kbdd Privacy Policy — Your Data, Your Rights

This Privacy Policy applies to all personal data collected and processed by kbdd in connection with the kbdd platform available at kbdd.io. It covers every interaction you have with kbdd — from visiting the website without an account, through the account registration process, to ongoing use of the casino, sportsbook, payment facilities, and customer support services.

kbdd is committed to handling personal data responsibly, transparently and in accordance with applicable data protection principles. This Privacy Policy is intended to give you a clear and complete picture of how your data is used so that you can make informed decisions about your use of the kbdd platform.

kbdd reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered players by email or by a prominent notice on the kbdd website. The effective date at the top of this document will be updated whenever a new version is published. It is your responsibility to review this Privacy Policy periodically.

This Privacy Policy applies only to the kbdd platform. It does not apply to any third-party websites, applications or services that may be linked from the kbdd website. kbdd is not responsible for the privacy practices of any third-party provider whose content is accessible through the kbdd platform.

kbdd collects personal data from you directly (when you provide it during registration or use of the platform) and automatically (through your interaction with the kbdd website and applications). The categories of data kbdd collects are described below.

Registration and identity data collected when you open a kbdd account includes:

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify the 21+ age requirement).
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar).
• Mobile phone number registered in Bangladesh.
• Email address.
• Username and hashed (never plain-text) password.

KYC verification data collected when you submit identity documents includes:

• Scanned copies or photographs of government-issued identity documents (National Identity Card, passport, or driving licence).
• Proof of address documents (utility bill, bank statement, or equivalent).
• Selfie or facial image where required for liveness verification.

Payment and financial data collected in connection with deposits and withdrawals includes:

• Mobile wallet identifiers (bKash number, Nagad number, Rocket number, Upay number).
• Partial card numbers (last four digits only; full card numbers are processed by PCI-DSS compliant payment processors and never stored by kbdd).
• Transaction history including deposit amounts, withdrawal requests, and payment timestamps, all denominated in BDT.
• Source-of-funds documentation where requested as part of an AML review.

Usage and technical data collected automatically when you use the kbdd platform includes:

• IP address and approximate geographic location derived from IP.
• Device type, operating system, browser type and version.
• Session timestamps, pages visited, features used, and clickstream data.
• Game history including games played, bet amounts, and outcomes.
• Cookie data and similar tracking technologies (see Section 8 for full details).

kbdd uses the personal data it collects for the following purposes, each of which has a clear legal basis:

kbdd will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or unless required to do so by applicable law.

kbdd does not sell, rent, or trade your personal data to any third party. kbdd shares personal data with external parties only in the following limited and controlled circumstances:

• Payment processors — bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the payment data necessary to process your deposits and withdrawals. Each of these providers operates its own privacy practices and security standards.
• Identity verification providers — third-party KYC and AML service providers receive identity document data and transaction data as required to verify your identity and comply with applicable anti-money laundering obligations.
• Fraud prevention agencies — kbdd may share data with fraud prevention and security services where there is a legitimate need to detect, prevent, or investigate fraudulent activity.
• Game content providers — providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data necessary to deliver and certify game content. These providers do not receive directly identifying personal data such as your name or address.
• Legal and regulatory authorities — kbdd will disclose personal data to law enforcement, regulatory bodies, or other authorities where required by applicable law, court order, or a lawful request. kbdd will notify you of such a disclosure where legally permitted to do so.
• Business transfers — in the event of a merger, acquisition, or transfer of kbdd's business assets, personal data held by kbdd may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to the privacy terms that applies to your data.

All third-party service providers that receive personal data from kbdd are required to process that data only for the purposes for which it was shared, to apply appropriate technical and organisational security measures, and to comply with data protection obligations equivalent to those applied by kbdd.

kbdd retains personal data for as long as necessary to fulfil the purpose for which it was collected and for as long as required by applicable legal and regulatory obligations. The retention periods set out below are kbdd's standard schedules under normal operating conditions:

When the applicable retention period expires and no further legal basis for retention exists, kbdd will securely delete or anonymise the relevant data. Anonymised data — from which all directly and indirectly identifying information has been removed — may be retained for longer periods for aggregate analytics and platform improvement purposes.

kbdd applies a layered set of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include but are not limited to:

• Encryption in transit — all data transmitted between your device and the kbdd platform is protected by TLS 1.2 or higher (256-bit SSL encryption). This applies on all connection types, including mobile data connections on Grameenphone, Robi, Banglalink, Teletalk and Airtel Bangladesh networks.
• Encryption at rest — all personal data stored in kbdd's databases is encrypted using AES-256 encryption. Encryption keys are managed separately from the data they protect.
• Access controls — access to systems containing personal data is restricted to authorised personnel on a strict need-to-know basis. All administrative access requires multi-factor authentication.
• New-device verification — when your kbdd account is accessed from a new or unrecognised device, an SMS-based one-time password (OTP) is sent to your registered mobile number before access is granted.
• Brute-force protection — repeated failed login attempts to your kbdd account trigger an automatic account lock and an alert to your registered contact details.
• Penetration testing — kbdd conducts regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident response — kbdd maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, kbdd will notify you without undue delay and will take immediate steps to contain and remediate the incident.

