bdbat Privacy Policy — How We Protect Your Personal Data

bdbat ("we", "us", "our") operates the online betting and casino platform accessible at bdbat.io. bdbat is the data controller in respect of all personal data collected from users of the platform, including registered players, unregistered visitors browsing the website, and prospective users who have initiated but not completed the registration process.

This Privacy Policy applies to all personal data collected, stored, and processed by bdbat in connection with the provision of its services to players primarily located in Bangladesh. By accessing or using the bdbat platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent, you must discontinue use of the platform and, if applicable, close your account by contacting our support team.

This Privacy Policy is to be read in conjunction with the bdbat Terms and Conditions and the Responsible Gaming Policy. In the event of any conflict between this Privacy Policy and those documents, this Privacy Policy shall prevail in respect of all data protection matters.

bdbat collects personal data from you in several ways: directly when you register an account or contact our support team; automatically when you use the platform; and from third-party sources such as payment providers and identity verification services. The categories of personal data we collect are detailed in the table below.

We do not intentionally collect special category data (such as racial or ethnic origin, health data, religious beliefs, or political opinions) through the normal use of the platform. If such data is incidentally disclosed to us during a support interaction, it will not be recorded or retained beyond what is strictly necessary to resolve your query.

bdbat uses the personal data it collects for clearly defined purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent or identifying a separate lawful basis for the new use. The primary purposes for which we process personal data are:

• Account Management: To create, maintain, and administer your bdbat account, including processing your registration, verifying your identity, and managing your account settings and preferences.
• Service Delivery: To enable you to place bets, play casino games, and access all features of the bdbat platform, including live dealer games provided by studios such as Evolution Gaming and Ezugi.
• Payment Processing: To process deposits made via bKash, Nagad, Rocket, Upay, and bank transfer, and to process withdrawal requests to your verified payment method. All financial transactions are conducted in ৳ BDT.
• KYC and Fraud Prevention: To verify your age (21+ requirement), identity, and payment method ownership as part of our Know Your Customer process, and to detect, investigate, and prevent fraudulent activity on the platform.
• Responsible Gaming: To monitor gameplay patterns for signs of problematic gambling behaviour, to apply deposit limits, session limits, and self-exclusion measures where requested, and to comply with our responsible gaming obligations.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance via our 24/7 support team.
• Marketing Communications: To send you promotional offers, bonus notifications, and relevant product updates where you have opted in to receive such communications. You may opt out at any time.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from authorities, and maintain records as required by our legal and regulatory obligations.
• Platform Improvement: To analyse aggregate behavioural data to improve the usability, performance, and content of the bdbat platform.

Every processing activity carried out by bdbat is grounded in a lawful basis. We rely on the following legal bases across our different data processing activities:

• Contractual Necessity: Processing your identity, contact, and financial data is necessary to perform the contract between you and bdbat — namely, to operate your account, process your transactions, and deliver the services you have signed up for.
• Legal Obligation: Processing for KYC verification, age verification, anti-money-laundering checks, and records retention is required by applicable law. We cannot waive these processing activities even at your request.
• Legitimate Interests: Processing for fraud detection, platform security, responsible gaming monitoring, and aggregate analytics is carried out on the basis of our legitimate interest in maintaining a safe, fair, and well-functioning platform. We have assessed that these interests are not overridden by your data rights in these contexts.
• Consent: Processing for marketing communications and non-essential cookies is carried out only where you have provided freely given, specific, informed, and unambiguous consent. You may withdraw consent for marketing communications at any time by contacting support at bdbat.io or by using the unsubscribe link in any marketing email.

bdbat does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the circumstances described below, and only to the extent necessary for the specified purpose.

• Payment Processors: We share your financial data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard, solely to process your deposit and withdrawal transactions.
• Identity Verification Partners: We share identity and document data with third-party KYC service providers to verify your age, identity, and payment method ownership as required by our compliance obligations.
• Game Technology Providers: Game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive certain technical session data (such as player session tokens and bet amounts) necessary to operate their games within the bdbat platform. These providers operate under data processing agreements with bdbat and are not permitted to use this data for their own purposes.
• Fraud and Security Services: We may share data with third-party fraud detection and cybersecurity providers who assist us in identifying and responding to suspicious activity on the platform.
• Legal Authorities: We may disclose your personal data to law enforcement agencies, courts, or regulatory authorities where required to do so by applicable law, or where we are legally compelled by a valid court order or regulatory directive.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of bdbat's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you by email prior to any such transfer taking effect and will ensure that the acquiring entity is bound by data protection obligations at least equivalent to those set out in this Privacy Policy.

bdbat uses cookies and similar tracking technologies on its website to ensure the platform functions correctly, to remember your preferences, to keep your session secure, and to understand how visitors interact with the site so that we can improve the user experience over time.

