28bd9 Privacy Policy

1.1 Registration Data. When you create a 28bd9 account, we collect your full legal name, date of birth, residential address, email address, and mobile phone number. This information is required to verify your identity, enforce our 21+ age policy, and comply with our anti-money laundering obligations.

1.2 Identity Verification Documents. To comply with Know Your Customer (KYC) requirements, 28bd9 may request copies of government-issued identification documents, including your National Identity Document (NID), passport, or driver's licence. We may also request proof of address (e.g., a utility bill or bank statement dated within the last three months) and proof of payment method ownership.

1.3 Financial Data. We collect records of all deposits, withdrawals, bonus claims, and betting or gaming transactions conducted through your 28bd9 account. We record payment method identifiers (such as your bKash or Nagad mobile number, or the first six and last four digits of a card) but we do not store full card numbers or mobile banking PINs.

1.4 Technical and Device Data. When you access the 28bd9 platform, we automatically collect your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and session timestamps. This data is used to maintain platform security, detect fraudulent access, and improve the user experience.

1.5 Behavioural and Usage Data. We collect data on how you interact with the 28bd9 platform, including pages visited, games played, markets wagered on, time spent per session, search queries within the platform, and click-path data. This data is used for platform improvement, personalised game recommendations, and responsible gaming monitoring.

1.6 Communications Data. If you contact 28bd9 customer support by email, live chat, or other channel, we retain records of those communications including your messages, any attachments submitted, and our responses. This data is used to manage your support requests and to improve the quality of our customer service.

1.7 Responsible Gaming Data. If you use any of the responsible gaming tools on 28bd9 — including deposit limits, session reminders, cooling-off periods, or self-exclusion — we record your settings and the history of changes to those settings. This data is retained for as long as necessary to enforce your chosen restrictions and to comply with responsible gaming obligations.

2.1 Directly from You. The majority of personal data we hold is provided directly by you during account registration, identity verification, payment transactions, completion of responsible gaming forms, or communications with our customer support team.

2.2 Automatically via Platform Technology. When you browse or use the 28bd9 platform, technical data is collected automatically through web server logs, cookies, pixel tags, and similar tracking technologies. This collection occurs each time you load a page, place a bet, or interact with a game.

2.3 From Third-Party Service Providers. 28bd9 works with trusted third-party vendors who may provide additional data points to support identity verification, fraud detection, and payment processing. For example, our KYC verification partner may cross-reference the identity documents you submit against authoritative data sources. Our payment processors provide transaction confirmation and status data back to 28bd9.

2.4 From Game Studio Providers. Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may return session-level technical data (such as game round IDs and round outcomes) to 28bd9 for account crediting, dispute resolution, and auditing purposes. These providers do not receive your full personal profile from 28bd9.

28bd9 uses the personal data we collect for the following purposes:

• Account Management: Creating, maintaining, and managing your 28bd9 account, including authenticating your identity at login and processing account updates you request.
• Identity Verification and KYC: Verifying your identity and age in compliance with our 21+ policy and applicable anti-money laundering (AML) and Know Your Customer (KYC) standards prior to processing withdrawals.
• Payment Processing: Processing your deposits via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and processing withdrawal requests to your registered payment method.
• Fraud and Security Monitoring: Detecting, investigating, and preventing fraudulent transactions, unauthorised account access, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming Compliance: Monitoring your gambling activity to identify patterns that may indicate problem gambling; enforcing the limits, cooling-off periods, and self-exclusion settings you activate on your account.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and providing assistance via email and live chat.
• Platform Improvement: Analysing aggregated usage data to improve the design, functionality, game selection, and performance of the 28bd9 platform.
• Personalisation: Using your game play history and preferences to surface relevant game recommendations and promotions within the 28bd9 platform. We do not engage in automated personalisation that produces legal or similarly significant effects without human review.
• Marketing Communications: Sending you promotional emails, bonus offers, and platform news where you have opted in to receive marketing communications. You may opt out at any time by contacting [email protected] or following the unsubscribe link in any marketing email.
• Legal and Regulatory Obligations: Fulfilling record-keeping, reporting, and disclosure obligations required by the terms of our offshore international gaming licence and applicable financial crime prevention standards.