As a kbdd account holder, you have the following rights with respect to your personal data. To exercise any of these rights, contact kbdd's data team at [email protected] with the subject line "Data Rights Request". kbdd will respond to all valid requests within 30 days.

• Right of access — you may request a copy of all personal data that kbdd holds about you. kbdd will provide this in a structured, commonly used, machine-readable format where technically feasible.
• Right to rectification — if any personal data kbdd holds about you is inaccurate or incomplete, you may request that it be corrected. You may also update certain details (such as your contact number or email address) directly from within your account dashboard after kbdd Login.
• Right to erasure — you may request that kbdd delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to kbdd's legal retention obligations — data that must be retained under applicable AML or financial regulations cannot be deleted until the applicable retention period has expired.
• Right to restriction of processing — you may request that kbdd restrict the processing of your data in certain circumstances, for example while the accuracy of data is being contested.
• Right to data portability — you may request that kbdd transfer your personal data to another service provider in a structured, machine-readable format, where technically feasible and where the processing is based on consent or contractual necessity.
• Right to withdraw consent — where kbdd processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to object — you may object to kbdd processing your personal data on the basis of legitimate interest. kbdd will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.

kbdd uses cookies and similar tracking technologies on the kbdd website to provide a functioning, personalised, and secure experience. A cookie is a small text file placed on your device by a website you visit. kbdd uses the following categories of cookies:

• Strictly necessary cookies — these cookies are essential for the kbdd platform to function. They enable core features such as account login sessions, payment process continuity, and security verification steps. These cookies cannot be disabled without breaking the kbdd platform.
• Functional cookies — these cookies remember your preferences (such as your preferred language, display settings, and last-used payment method) to provide a more personalised experience on return visits.
• Analytics cookies — kbdd uses analytics cookies to understand how players interact with the kbdd website, which pages are most visited, and where users encounter difficulties. This data is collected in aggregate and anonymised form and is used solely to improve the kbdd platform.
• Security cookies — these cookies help kbdd detect and prevent fraudulent activity, bot traffic, and brute-force login attempts. They are strictly necessary for the protection of your account and the integrity of the kbdd platform.

kbdd does not use third-party advertising cookies or tracking pixels that share your data with advertisers. The kbdd platform does not serve third-party advertising.

The kbdd platform is strictly intended for adults aged 21 years and above. kbdd does not knowingly collect personal data from persons under the age of 21. Age verification is performed at the point of registration and again before the first withdrawal is processed on every kbdd account.

If kbdd identifies or is notified that personal data belonging to a person under the age of 21 has been collected, that account will be immediately suspended, all associated personal data will be securely deleted in line with kbdd's data retention procedures, and any funds held in the account will be reviewed in accordance with kbdd's underage gambling response procedure.

kbdd's primary operations and data storage infrastructure are designed to serve players in Bangladesh. In certain circumstances, personal data may be processed or accessed by service providers operating outside Bangladesh — for example, identity verification providers or game content certification bodies operating in other countries.

Where personal data is transferred outside Bangladesh, kbdd ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within kbdd's own systems. These safeguards include contractual data protection clauses with all international service providers, requiring them to apply security measures and data handling practices consistent with the principles set out in this Privacy Policy.

kbdd does not transfer personal data to countries or territories that do not provide an adequate level of data protection without first implementing appropriate contractual or technical safeguards. If you have questions about international transfers of your personal data, contact kbdd at [email protected].

kbdd uses certain personal data — specifically game history, session duration, deposit frequency, and betting pattern data — for responsible gaming monitoring purposes. This data is analysed to identify indicators of potentially harmful gambling behaviour so that kbdd can proactively reach out to players who may benefit from responsible gaming support tools.

Responsible gaming data processing is carried out on the basis of kbdd's legitimate interest in promoting safe gambling and its obligation to maintain a safe platform. This data is not shared with third parties for commercial purposes and is handled with the highest degree of sensitivity within kbdd's internal systems.

kbdd reviews this Privacy Policy on a regular basis and reserves the right to update it at any time. When a material change is made — for example, a change to the categories of data collected, a new sharing arrangement with a third party, or a change in retention periods — kbdd will notify registered players by email at least 14 days before the change takes effect.

Minor clarifications or corrections that do not materially affect the substance of this Privacy Policy may be made without advance notice. The effective date shown at the top of this document will always reflect when the current version was last updated.

Continued use of the kbdd platform after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. If you do not agree with any changes to this Privacy Policy, you should discontinue use of the kbdd platform and contact [email protected] to request account closure.

For all privacy-related enquiries, data rights requests, or concerns about how kbdd handles your personal data, please contact kbdd's support team using the details below. All privacy correspondence is handled by kbdd's designated data protection team and treated with strict confidentiality.

kbdd's support team is available 24 hours a day, 7 days a week, operating on Bangladesh Standard Time (BST, UTC+6). Players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar can expect responses in English from a team familiar with the local context and payment ecosystem.

If you are not satisfied with kbdd's response to a data rights request or privacy concern, you have the right to escalate the matter to the relevant data protection authority. kbdd will cooperate fully with any such authority investigation.