bde9 Privacy Policy – How We Protect Your Personal Data

1 Introduction and Scope

bde9 is committed to safeguarding the privacy and personal data of every individual who interacts with our platform. This Policy applies to all personal data collected through the bde9 website at bde9.io, the bde9 mobile platform, any associated applications, and all communications between bde9 and its registered players or website visitors.

This Policy covers data collected from players located in Bangladesh, including those accessing bde9 from Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar, as well as players in other jurisdictions where bde9 services are available. Where applicable law in a specific jurisdiction grants additional data protection rights beyond those described in this Policy, bde9 will honour those rights upon verified request.

This Policy is incorporated into and forms part of the bde9 Terms & Conditions. Defined terms used in this Policy and not separately defined herein carry the meanings given to them in the bde9 Terms & Conditions, available at /terms-conditions. Players are encouraged to read both documents together to obtain a complete understanding of their rights and obligations when using the bde9 platform.

2 Personal Data We Collect

bde9 collects personal data in three principal ways: data you provide directly to us during registration and account use, data generated automatically by your use of the platform, and data received from trusted third-party partners. The categories of data we collect are described below.

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, nationality, residential address (street, city, district), email address, and mobile phone number registered with your mobile financial service (bKash, Nagad, Rocket, or Upay).
• Identity verification (KYC) documents: Bangladesh National Identity Card (NID) number and scan, passport, birth certificate, or other government-issued identity document as required to satisfy age and identity verification obligations.
• Financial data: Mobile financial service account numbers (bKash, Nagad, Rocket, Upay), bank account details for partner banks (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and transaction reference numbers submitted in connection with deposits and withdrawals.
• Communications: The content of any messages, emails, or live chat conversations you initiate with bde9 support, including your contact preferences and support history.
• Responsible gaming data: Deposit limits, session time limits, self-exclusion requests, cooling-off periods, and any other responsible gaming preferences you configure on your account.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage and behavioural data: Pages visited, features used, games played (including game provider, game title, stake amounts, and session duration), betting and wagering history, login timestamps, and session activity logs.
• Geolocation data: General geographic location derived from your IP address, used to verify that you are accessing bde9 from a permitted jurisdiction. bde9 does not collect precise GPS-level location data without your explicit consent.
• Cookies and tracking data: Data collected through cookies, pixel tags, and similar technologies as described in Section 6 of this Policy.

2.3 Data Received from Third Parties

• Payment providers: Transaction confirmation data, payment status updates, and fraud screening flags received from bKash, Nagad, Rocket, Upay, and bank partners.
• Identity verification services: Verification status outcomes (pass/fail/refer) received from KYC service providers used by bde9 to validate identity documents.
• Fraud and risk management partners: Risk scores, device fingerprint data, and behavioural analytics from third-party fraud prevention systems used to protect the integrity of the bde9 platform.

3 How We Use Your Personal Data

bde9 uses the personal data we collect for the following purposes. Each use is linked to a legal basis described in Section 4 of this Policy.

bde9 does not use your personal data to make fully automated decisions that produce significant legal effects on you without human review. Where automated systems flag an account for fraud, bonus abuse, or responsible gaming intervention, a member of the bde9 compliance or support team reviews the flag before any material action is taken against the account.

4 Legal Basis for Processing

bde9 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform our contractual obligations to you under the bde9 Terms & Conditions, including account management, payment processing, and service delivery.
• Legal obligation: Processing that bde9 is required to carry out to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC identity verification requirements, and responses to lawful orders from courts or regulatory authorities.
• Legitimate interests: Processing carried out for purposes that serve bde9's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud prevention, platform security, responsible gaming monitoring, and platform performance analytics.
• Consent: Processing carried out on the basis of your freely given, specific, informed consent. This applies primarily to the sending of promotional and marketing communications. You may withdraw consent for marketing communications at any time by contacting bde9 support at [email protected] or by updating your communication preferences in your account settings. Withdrawal of marketing consent does not affect any other aspect of your account.

