Privacy Policy — How bdback Protects Your Personal Data

bdback collects personal data through several channels: directly from you when you register an account or interact with the platform, automatically through your use of the platform, and from third-party service providers where necessary to deliver our services. Below is a comprehensive breakdown of the data we collect.

1.1 Registration and Account Data. When you create a bdback account, we collect the following information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify you are aged 18 or above)
• Residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, or Mymensingh)
• Mobile phone number (primary contact and linked to bKash or Nagad accounts)
• Email address (for transactional and account communications)
• Username and encrypted password hash (we never store plain-text passwords)
• Preferred language and currency settings

1.2 Identity Verification (KYC) Data. To comply with anti-money laundering obligations and verify your eligibility to use the platform, we may collect:

• Scanned or photographed copies of government-issued photo ID (National Identity Card, passport, or driving licence)
• Proof of address documents (utility bill, bank statement dated within 90 days)
• Selfie or live photo for biometric comparison where enhanced verification is required
• Proof of payment method ownership (e.g., screenshot of bKash or Nagad account showing your registered mobile number)

1.3 Financial and Transaction Data. When you make deposits or withdrawals, we collect:

• Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Mobile wallet number (for bKash, Nagad, Rocket, Upay transactions)
• Partial card number (last four digits only — we never store full card numbers)
• Transaction amounts in Bangladeshi Taka (BDT), timestamps, and reference numbers
• Deposit and withdrawal history associated with your account

1.4 Gameplay and Betting Data. As you use the bdback platform, we collect records of your activity including:

• Games played, bet amounts, outcomes, and session durations
• Sports betting selections, odds accepted, and settlement results
• Bonus usage, wagering progress, and promotional participation
• Responsible gaming settings you have applied (deposit limits, session limits, self-exclusion periods)

1.5 Technical and Device Data. When you access bdback, our servers automatically collect certain technical information:

• IP address and approximate geographic location (country and city level)
• Device type, operating system, and browser version
• Session identifiers and authentication tokens
• Platform access timestamps, page navigation sequences, and feature interaction logs
• Referral source (e.g., which page referred you to bdback)

1.6 Communications Data. If you contact bdback support via live chat, email, or WhatsApp, we retain records of those communications including the content of messages, timestamps, and support agent responses. These records are used to resolve disputes, train support staff, and improve service quality.

bdback uses the personal data it collects for specific, documented purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The table below sets out our primary data use cases alongside the legal basis for each processing activity.

2.1 Marketing Communications. If you have provided consent to receive marketing communications, bdback may send you promotional emails and SMS messages about bonuses, seasonal offers (including Eid, Pohela Boishakh, BPL, and IPL promotions), new game releases, and platform news. You may withdraw your marketing consent at any time by updating your account preferences or contacting support at [email protected]. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal.

2.2 Automated Decision-Making. bdback uses automated systems to detect fraud, money laundering, and bonus abuse. These systems may result in automated restrictions being applied to your account (such as a temporary hold on withdrawals pending manual review). You have the right to request human review of any automated decision that significantly affects you. To exercise this right, contact support at [email protected].

2.3 Profiling for Responsible Gaming. bdback analyses gameplay patterns to identify signs of problem gambling behaviour. This profiling is conducted in your interests — to trigger responsible gaming interventions such as spending limit reminders and support outreach. We do not use this profiling for commercial targeting or to increase your spending.

bdback does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the relevant purpose.

3.1 Payment Processors. To process your deposits and withdrawals, we share relevant transaction data with our payment partners: bKash, Nagad, Rocket, Upay, Visa, and Mastercard. These providers receive only the data required to execute the specific transaction (e.g., your mobile wallet number and transaction amount). Each payment partner operates under its own privacy policy and is independently responsible for its data practices.

3.2 Game Providers. When you play casino games or live dealer games on the bdback platform, the relevant game software is served by third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive anonymised session identifiers and gameplay outcome data to support game integrity and fair play auditing. They do not receive your personal registration or payment data.

3.3 KYC and Identity Verification Services. bdback may use third-party identity verification services to assist with document validation and age verification. These services receive copies of your KYC documents solely for the purpose of verification and are contractually prohibited from using this data for any other purpose.

3.4 Technology and Infrastructure Providers. bdback uses third-party cloud hosting, database management, and cybersecurity services to operate the platform. These providers act as data processors under our instruction and may have access to personal data stored on our infrastructure. All such providers are bound by data processing agreements requiring them to maintain appropriate security standards.

3.5 Legal and Regulatory Disclosure. bdback may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where required or permitted by applicable law — for example, in connection with an anti-money laundering investigation or a court order. We will notify you of such disclosures where we are legally permitted to do so.

3.6 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of substantially all of bdback's assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify registered players via email and platform notice in advance of any such transfer, and the acquiring entity will be required to honour the commitments set out in this Privacy Policy.

bdback uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session, and analyse platform usage. This section explains what cookies we use and how you can control them.

4.1 What Are Cookies? Cookies are small text files stored on your device (computer, tablet, or mobile phone) by your web browser when you visit a website. They allow the website to recognise your device on subsequent visits and recall information about your preferences or session state. Cookies cannot execute code or deliver viruses to your device.