4.1 Contractual Necessity. Processing of your registration data, financial transaction records, and account activity data is necessary for the performance of the contract between you and 28bd9 (i.e., the provision of the betting and casino platform services described in our Terms & Conditions). Without this processing, we cannot create or maintain your account or provide the services you have requested.

4.2 Legal Obligation. Processing of identity verification documents, AML-related transaction monitoring data, and responsible gaming records is required for 28bd9 to comply with applicable legal and regulatory obligations imposed by our gaming licence and associated compliance frameworks.

4.3 Legitimate Interests. Processing of technical and device data for fraud prevention, platform security, and abuse detection is carried out on the basis of 28bd9's legitimate interests in protecting the integrity and security of the platform and its users. We have assessed that this processing does not override your fundamental privacy rights.

4.4 Consent. Processing of your data for direct marketing communications is conducted on the basis of your explicit opt-in consent. You may withdraw consent for marketing communications at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5.1 28bd9 does not sell, rent, or trade your personal data to unaffiliated third parties for their own commercial or marketing purposes. We share personal data only in the circumstances described in this section.

5.2 Service Providers and Data Processors. We share personal data with trusted third-party service providers who process data strictly on our behalf and subject to written data processing agreements. These providers include:

• KYC and identity verification vendors who verify the documents you submit against authoritative reference data sources.
• Payment processing partners (including the operators of bKash, Nagad, Rocket, Upay, Visa, and Mastercard merchant services) who process your deposit and withdrawal transactions.
• Cloud hosting and infrastructure providers who store platform data on secured servers.
• Fraud detection and risk management technology providers.
• Customer support platform providers through whom live chat and email ticket data is routed.
• Game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others) for game session resolution and auditing purposes, limited to the data technically necessary for these functions.

5.3 Legal and Regulatory Disclosure. 28bd9 may disclose personal data to law enforcement authorities, regulators, or other government bodies where required to do so by applicable law, court order, or regulatory direction. 28bd9 will notify you of such disclosure where legally permitted to do so.

5.4 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or substantially all of 28bd9's assets, your personal data may be transferred to the acquiring or successor entity. You will be notified in advance of any such transfer via the email address registered on your account, and you will retain the right to request deletion of your data before the transfer is completed.

5.5 Aggregate and Anonymised Data. 28bd9 may share aggregated, anonymised, or pseudonymised data (from which individual identities cannot reasonably be re-identified) with analytics partners, game studios, or industry bodies for statistical and research purposes. Such sharing does not constitute disclosure of personal data.

6.1 28bd9 retains your personal data for as long as your account remains active and for a defined period following account closure, as set out below:

6.2 On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where full deletion is not technically possible for specific data stored in backup systems, 28bd9 will ensure that such data is isolated from active processing and scheduled for deletion at the next practicable backup rotation cycle.

7.1 28bd9 applies a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 28bd9 platform is encrypted in transit using 256-bit SSL/TLS protocols. Look for the padlock icon in your browser's address bar when using 28bd9.io.
• Password Hashing: Account passwords are stored using industry-standard one-way cryptographic hashing algorithms. Plain-text passwords are never stored or accessible to any 28bd9 personnel.
• Access Controls: Access to systems containing personal data is restricted to authorised 28bd9 personnel on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Intrusion Detection: 28bd9's infrastructure is monitored around the clock by automated intrusion detection systems that flag anomalous access patterns for immediate review.
• Secure Data Centres: Personal data is stored on servers located in secured data centres with physical access controls, environmental monitoring, and redundant power and connectivity.
• Regular Security Assessments: 28bd9 conducts periodic security assessments and vulnerability reviews of the platform to identify and remediate potential weaknesses before they can be exploited.

7.2 While 28bd9 employs robust technical and organisational security measures, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your own login credentials and for notifying 28bd9 at [email protected] immediately if you suspect any unauthorised access to your account.

