36bd Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") explains how 36bd ("we", "us", "our") collects, uses, stores, shares, and protects personal information provided by or collected from individuals ("you", "Player", "User") who access or use the 36bd platform at https://36bd.io. This Policy forms part of the 36bd Terms & Conditions and should be read alongside that document. By registering a Player Account or using the platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1. About This Privacy Policy

36bd is committed to handling personal data responsibly, transparently, and in accordance with sound data protection principles. This Policy applies to all personal data processed by 36bd in connection with the operation of the platform, including data collected during account registration, identity verification, gameplay, financial transactions, and customer support interactions.

This Policy applies to all Players located in Bangladesh who access the platform. If you have any questions about how your data is handled, you may contact our data team at support [at] 36bd.io at any time.

2. Personal Data We Collect

2.1 Registration and Identity Data

When you create a Player Account with 36bd, we collect the following categories of personal data:

Date of birth is collected to verify that you meet the 21+ age requirement. National ID or passport information is collected only where identity verification ("KYC") is triggered in accordance with our anti-money-laundering obligations.

2.2 Financial Transaction Data

We collect data relating to deposits and withdrawals processed through Supported Payment Methods (bKash, Nagad, Rocket, Upay), including transaction reference numbers, amounts in BDT, timestamps, and the mobile account identifiers associated with each transaction. We do not store full payment credentials such as mobile banking PINs or bank account passwords. All payment data is transmitted directly via the respective payment provider's secure API.

2.3 Gameplay and Activity Data

We collect records of your betting and gaming activity on the platform, including game sessions, bet amounts, win/loss outcomes, bonus claims, and sports betting selections. This data is used for account management, responsible gaming monitoring, fraud detection, and regulatory reporting purposes.

2.4 Technical and Device Data

When you access the 36bd platform, our servers automatically collect certain technical information, including:

• IP address and approximate geographic location derived from it
• Device type, operating system, and browser version
• Session start and end timestamps
• Pages visited and features accessed within the platform
• Referring URL (the website you visited before arriving at 36bd, if applicable)

2.5 Customer Support Communications

When you contact 36bd via live chat or email, we retain records of those communications including the content of messages, attachments shared, timestamps, and the resolution outcome. These records are used to handle your query, improve support quality, and as evidence in the event of a dispute.

3. How We Collect Your Data

36bd collects personal data through the following means:

• Directly from you — via the account registration form, KYC document upload, customer support interactions, and your voluntary provision of information in account settings.
• Automatically — via server logs, session tracking, and cookies or similar technologies when you browse or interact with the platform.
• From payment providers — transaction confirmation data received from bKash, Nagad, Rocket, and Upay in response to deposit and withdrawal instructions you initiate.
• From game providers — gameplay outcome and session data returned by third-party Game Providers (such as Pragmatic Play, Evolution Gaming, Spribe, and Ezugi) when you play their games through the 36bd interface.

4. Lawful Basis for Processing

36bd processes personal data on the following lawful bases:

Processing Purpose	Lawful Basis
Account registration and management	Performance of a contract (the Player Account agreement)
Processing deposits and withdrawals	Performance of a contract
Identity verification (KYC)	Legal obligation (AML compliance)
Fraud detection and prevention	Legitimate interests of 36bd
Responsible gaming monitoring	Legal obligation and legitimate interests
Sending promotional communications	Consent (opt-in only)
Platform analytics and improvement	Legitimate interests of 36bd
Customer support	Performance of a contract

5. How We Use Your Personal Data

36bd uses the personal data we collect for the following specific purposes:

• To create, maintain, and administer your Player Account
• To verify that you meet the minimum age requirement of 21 years
• To process deposits and withdrawal requests through your chosen payment method
• To identify and prevent fraudulent activity, money laundering, and multi-accounting
• To monitor gameplay patterns for signs of problem gambling and to deliver responsible gaming interventions where appropriate
• To communicate with you regarding account status, security alerts, and transaction confirmations
• To send you promotional offers and personalised bonuses, where you have opted in to marketing communications
• To analyse platform usage patterns in aggregate to improve the quality, performance, and user experience of the 36bd service
• To respond to customer support enquiries and resolve complaints
• To comply with applicable legal and regulatory obligations

36bd does not use your personal data for automated individual decision-making that produces significant legal or similarly significant effects on you without human review.

6. Data Sharing and Disclosure

6.1 Service Providers

36bd shares personal data with carefully selected third-party service providers who assist us in operating the platform. These include payment processors (bKash, Nagad, Rocket, Upay), game software providers (Pragmatic Play, Evolution Gaming, Microgaming, Ezugi, Spribe, NetEnt), identity verification services, and cloud hosting infrastructure providers. All service providers are contractually required to process personal data only for the specific purpose for which it was shared and to implement appropriate security measures.

6.2 Legal and Regulatory Disclosure

36bd may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where required to do so by applicable law or valid legal process. In such cases, we will disclose only the minimum data necessary to comply with the legal requirement and will notify the affected Player where legally permissible.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of 36bd or substantially all of its assets, personal data held by 36bd may be transferred to the acquiring entity. Players will be notified of any such transfer via their registered email address prior to their data being subject to a materially different privacy policy.

6.4 No Sale of Data

36bd does not sell, rent, or trade personal data to third parties under any circumstances. This commitment is unconditional and applies regardless of whether a Player's account is active, dormant, or closed.