Where bde9 relies on legitimate interests as a legal basis for processing, we carry out a balancing assessment to ensure that our interests do not disproportionately override your rights. Records of these assessments are maintained internally. You may request further information about any specific legitimate interests assessment by contacting [email protected].

5 Data Sharing and Disclosure

bde9 shares personal data with third parties only in the limited circumstances described below, and only to the extent necessary for the specific purpose stated:

• Payment processing partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the transaction data necessary to process your deposits and withdrawals. These partners are bound by their own data protection obligations and are not authorised to use your data for any purpose beyond payment processing.
• Identity verification providers: KYC service providers receive copies of identity documents and verification data necessary to complete age and identity verification. These providers operate under strict data processing agreements with bde9.
• Game providers and studios: Game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive session-level data necessary to deliver their games on the bde9 platform. Personal identification data is not shared with game providers beyond what is required for session management.
• Fraud prevention and risk management services: Third-party providers who assist bde9 in detecting and preventing fraudulent activity receive device and behavioural data as described in Section 2. These providers act as data processors under bde9's instructions.
• Legal and regulatory authorities: bde9 will disclose personal data to courts, law enforcement agencies, financial intelligence units, or other regulatory authorities where required to do so by applicable law, court order, or lawful investigative demand. bde9 will notify you of such disclosures where permitted by law.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of bde9's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer where practicable, and the acquiring entity will be required to honour this Privacy Policy.

All third parties with whom bde9 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only in accordance with bde9's instructions and applicable data protection requirements.

6 Cookies and Tracking Technologies

bde9 uses cookies and similar tracking technologies on the bde9.io website and mobile platform to operate core platform functions, improve user experience, and support analytics and security systems. The categories of cookies used by bde9 are described below.

• Strictly necessary cookies: These cookies are essential for the bde9 platform to function. They enable core features such as account login sessions, security token validation, and session state management. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional cookies: These cookies remember your preferences and settings, such as your chosen display language, notification preferences, and responsible gaming configuration, so you do not need to re-enter them each session.
• Analytics cookies: bde9 uses internal analytics tools to collect aggregated, anonymised data about how players navigate and use the platform. This data helps bde9 identify performance issues, improve page layouts, and develop new features. Individual players are not identified from analytics data.
• Security and fraud detection cookies: These cookies assist bde9's security systems in identifying unusual device behaviour, detecting bot activity, and flagging suspicious login patterns. They are essential to maintaining platform integrity.

bde9 does not use third-party advertising cookies or cross-site tracking cookies to serve targeted advertisements on external websites. Any data collected via cookies on the bde9 platform remains within the bde9 ecosystem and is not shared with advertising networks.

7 Data Security

bde9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and bde9's servers;
• AES-256 encryption at rest for all sensitive personal data and KYC documents stored on bde9's servers;
• Role-based access controls ensuring that only authorised bde9 personnel with a legitimate business need can access personal data, and only to the extent required for their specific role;
• Multi-factor authentication required for all internal bde9 staff access to systems containing personal data;
• Regular security audits and penetration testing conducted by independent third-party security specialists to identify and address vulnerabilities in bde9's systems;
• Intrusion detection and monitoring systems that continuously monitor bde9's infrastructure for anomalous activity and trigger alerts for human review;
• Data backup and disaster recovery procedures to ensure business continuity and data integrity in the event of a system failure or security incident.

In the event of a personal data breach that poses a risk to your rights and freedoms, bde9 will notify affected players without undue delay, providing details of the nature of the breach, the data categories affected, the likely consequences, and the steps bde9 is taking to address the breach and mitigate its impact. Where required by applicable law, bde9 will also notify the relevant supervisory authority.

While bde9 employs industry-standard security practices, no digital system can guarantee absolute security. Players are reminded to use strong, unique passwords for their bde9 accounts, to enable SMS OTP two-factor authentication where available, and to notify bde9 support immediately if they suspect that their account credentials have been compromised.

