bd989 Privacy Policy — Your Data, Protected

Data We Collect

When you register a bd989 account, interact with the platform, or contact our support team, bd989 collects the following categories of personal data. All data collection is limited to what is necessary for the purposes described in this Privacy Policy.

How We Use Your Data

bd989 processes your personal data for the following specific and lawful purposes. We do not use your data for purposes that are incompatible with those listed here. Where a new purpose arises, we will update this Privacy Policy and notify active account holders before processing begins.

• Account Operation: Your identity, contact, and payment data are used to create and maintain your bd989 account, process your deposits and withdrawals, and communicate essential account information such as transaction confirmations and security alerts.
• Identity Verification (KYC): bd989 is required to verify the identity of all players before processing withdrawals, in accordance with anti-money laundering best practices. Your NID or passport data and selfie photograph are used solely for this verification purpose.
• Fraud Prevention and Security: Technical data (IP address, device fingerprint, session data) is analysed to detect suspicious login activity, prevent account takeover, identify multi-accounting, and flag potentially fraudulent payment behaviour.
• Responsible Gaming Compliance: Usage data (betting history, session length, deposit frequency) is monitored to identify patterns that may indicate problem gambling behaviour, in order to trigger responsible gaming interventions such as deposit limit recommendations or self-exclusion prompts.
• Customer Support: Communications data from live chat and email interactions is retained to provide context for ongoing support cases, resolve disputes, and improve support quality through quality-assurance review.
• Platform Improvement: Aggregated, anonymised usage data is analysed to understand which games, features, and payment methods are most used by bd989 players in Bangladesh, in order to improve the platform experience.
• Marketing Communications (Opt-In Only): If you have explicitly opted in to marketing communications during registration or within your account settings, bd989 may send you promotional emails about bonuses, new games, and seasonal offers (e.g., BPL season promotions, Eid offers). You may withdraw this consent at any time by updating your account preferences or contacting [email protected].
• Legal Compliance: In certain circumstances bd989 may be required to process or disclose personal data to comply with a legal obligation, court order, or directive from a competent authority. In such cases, bd989 will disclose only the minimum data required and will notify the affected account holder where legally permitted to do so.

Data Sharing & Third Parties

bd989 does not sell, rent, or otherwise trade your personal data to third parties for their own commercial use. We share data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

• Payment Processing Partners: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or bank transfer, bd989 shares the transaction reference number and your registered mobile number or bank account name with the relevant payment provider to facilitate the transaction. These partners process your payment data under their own privacy policies and are independently responsible for their data handling practices.
• Game Content Providers: Game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive a session token and anonymised player identifier to load and operate their games within the bd989 platform. These providers do not receive your full name, NID, contact details, or payment information.
• KYC and Identity Verification Services: bd989 may use trusted third-party identity verification technology to assist with document authenticity checks and facial-match verification during the KYC process. Such providers operate under strict data processing agreements and are not permitted to use your identity documents for any purpose other than the specific verification task contracted by bd989.
• Analytics and Platform Security: bd989 uses industry-standard analytics tools and fraud detection systems that process anonymised or pseudonymised technical and usage data to identify security threats and improve platform performance. These tools do not receive data that directly identifies you by name.
• Legal and Regulatory Disclosure: bd989 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities if required to do so by applicable law, a court order, or a formal regulatory request. In all such cases, bd989 will disclose only the data specifically requested and will keep a record of the disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the bd989 business, your personal data may be transferred to the acquiring entity as part of the transaction. bd989 will notify affected account holders via email prior to any such transfer and will ensure that the acquiring entity is bound by equivalent data protection obligations.

Cookies & Tracking Technologies

bd989 uses cookies and similar tracking technologies (including local storage and session storage) to operate the platform, maintain your login session, remember your preferences, and monitor platform security. This section explains what types of cookies we use and how you can control them.

You can manage cookies at the browser level by accessing your browser's privacy or settings menu and selecting cookie preferences. Note that disabling essential or security cookies will prevent the bd989 platform from functioning correctly, and bd989 cannot guarantee account security for sessions where security cookies have been blocked.

The bd989 Android APK uses equivalent local storage mechanisms in place of browser cookies. These serve the same functional purposes described above and are subject to the same data retention limits. The APK does not embed third-party advertising SDKs.

Data Retention & Storage

bd989 retains your personal data for as long as your account is active and for such additional periods as are required to meet our legal, regulatory, and operational obligations. The following retention schedule applies to the main categories of data we hold:

• Account and Identity Data: Retained for the duration of your account plus a minimum of five (5) years following permanent account closure. This retention period reflects standard anti-money laundering record-keeping obligations applicable to online gaming platforms.
• Transaction and Payment Data: All deposit and withdrawal records are retained for a minimum of five (5) years from the date of the transaction, in accordance with financial record-keeping best practices. Individual bKash, Nagad, and Rocket transaction reference numbers are retained for the same period.
• KYC Verification Documents: NID or passport copies and selfie photographs submitted for KYC are retained for five (5) years following account closure. Documents are stored in an encrypted vault with access restricted to bd989 compliance personnel.
• Usage and Gameplay Data: Betting history, session logs, and game records are retained for three (3) years from the date of each session. Anonymised, aggregated usage data (with no personal identifiers) may be retained indefinitely for platform analytics purposes.
• Support Communications: Live chat transcripts and support email threads are retained for two (2) years from the date of the final message in the conversation, and then securely deleted.
• Marketing Consent Records: Records of marketing opt-in and opt-out events are retained for the life of the account plus two (2) years following closure, to demonstrate compliance with consent obligations.

