bd989 Privacy Policy — How We Protect Your Personal Data

1. Introduction

This Privacy Policy ("Policy") explains how bd989 ("bd989", "we", "us", "our") collects, processes, stores, and protects personal data in connection with the operation of the online gaming and sports betting platform accessible at bd989.io ("Platform"). This Policy applies to all users who register an account, access the Platform as a guest, interact with our customer support team, or otherwise provide personal data to bd989 through any channel.

bd989 is committed to handling all personal data with integrity, transparency, and in a manner consistent with internationally recognised data protection principles. We apply a strict data minimisation approach, collect only what is necessary, and give every account holder meaningful control over their own information.

By registering an account on bd989 or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and contact us at [email protected] to request account closure.

2. Data Controller

For the purposes of this Privacy Policy, bd989 acts as the data controller — the entity that determines the purposes and means of processing your personal data. All data-related queries, access requests, correction requests, deletion requests, and complaints should be directed to our support team at [email protected] with the subject line "Privacy Request".

bd989 operates the Platform primarily for adult users based in Bangladesh. While the Platform may be technically accessible from other locations, it is designed and marketed exclusively for the Bangladeshi market, and all data processing described in this Policy is conducted in accordance with that context.

3. Data We Collect

bd989 collects the following categories of personal data, each tied to a specific and documented purpose:

3.1 Registration & Identity Data

• Full legal name (as it appears on government-issued identification)
• Date of birth (to verify you meet the 21+ age requirement)
• Residential address (city, district, and postal code)
• Bangladeshi mobile phone number (for account verification and communication)
• Email address (for transactional notifications and support communications)
• Username and encrypted password (for account authentication)

3.2 Identity Verification (KYC) Documents

• National Identity Card (NID) number and scanned copy
• Passport (where NID is unavailable)
• Birth certificate (as supplementary age-verification document where required)
• Proof of residential address (utility bill, bank statement, or equivalent dated within 90 days)
• Selfie photograph (for liveness verification in certain high-value withdrawal scenarios)

3.3 Financial Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers used for deposits and withdrawals
• Bank account details (account number, branch name) where bank transfer is the chosen payment method
• Visa / Mastercard details (card number masked to last 4 digits after initial processing — full card data is handled exclusively by our PCI-DSS compliant payment processor and is never stored on bd989 servers)
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used

3.4 Gaming & Betting Activity Data

• Game sessions played, wager amounts, game results, and cumulative win/loss records
• Sports betting markets selected, odds accepted, stake amounts, and settlement outcomes
• Bonus and promotion redemption history
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status)

3.5 Technical & Device Data

• IP address at time of registration and at each login
• Device type, operating system version, and browser type
• Session timestamps (login time, logout time, session duration)
• Pages and game titles accessed during each session
• Error logs and crash reports (used exclusively for platform stability improvements)

3.6 Communications Data

• Content of support tickets, live chat transcripts, and email correspondence with the bd989 team
• Feedback and dispute submissions
• Promotional opt-in preferences (SMS, email notifications)

4. How Data Is Collected

bd989 collects personal data through the following channels:

• Account Registration: You provide identity, contact, and date-of-birth data directly when creating your bd989 account through the registration form on the Platform.
• KYC Verification: You upload identity and address documents directly through the secure KYC portal within your account dashboard when prompted to complete verification.
• Deposits & Withdrawals: Financial data is collected automatically when you initiate a deposit or withdrawal transaction through the payment section of the Platform.
• Platform Usage: Technical and device data, gaming activity data, and session data are collected automatically by bd989's servers as you interact with the Platform.
• Customer Support: Communications data is collected when you contact our support team via live chat, email, or any other support channel.
• Cookies & Tracking Technologies: Certain technical data is collected passively via cookies and similar technologies as described in Section 8 of this Policy.

5. How We Use Your Data

bd989 uses your personal data for the following specific purposes. Each purpose is matched to a lawful legal basis in Section 6.

Purpose	Data Categories Used	Legal Basis
Create and manage your account	Registration & Identity Data	Contract performance
Verify your age (21+ requirement)	Date of birth, KYC documents	Legal obligation
Process deposits and withdrawals	Financial Data	Contract performance
Deliver gaming and betting services	Gaming & Betting Activity Data	Contract performance
Fraud detection and prevention	Technical Data, Financial Data, Gaming Data	Legitimate interest
Anti-money laundering (AML) compliance	Identity Data, Financial Data, KYC documents	Legal obligation
Responsible gaming monitoring	Gaming Activity Data, Responsible Gaming settings	Legal obligation / Legitimate interest
Customer support	Communications Data, Account Data	Contract performance
Platform improvement and bug fixing	Technical Data, Error logs	Legitimate interest
Promotional communications (opt-in only)	Contact Data, Communications preferences	Consent

bd989 does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review. All account suspension, withdrawal restriction, and bonus forfeiture decisions are reviewed by a member of the bd989 compliance or risk management team before being actioned.