4.2 Categories of Cookies We Use.

4.3 Managing Cookies. You can control most cookies through your browser settings. The major browsers offer options to block all cookies, accept only first-party cookies, or notify you before a cookie is stored. Please be aware that disabling functional or analytics cookies may affect your experience on the bdback platform. Disabling strictly necessary or anti-fraud cookies may prevent you from logging in or using core platform features. For browser-specific cookie management instructions, consult your browser's help documentation.

4.4 Local Storage and Session Storage. In addition to cookies, bdback may use HTML5 local storage and session storage to retain session state data on your device. This data is never transmitted to third parties and is cleared when you log out or close your browser session (session storage) or when you clear your browser's local storage (local storage).

bdback retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply to the main categories of personal data we hold:

Upon expiry of the applicable retention period, personal data is either securely deleted from our systems or irreversibly anonymised so that it can no longer be associated with any individual player. Anonymised data may be retained indefinitely for aggregate statistical analysis.

If you request deletion of your account, bdback will process the closure and initiate deletion of personal data that is not subject to a mandatory retention period. Data subject to legal retention obligations (such as KYC documents and transaction records) will be retained for the minimum required period and then securely deleted.

Protecting the personal data of bdback players is a core operational responsibility. We maintain a multi-layered security architecture designed to prevent unauthorised access, data breaches, and misuse of personal information.

6.1 Technical Security Controls. bdback implements the following technical measures across its infrastructure:

• 256-bit SSL/TLS encryption on all connections between players and bdback servers
• Encrypted storage of passwords using industry-standard hashing algorithms (bcrypt with salting) — plain-text passwords are never stored
• Encrypted storage of sensitive personal data at rest on all database servers
• Network segmentation and firewalls isolating player data from public-facing systems
• Intrusion detection and prevention systems (IDS/IPS) monitoring for anomalous activity
• Regular automated vulnerability scanning and periodic third-party penetration testing
• Secure key management practices with access controls limiting who can access encryption keys

6.2 Organisational Security Controls. Technical measures alone are not sufficient. bdback also implements the following organisational controls:

• Role-based access controls (RBAC) ensuring employees can only access personal data necessary for their job function
• Mandatory security training for all staff who handle personal data
• Data processing agreements with all third-party vendors who have access to personal data
• Incident response procedures for detecting, containing, and reporting data breaches
• Background screening for employees in data-sensitive roles

6.3 Data Breach Response. In the event of a confirmed data breach affecting player personal data, bdback will act promptly to contain the breach, assess the risk to affected players, and notify impacted individuals without undue delay. We will provide clear information about what data was affected, what steps we have taken, and what actions — if any — affected players should take to protect themselves.

6.4 Your Responsibility. While bdback takes extensive measures to protect your data, the security of your account also depends on the strength and confidentiality of your login credentials. We strongly recommend using a unique, strong password for your bdback account that you do not use on any other platform. Enable any available two-factor authentication features on your account. If you suspect your account has been compromised, contact support immediately at [email protected].

As a player on the bdback platform, you hold meaningful rights over your personal data. bdback is committed to honouring these rights promptly and without placing unnecessary obstacles in your way. All rights requests should be submitted to [email protected] with the subject line "DATA RIGHTS REQUEST". We will respond within 30 calendar days of receiving a valid request.

7.1 Identity Verification for Rights Requests. To protect against fraudulent data rights requests, bdback will verify your identity before processing any request. You will be asked to confirm your registered email address, mobile number, and may be asked to provide a piece of KYC documentation. This verification step is a security measure to ensure your data is only disclosed or deleted at your own genuine request.

7.2 Limitations on Rights. Some rights requests may be limited where bdback has a legal obligation to retain data (for example, AML transaction records cannot be deleted before the mandatory retention period expires). Where we are unable to fully comply with a rights request, we will explain the reason clearly and tell you what partial steps we can take.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how bdback has handled your personal data, please contact us using the details below. We take all privacy concerns seriously and aim to resolve queries promptly and transparently.

Privacy Enquiries and Data Rights Requests:
Email: [email protected]
Subject line: "PRIVACY POLICY ENQUIRY" or "DATA RIGHTS REQUEST"
Response time: Within 30 calendar days of receipt

General Support:
Live Chat: Available 24/7 directly on the bdback platform
WhatsApp: +880 1700 000000
Support Hours: 24/7 (Bangladesh Standard Time, UTC+6)

8.1 Updates to This Privacy Policy. bdback reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform features. When material changes are made, we will notify registered players via the email address associated with their account and display a prominent notice on the bdback platform at least 14 days before the updated policy takes effect. The "last updated" date at the top of this document will always reflect the most recent revision. Continued use of the bdback platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Privacy Policy, you should close your account before the effective date of the changes.

8.2 Children and Minors. bdback is strictly an 18+ platform. We do not knowingly collect personal data from individuals under the age of 18. If you believe that a minor has registered an account on the bdback platform or submitted personal data to us, please contact us immediately at [email protected]. Upon confirmation, we will promptly close the account and securely delete any personal data associated with the minor. Age verification is a mandatory step in the bdback registration and KYC process, and we take underage access prevention very seriously.