7. Cookies and Tracking Technologies

36bd uses cookies and similar tracking technologies (such as local storage and session tokens) to operate essential platform functionality, maintain your logged-in session, remember your preferences, and analyse platform usage. The categories of cookies used are as follows:

• Essential cookies: Required for the platform to function. These cannot be disabled without preventing you from using core features such as logging in, accessing your account balance, or placing bets. No consent is required for essential cookies.
• Analytics cookies: Used to collect anonymised data about how Players navigate and interact with the platform. This helps us identify areas for improvement. Analytics cookies are only activated with your consent.
• Preference cookies: Store your interface preferences such as language settings. These are activated with your consent.

You may manage your cookie preferences through your browser settings at any time. Note that disabling essential cookies may impair your ability to use the platform. 36bd does not use third-party advertising cookies or behavioural tracking cookies for the purpose of off-site targeted advertising.

8. Data Security

36bd implements a layered security architecture to protect personal data against unauthorised access, alteration, disclosure, or destruction. Key security measures include:

• Transport encryption: All data transmitted between your device and 36bd servers is encrypted using TLS 1.2 or higher (256-bit SSL), consistent with industry best practice and the standards employed by Bangladesh's major financial institutions.
• Encryption at rest: Sensitive personal data fields stored in our databases — including identity document details and financial information — are encrypted at the storage layer.
• Password security: Player account passwords are hashed using bcrypt with per-user salting. Plain-text passwords are never stored or transmitted by 36bd.
• Access controls: Access to personal data within 36bd's internal systems is restricted on a strict need-to-know basis. Staff with access to Player data are subject to confidentiality obligations and regular security training.
• Infrastructure security: Our platform infrastructure is hosted in data centres with physical access controls, redundant power, and 24/7 monitoring.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights or interests, 36bd will notify affected Players without undue delay via their registered email address.

9. Data Retention

36bd retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or to meet applicable legal retention requirements. The following retention periods apply:

Data Category	Retention Period
Account registration and identity data	Duration of account plus 90 days after verified closure
Financial transaction records	7 years from the date of the transaction (AML compliance)
KYC / identity verification documents	5 years from account closure or last transaction
Gameplay and betting history	3 years from account closure
Customer support communications	2 years from the date of the interaction
Technical / server log data	90 days on a rolling basis
Marketing consent records	Duration of account or until consent is withdrawn

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

10. Your Privacy Rights

As a Player on the 36bd platform, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to support [at] 36bd.io. We will respond within 30 days of receiving a valid request.

• Right of Access: You may request a copy of the personal data 36bd holds about you, along with information about how it is being used.
• Right to Rectification: Where personal data held by 36bd is inaccurate or incomplete, you may request that it be corrected or supplemented.
• Right to Erasure: Subject to our legal retention obligations, you may request deletion of your personal data. Note that financial transaction records must be retained for seven (7) years under applicable compliance requirements and cannot be erased on request within that period.
• Right to Restrict Processing: In certain circumstances, you may request that 36bd restrict the processing of your personal data, for example while a dispute is being investigated.
• Right to Data Portability: You may request a copy of the personal data you have provided to 36bd in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Object: You may object to the processing of your personal data where it is based on our legitimate interests, including profiling for responsible gaming purposes, subject to 36bd demonstrating compelling grounds to continue processing.

11. Children's Privacy

The 36bd platform is strictly for adults aged 21 years and above. We do not knowingly collect, use, or store personal data from individuals under the age of 21. Age verification is conducted during the account registration process and may be supplemented by documentary KYC checks. If 36bd becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately suspended, the data deleted in accordance with our retention policy, and any Real Money Balance returned to the payment method used for deposit after deducting any withdrawals made during the underage usage period. If you are a parent or guardian and believe your child has registered a 36bd account, please contact us immediately at support [at] 36bd.io.

12. Third-Party Links and Services

The 36bd platform may contain references to third-party game providers whose games are embedded within the platform interface. While 36bd takes care to work only with reputable providers, we are not responsible for the privacy practices of third-party game software providers. When you interact with a third-party game engine, data may be transmitted to that provider's servers in accordance with their own privacy policy. We encourage you to review the privacy policies of game providers if you have specific concerns about how gameplay data is handled at their end.

36bd does not include external links to unaffiliated third-party websites on the platform and accepts no responsibility for the privacy or data security practices of any external site you may access independently.

13. Changes to This Privacy Policy

36bd reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. Where changes are material, we will provide notice to Players via the email address registered to their account at least 14 days prior to the changes taking effect. The "Last Updated" date at the top of this document will be revised each time the Policy is amended. Your continued use of the 36bd platform after the effective date of any revision constitutes acceptance of the updated Policy. If you do not agree to the revised Policy, you must close your account before the effective date of the change.

14. Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 36bd, please contact us using the details below. All privacy-related enquiries receive dedicated attention from our data team.

• Email (plain text, not a link): support [at] 36bd.io
• Live Chat: Available 24 hours a day, 7 days a week, from within your Player Account dashboard after logging in.
• Response Time: Privacy-related requests are acknowledged within 48 hours and fully resolved within 30 days of receipt of a valid, verified request.

When submitting a data request by email, please include your registered email address or username so we can locate and verify your account before processing the request. We may ask for additional verification to confirm your identity before disclosing or deleting personal data.