6. Legal Basis for Processing

bd989 relies on the following legal bases for processing personal data:

• Contract Performance: Processing that is necessary to provide the gaming and betting services you have requested, including account creation, payment processing, and service delivery.
• Legal Obligation: Processing that is required for bd989 to comply with applicable financial crime prevention, anti-money laundering, age verification, and record-keeping requirements.
• Legitimate Interest: Processing that serves bd989's genuine business interests — such as fraud prevention, platform security, and product improvement — where those interests are balanced against and do not override your privacy rights.
• Consent: Processing that is based on your freely given, specific, and informed consent — most notably for promotional and marketing communications via SMS or email. You may withdraw consent at any time by contacting [email protected] or updating your notification preferences in your account settings.

7. Data Sharing & Third Parties

bd989 does not sell, rent, or trade your personal data with any third party for commercial purposes. Your data is shared only in the limited circumstances described below, and only to the extent strictly necessary for the described purpose:

7.1 Payment Processors

When you make a deposit or request a withdrawal, the relevant financial data (mobile wallet number, masked card details, transaction amount) is shared with our contracted payment processing partners — including the operators of bKash, Nagad, Rocket, Upay, and our card processing gateway — solely to execute the transaction. These partners are contractually required to handle your data securely and in accordance with PCI-DSS standards.

7.2 Game Providers

To deliver third-party casino games (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others), a limited set of session data — including your account identifier, game session token, and wager history relevant to that session — is shared with the relevant game provider solely to render and settle the game round. Game providers do not receive your full identity data or financial details.

7.3 Identity Verification Services

bd989 may use contracted third-party KYC service providers to assist in verifying the authenticity of identity documents you submit. These providers receive only the specific documents necessary for the verification task and are contractually prohibited from retaining or using the documents for any other purpose.

7.4 Legal and Regulatory Authorities

bd989 will disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities when required to do so by a valid legal order, court order, or applicable legal requirement. In such cases, bd989 will disclose only the minimum information required to comply with the specific legal demand.

7.5 Fraud Prevention Networks

bd989 participates in industry-standard fraud prevention networks. Certain technical identifiers (IP addresses, device fingerprints) may be cross-referenced with shared fraud databases to identify accounts associated with known fraudulent activity. No personally identifying information (name, NID, phone number) is shared with these networks.

8. Cookies & Tracking Technologies

bd989 uses cookies and similar tracking technologies on the Platform to ensure it functions correctly, to maintain your login session, and to collect the technical usage data described in Section 3.5. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your authenticated login session, store your language preference, enable the secure transmission of payment data, and remember your responsible gaming settings. These cookies cannot be disabled without breaking core platform functionality. No consent is required for strictly necessary cookies as they are technically indispensable.

8.2 Performance & Analytics Cookies

bd989 uses first-party analytics cookies to understand how users navigate the Platform — for example, which game categories attract the most visits, which pages generate the most support queries, and where technical errors tend to occur. This data is collected in aggregate and anonymised form and is used solely to improve the Platform. No individual user profiling is conducted via analytics cookies.

8.3 Security Cookies

bd989 uses security cookies to support our fraud detection and account protection systems. These cookies help identify login attempts that deviate significantly from your established usage pattern (for example, a login from an unusual IP address or device) so that our security team can investigate potential unauthorised access.

8.4 Cookie Management

You can manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies at any time. Please note that disabling performance or security cookies may affect the functionality of certain platform features and our ability to protect your account from unauthorised access.

9. Data Retention

bd989 retains your personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following retention schedule applies:

Data Category	Retention Period	Reason
Account & identity data	Duration of account + 5 years after closure	AML / financial record-keeping obligations
KYC verification documents	Duration of account + 5 years after closure	Regulatory compliance
Financial transaction records	7 years from transaction date	Financial record-keeping obligations
Gaming & betting activity logs	3 years from account closure	Dispute resolution, fraud investigation
Support correspondence	3 years from last interaction	Dispute resolution
Technical / device / session logs	13 months from collection	Security & fraud monitoring
Marketing consent records	Until consent is withdrawn + 2 years	Proof of consent

Upon expiry of the applicable retention period, all personal data is securely deleted or irreversibly anonymised. Deletion is logged internally as evidence of compliance with our data retention obligations.