All retained data is stored on servers protected by industry-standard physical and logical access controls. bd989 does not transfer personal data to storage locations outside of its contracted cloud infrastructure without ensuring equivalent data protection standards apply to the receiving location.

Security Measures

Protecting the personal data of bd989 players in Bangladesh is a continuous operational priority. bd989 implements the following technical and organisational security measures to safeguard your information against unauthorised access, accidental loss, destruction, or disclosure:

• Transport Layer Encryption: All data in transit between your device and bd989 servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES cipher suites. The bd989 website and Android APK enforce HTTPS-only connections and will not transmit data over unencrypted HTTP.
• Data at Rest Encryption: Personal data stored in bd989's database infrastructure — including identity documents, payment information, and account details — is encrypted at rest using AES-256 encryption. Database encryption keys are managed by a dedicated key management system with strict access controls.
• Access Controls: Access to production systems containing personal data is restricted to authorised bd989 personnel on a need-to-know basis. All internal access events are logged and reviewed. No support agent or general staff member has unrestricted access to the full personal data of any account holder.
• Two-Factor Authentication (2FA): bd989 strongly recommends that all account holders enable two-factor authentication (2FA) via their account security settings. 2FA adds a one-time passcode (OTP) requirement at login, significantly reducing the risk of unauthorised account access even in the event of credential theft.
• Intrusion Detection and Monitoring: bd989's platform infrastructure is monitored continuously for anomalous activity, intrusion attempts, and abnormal data access patterns. Automated alerts trigger immediate security review when suspicious behaviour is detected.
• Security Incident Response: In the event of a confirmed data breach that affects your personal data, bd989 will notify affected account holders via the email address on file within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the data categories affected, the steps bd989 has taken in response, and any actions you should take to protect your account.
• Staff Training: All bd989 staff who handle personal data undergo data protection and security awareness training. Staff are bound by confidentiality obligations regarding player data and are required to report any suspected data security incident immediately to the bd989 security team.

Your Rights & Choices

As a bd989 account holder, you hold the following rights over your personal data. These rights apply to all players accessing the platform, including players based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and all other locations across Bangladesh. To exercise any of these rights, submit a request to [email protected] with your account username and a description of the right you wish to exercise. bd989 will respond within 14 calendar days.

• Right to Access: You have the right to request a copy of all personal data that bd989 holds about you. bd989 will provide a structured, machine-readable data export within 14 calendar days of receiving a verified access request. The export will cover all data categories described in Section 1 of this Privacy Policy.
• Right to Rectification: If any personal data bd989 holds about you is inaccurate or incomplete — for example, a misspelled name or an outdated mobile number — you have the right to request that we correct it. Corrections to identity data may require re-submission of updated KYC documents.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you believe the data has been processed unlawfully. bd989 will honour erasure requests to the maximum extent permitted by applicable law. Data subject to mandatory retention obligations (see Section 5) cannot be deleted until the relevant retention period expires.
• Right to Data Portability: You may request that bd989 provide your personal data in a portable, machine-readable format (JSON or CSV) that you can transfer to another service provider. This right applies to data that you provided to bd989 directly and that bd989 processes on the basis of your consent or to perform your account contract.
• Right to Restrict Processing: You may request that bd989 temporarily suspend the processing of your personal data — for example, while a rectification request is being resolved, or while you contest the lawfulness of processing. During a restriction period, bd989 may store your data but may not actively process it beyond storage.
• Right to Object: You have the right to object to bd989's processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to processing based on bd989's legitimate interests where you believe your fundamental rights and interests override those legitimate interests.
• Right to Withdraw Consent: Where bd989 processes your data based on your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before the withdrawal.

bd989 will not charge a fee for exercising any of the above rights unless a request is manifestly unfounded, repetitive, or excessive — in which case bd989 reserves the right to charge a reasonable administrative fee or decline the request, with written justification provided.

Policy Updates & Contact

bd989 reviews this Privacy Policy at least annually and updates it whenever there is a material change in how we collect, use, or protect personal data. Material changes may arise from updates to our payment processing partners, new game provider integrations, changes in applicable law, or improvements to our platform security architecture.

When a material change is made to this Privacy Policy, bd989 will notify all active account holders via the email address registered to their account at least 14 days before the updated policy takes effect. The notification will summarise the key changes in plain English and provide a link to the full updated policy. Continued use of the bd989 platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised terms.

If you have any questions, concerns, or complaints about how bd989 handles your personal data — or if you wish to exercise any of the data rights described in Section 7 — please contact the bd989 Data Privacy team using the following channel:

• Email: [email protected] — Please include "Privacy Request" in the subject line along with your registered bd989 username. bd989 aims to acknowledge all privacy-related emails within 48 hours and to resolve them fully within 14 calendar days.
• Live Chat: Log in to your bd989 account and open the live chat widget. Our support team is available 24/7 at Bangladesh Standard Time (UTC+6) and can escalate data privacy requests to the compliance team on your behalf.
• Response Timeline: bd989 is committed to responding to all data access, rectification, erasure, and portability requests within 14 calendar days of receiving a verified request. For complex requests, bd989 may extend this timeline by a further 14 days, in which case you will be notified of the extension and its reason within the original 14-day window.