8 Data Retention

bde9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory retention obligations, and to resolve any disputes or enforce our agreements. The principal retention periods applied by bde9 are as follows:

Upon expiry of the applicable retention period, bde9 will securely delete or anonymise your personal data in accordance with industry-standard data destruction procedures. Data that has been anonymised beyond the possibility of re-identification may be retained indefinitely for statistical and research purposes without further notice.

9 Your Data Protection Rights

As a bde9 player, you hold the following rights in respect of your personal data. bde9 will respond to all verified data rights requests within 30 calendar days of receipt, or such shorter period as may be required by applicable law. All requests must be submitted to [email protected] with sufficient identification information to allow bde9 to verify your identity before processing the request.

• Right of access: You have the right to request a copy of the personal data bde9 holds about you, together with information about how it is being used. bde9 will provide this information in a structured, commonly used format.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data bde9 holds about you. You may also update certain data categories directly through your account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the data has been unlawfully processed. This right is subject to bde9's legal retention obligations — we are required by law to retain certain categories of data for defined periods regardless of erasure requests.
• Right to restriction of processing: You may request that bde9 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over erasure.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, machine-readable format and to request that it be transmitted to another service provider where technically feasible.
• Right to withdraw consent: Where processing is based on your consent (principally marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests where you believe your individual rights and freedoms override bde9's interests. bde9 will review all objections and cease the relevant processing unless bde9 can demonstrate compelling legitimate grounds that override your interests.

10 Children and Minors

bde9 employs automated age verification checks during the registration process and may request documentary proof of age at any point. Any account found to belong to a person under 21 years of age will be immediately and permanently suspended. All data associated with such an account will be deleted as soon as practicable, except where bde9 is required to retain certain records for legal or fraud investigation purposes.

If a parent or guardian believes that their child under 21 has registered an account with bde9 or has provided personal data to bde9 without authorisation, they should contact bde9 support immediately at [email protected]. bde9 will investigate promptly and take all appropriate action, including deletion of the account and associated data.

bde9 supports the use of third-party parental control and content filtering software to restrict access to online gambling platforms. Parents and guardians in Bangladesh who wish to prevent minors from accessing gambling content are encouraged to explore filtering tools available through their internet service provider or device manufacturer.

11 Amendments to This Privacy Policy

bde9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or operational requirements. All amendments will be published on this page with an updated effective date.

Where an amendment is material — meaning it significantly changes how bde9 collects, uses, or shares your personal data — bde9 will provide advance notice to registered players via a prominent notice on the bde9 platform and, where practicable, via a notification to your registered email address or mobile number. Material amendments will take effect no sooner than 14 days after notice is provided, unless an earlier effective date is required by law.

Non-material amendments (such as clarifications of existing language, corrections of typographical errors, or updates to contact information) may take effect immediately upon publication without advance notice. bde9 recommends that players review this Privacy Policy periodically to remain informed of how their data is handled.

Your continued use of the bde9 platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to an amended Policy, you should cease using the bde9 platform and contact [email protected] to request account closure and the return of any real-money balance subject to verification.

12 Contact Information and Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or bde9's handling of your personal data, please contact the bde9 Data Protection team using the contact details below:

• Email: [email protected]
• Subject line: "Privacy Policy Enquiry" or "Data Protection Request"
• Response time: bde9 aims to respond to all privacy-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6).

If you believe that bde9 has not handled your personal data in accordance with this Privacy Policy or applicable data protection law, you have the right to lodge a complaint. bde9 encourages players to contact us directly in the first instance so that we have the opportunity to address your concern promptly and to your satisfaction. If bde9 is unable to resolve your complaint to your satisfaction, you may escalate your complaint to the relevant data protection or consumer protection authority in your jurisdiction.

bde9 takes all privacy complaints seriously. Every complaint is logged, investigated by a designated member of the bde9 compliance team, and responded to in writing. Where a complaint reveals a systemic issue with bde9's data handling practices, bde9 will take corrective action and, where appropriate, notify affected players.