10. Security Measures

bd989 employs a multi-layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our key security controls include:

• Transport Layer Security: All data transmitted between your browser or device and bd989's servers is encrypted using TLS 1.3 with 256-bit encryption keys. HTTP connections are automatically redirected to HTTPS.
• Data-at-Rest Encryption: Personal data stored in bd989's databases is encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the encrypted data stores.
• Access Controls: Access to personal data is strictly limited to bd989 staff members and contractors who require it to perform their job function. All internal access is role-based, logged, and audited on a regular basis.
• Two-Factor Authentication: bd989 offers two-factor authentication (2FA) for all user accounts. We strongly encourage all account holders to enable 2FA from their account security settings to add an additional layer of protection to their login credentials.
• Intrusion Detection: bd989's infrastructure is monitored around the clock by automated intrusion detection and prevention systems. Suspicious network activity triggers an immediate security alert for review by our technical team.
• PCI-DSS Compliance: Card payment processing is handled exclusively by PCI-DSS Level 1 certified payment processors. Full card numbers are never transmitted to or stored on bd989's own servers.
• Security Audits: bd989's platform and data infrastructure undergo periodic independent security reviews and penetration testing to identify and remediate vulnerabilities proactively.

Despite these extensive measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bd989 will notify affected users without undue delay and will take all reasonable steps to contain the breach and prevent recurrence.

11. Your Privacy Rights

As a bd989 user, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team at [email protected] with the subject line "Privacy Request" and clearly describe the right you wish to exercise. We will respond within ten (10) business days:

11.1 Right of Access

You have the right to request a copy of all personal data that bd989 holds about you, together with information about how it is used, how long it will be retained, and with whom it has been shared. This is sometimes called a Subject Access Request (SAR).

11.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay. You may update most account details yourself through the account settings page; for data that cannot be self-corrected (such as name on file), contact our support team.

11.3 Right to Erasure

You have the right to request that bd989 delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. Please note that this right is subject to our legal obligations to retain certain data (see Section 9) — we cannot delete data that we are legally required to keep.

11.4 Right to Restriction of Processing

In certain circumstances (for example, while the accuracy of data is being disputed), you have the right to request that bd989 restrict the processing of your personal data to storage only, pending resolution of the dispute.

11.5 Right to Data Portability

You have the right to receive a copy of the personal data you have provided to bd989 in a structured, commonly used, and machine-readable format (such as JSON or CSV). This right applies to data processed on the basis of your consent or for contract performance.

11.6 Right to Object

You have the right to object to processing of your personal data that is based on bd989's legitimate interests. Upon receipt of a valid objection, bd989 will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests. You may also object to the processing of your data for direct marketing purposes at any time, with immediate effect.

11.7 Right to Withdraw Consent

Where processing is based on your consent (primarily promotional communications), you may withdraw that consent at any time by contacting [email protected] or by updating your notification preferences in your account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

12. Minors & Age Policy

The bd989 Platform is strictly restricted to individuals who are at least 21 years of age. bd989 does not knowingly collect, process, or store personal data relating to individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If bd989 discovers or has reason to believe that an account belongs to a person under the age of 21, the account will be immediately suspended, all balances will be frozen pending investigation, and the account will be permanently closed. Any deposits made by a minor will be returned to the source payment method after identity verification of the rightful account holder, and all wagers placed will be voided.

If you believe that a minor in your household has created a bd989 account, please contact us immediately at [email protected]. We will investigate and take all appropriate action without delay.

13. International Data Transfers

bd989 primarily processes and stores personal data on servers located in or near the Bangladesh region to minimise latency and maintain data sovereignty for Bangladeshi users. In certain technical scenarios — such as the use of third-party game providers or cloud infrastructure components — your data may be processed on servers located outside Bangladesh.

Where personal data is transferred outside Bangladesh, bd989 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards include contractual data processing agreements with all third-party processors, data encryption in transit and at rest, and access controls that prevent any transfer recipient from using the data for purposes beyond those specified in the processing agreement.

14. Changes to This Privacy Policy

bd989 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or the services we provide. All changes will be published on this page with an updated "Last Updated" date at the top of the Policy.

For material changes that significantly affect how we process your personal data or reduce your privacy rights, bd989 will make reasonable efforts to notify registered users via their registered mobile number or the account notification centre at least seven (7) days before the revised Policy takes effect. Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

We recommend reviewing this Privacy Policy periodically to stay informed about how bd989 protects your personal data. The current version of this Policy will always be available on this page at bd989.io/privacy-policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to bd989's handling of your personal data, please contact our support team using the details below. We aim to acknowledge all privacy-related enquiries within two (2) business hours and to fully resolve them within ten (10) business days:

All communications relating to privacy requests must be submitted in writing via email to the address above. We are unable to process verbal privacy requests made through the live chat channel. Requests submitted by email will receive a formal written response that you can retain for your records.