age eligibility.

If bd35 discovers or is notified that personal data belonging to a person under the age of 21 has been collected, bd35 will immediately close the relevant account and securely delete all associated personal data without undue delay, subject only to any overriding legal obligations to retain records of the account closure.

The bd35 platform integrates with a number of third-party service providers to deliver its full range of features. While bd35 takes care to engage only reputable, security-conscious providers, each third-party service operates under its own terms of service and privacy policy. bd35 is not responsible for the data practices of any third-party provider once data leaves the bd35 environment under the terms described in Section 7.

The primary categories of third-party integration on the bd35 platform are:

• Game content providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi supply the live dealer, RNG casino, slot, and fishing game content available on bd35. Game sessions are delivered via embedded iframes or API integrations. These providers receive only the technical session data required to run their games.
• Payment gateway providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard process payment transactions on behalf of bd35 users. Each of these providers is a regulated financial service and maintains its own data protection standards.
• Cloud infrastructure: The bd35 platform is hosted on cloud infrastructure provided by reputable data centre operators. Server infrastructure is configured to store data in a manner consistent with this privacy policy.

bd35 does not embed third-party social media widgets, advertising pixels, or affiliate tracking scripts that would allow third parties to independently collect data about your visit to bd35.io without your knowledge.

bd35 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the evolution of our platform and services. When material changes are made to this policy, bd35 will:

• Update the "Effective Date" displayed at the top of this page and in the hero section above.
• Notify all registered users by email to their registered email address, providing a summary of the key changes and a link to the updated policy, at least 14 calendar days before the changes take effect.
• Display a prominent notice on the bd35 platform for a period of no less than 14 days following publication of the updated policy.

Your continued use of the bd35 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised policy. If you do not agree with the changes, you should stop using the platform and may request account closure and data deletion in accordance with Section 11 above.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bd35 handles your personal data, please contact our support team using the details below. All privacy-related enquiries are handled by our dedicated data support staff and will receive a response within 2 business days.

Email: [email protected]

Support Hours: 24 hours a day, 7 days a week, including Bangladeshi public holidays. Our support team operates on Bangladesh Standard Time (BST, UTC+6).

Language: All privacy-related communications are handled in English.

When submitting a data rights request (Section 11), please include the following information in your email to help us process your request promptly:

• Your full name as registered on your bd35 account.
• Your bd35 username.
• The email address registered to your bd35 account.
• A clear description of the right you wish to exercise (e.g., access, rectification, erasure).
• Any supporting details that will help us locate the specific data you are enquiring about.