Cookies are small text files placed on your device when you visit bdbat.io. They do not contain executable code and cannot access other files on your device. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These are essential for the platform to function. They manage your login session, maintain your security token, and remember items you have added to any interactive interface. These cookies cannot be disabled without breaking core platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised data about how visitors use bdbat.io — which pages are visited most frequently, which game categories attract the most clicks, and where users encounter errors. This data is used solely to improve the platform.
• Functionality Cookies: These remember your preferences, such as your preferred language (English), and settings you have configured in your account, so you do not need to re-enter them on each visit.
• Marketing and Preference Cookies: Where you have consented, these cookies allow us to personalise promotional content shown on the bdbat platform based on your betting and gaming history. They are not used to serve advertising on third-party websites.

You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to use the platform. Disabling other categories of cookies will not prevent you from accessing bdbat but may reduce the personalisation of your experience. For detailed guidance on managing cookies in your browser, please refer to your browser's official help documentation.

bdbat retains your personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply to the main categories of personal data we hold:

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from our systems or irreversibly anonymised so that it can no longer be associated with any individual. Anonymised data may be retained indefinitely for aggregate statistical analysis and platform improvement purposes.

bdbat employs a layered, defence-in-depth approach to data security. The following technical and organisational measures are applied across the platform to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption: All data stored on bdbat's servers is encrypted at rest using AES-256. All data transmitted between your device and the bdbat platform is encrypted in transit using TLS 1.3, the current industry standard for secure web communications.
• Access Controls: Access to systems containing personal data is restricted to authorised bdbat personnel who have a documented need to access that data. All internal access is subject to role-based permissions, multi-factor authentication, and comprehensive access logging.
• Infrastructure Security: bdbat's platform infrastructure is hosted on servers protected by enterprise-grade firewalls, intrusion detection systems, and 24/7 monitoring. Regular penetration testing and vulnerability assessments are conducted by independent security specialists.
• Payment Security: All payment transactions processed through bdbat are handled via PCI-DSS-compliant payment gateways. bdbat does not store full card numbers or mobile wallet PINs on its own servers.
• Incident Response: bdbat maintains a formal data breach response procedure. In the event of a security incident affecting your personal data, we will notify you by email within 72 hours of becoming aware of the breach, in accordance with our legal obligations.
• Staff Training: All bdbat staff with access to personal data undergo mandatory data protection training upon appointment and receive refresher training annually.

As a data subject, you hold a meaningful set of rights over the personal data that bdbat holds about you. bdbat is committed to facilitating the exercise of these rights promptly and without unnecessary friction. All rights requests should be submitted to support at bdbat.io with the subject line "Data Rights Request" and must include sufficient information to verify your identity before the request is acted upon.

bdbat will respond to all verified data rights requests within 30 calendar days. In complex or high-volume cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and provide a reason for the delay. We will not charge a fee for processing reasonable requests, but we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

Please note that certain rights are subject to limitations. For example, we cannot delete personal data that we are legally required to retain, and we cannot provide access to data that would disclose information about another individual without that individual's consent. Where we are unable to fulfil a request in full, we will explain why and describe any partial steps we are able to take.

bdbat is strictly an adult platform. Access to the bdbat platform and all of its services — including sports betting, live casino, and slots — is permitted only to individuals who are 21 years of age or older. This is an absolute requirement and applies to all players regardless of their location within Bangladesh.

bdbat does not knowingly collect, use, or store personal data from any individual under the age of 21. During the registration process, all prospective users are required to confirm that they meet the 21+ age requirement, and age verification checks are conducted as part of our KYC process. Where we suspect that an account has been registered by or is being used by a person under 21, that account will be immediately suspended pending investigation.

If you are a parent or guardian and believe that a minor in your care has registered an account with bdbat or has provided personal data to us, please contact us immediately at support at bdbat.io. We will investigate the matter and, if confirmed, will promptly delete all personal data associated with that account and refund any deposits made, subject to our terms and the outcome of the investigation.

bdbat reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes to this Privacy Policy, we will notify you by posting a prominent notice on the bdbat platform and, where we hold a valid email address for you, by sending a notification email to that address at least 14 days before the changes take effect.

The version number and "Last Updated" date at the top of this policy indicate which version is currently in effect. Your continued use of the bdbat platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any material change to this Privacy Policy, you must stop using the platform and may request account closure by contacting our support team.

Previous versions of this Privacy Policy are available on request by contacting support at bdbat.io. We recommend that you review this page periodically to stay informed about how bdbat is protecting your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way bdbat handles your personal data, please do not hesitate to contact us. Our data support team is available 24 hours a day, 7 days a week, including Eid, Pohela Boishakh, Victory Day (December 16), and other public holidays in Bangladesh.

bdbat serves players across all major divisions of Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh. Wherever you are located within Bangladesh, your privacy rights are the same and our commitment to protecting your data is identical.