8.1 28bd9 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files placed on your device by your browser when you visit 28bd9.io. They allow the platform to recognise your device across sessions, maintain your login state, and remember your preferences.

8.2 28bd9 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in during a session and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences and settings, such as preferred language, currency display, and responsible gaming notification settings. Disabling these cookies may reduce your platform experience but will not prevent access.
• Analytics Cookies: Used to collect aggregated, anonymised data on how users navigate and use the platform — including which pages are visited most, how long sessions last, and which games are played most frequently. This data informs platform improvements and does not identify you personally.
• Security and Fraud Detection Cookies: Used to detect unusual or potentially fraudulent access patterns, including session replay tokens and device fingerprinting identifiers. These cookies support the integrity of the platform and protection of all users.

8.3 You can manage your cookie preferences through your browser settings. Note that blocking strictly necessary cookies will prevent you from logging in and using the 28bd9 platform. Blocking other categories of cookies may affect certain features but will not prevent basic access. 28bd9 does not use third-party advertising or behavioural targeting cookies.

9.1 Subject to applicable law and the limitations described in this Policy, you have the following rights in relation to your personal data held by 28bd9:

• Right of Access: You may request a copy of the personal data 28bd9 holds about you. We will provide this within 30 days of receiving a verifiable request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it. You can update basic account details (email address, phone number, address) directly from your account dashboard.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and there is no overriding legitimate interest. Note that we are required to retain certain categories of data (particularly financial transaction records and KYC documents) for regulatory compliance periods regardless of an erasure request.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, such as while a dispute about its accuracy is under investigation.
• Right to Data Portability: For data processed on the basis of consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to 28bd9's right to demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

9.2 To exercise any of the rights listed above, contact 28bd9 at [email protected] with your full name, registered email address, and a clear description of the right you wish to exercise. We may require additional identity verification before processing your request to protect against unauthorised data access.

9.3 28bd9 will respond to all valid data rights requests within 30 calendar days. Where a request is complex or we have received a high volume of requests, we may extend this period by a further 30 days with written notice to you explaining the reason for the extension.

10.1 The 28bd9 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age is verified at the point of registration and confirmed via government-issued identity documentation (NID or equivalent) prior to processing the first withdrawal from any account.

10.2 If 28bd9 becomes aware — through our own verification processes, a report from a third party, or a parental notification — that an account is held by a person under the age of 21, we will take the following immediate actions: suspend the account, void all betting and gaming activity conducted on the account, forfeiture any remaining balance, and permanently close the account. Any personal data collected in connection with the underage account will be deleted following the resolution of any associated compliance investigation.

10.3 If you are the parent or guardian of a minor and you believe they may have registered a 28bd9 account, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

11.1 As an internationally operated platform with an offshore gaming licence, 28bd9 may transfer your personal data to, and process it in, jurisdictions outside Bangladesh. These may include the jurisdiction of our data centre provider, our KYC verification partner, or our game studio providers.

11.2 When personal data is transferred outside Bangladesh, 28bd9 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Privacy Policy. Such safeguards include contractual data processing agreements with the receiving entity that impose obligations consistent with recognised international data protection standards.

11.3 By registering a 28bd9 account and accepting this Privacy Policy, you consent to the transfer of your personal data to the jurisdictions referenced in clauses 11.1 and 11.2, subject to the safeguards described. If you do not consent to such transfers, you should not register or continue to use the 28bd9 platform.

12.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which 28bd9 handles your personal data, please contact our support team at [email protected]. We aim to respond to all privacy-related enquiries within five (5) business days (Bangladesh Standard Time, UTC+6).

12.2 If you are not satisfied with our response to your privacy concern, you have the right to escalate the matter through the formal dispute resolution process described in the 28bd9 Terms & Conditions. Formal complaints will receive a substantive written response within fifteen (15) business days.

12.3 28bd9 is committed to resolving all legitimate privacy concerns fairly and transparently. We treat all privacy complaints seriously and will conduct an internal review of each complaint received, documenting the findings and any corrective action taken.