Privacy Policy — How bdg3 Protects Your Personal Data

01 Introduction

bdg3 ("we", "us", "the Platform", "the Operator") is committed to protecting the privacy and personal data of every individual who accesses or registers on the bdg3 platform. This Privacy Policy sets out in clear terms what personal information we collect, the purposes for which it is collected and used, the legal basis on which we rely for processing, how long we retain it, who we share it with, and what rights you have in relation to your own data.

bdg3 serves players primarily located in Bangladesh, providing online casino games, live dealer experiences, and sports betting services. In the course of operating these services, we necessarily collect and process personal data. We do so responsibly, proportionately, and always with a specific legitimate purpose in mind. We do not collect data for its own sake, and we do not monetise player data through advertising partnerships or third-party data sales.

If you have any questions about how bdg3 handles your personal data that are not answered by this policy, you are encouraged to contact our support team using the details provided in Section 16. All privacy-related enquiries are handled by our dedicated data protection contact, and responses are provided within a reasonable timeframe.

02 Data Controller

For the purposes of applicable data protection principles, bdg3 acts as the data controller in respect of all personal data collected directly from players via the platform. As data controller, bdg3 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

Where third-party service providers — such as Game Providers, payment processors, or identity verification services — process your personal data on behalf of bdg3, they do so as data processors acting under contractual instructions from bdg3. bdg3 remains responsible for ensuring that such processors handle your data in accordance with this Privacy Policy and applicable data protection standards.

03 Data We Collect

bdg3 collects the following categories of personal data from registered players and platform visitors:

bdg3 does not collect biometric data beyond the selfie photograph required for identity verification purposes. We do not collect data about your racial or ethnic origin, religious beliefs, health conditions, or political opinions. We do not access your device's camera, microphone, or contacts list beyond the explicit actions you perform within the platform.

04 How We Collect Your Data

bdg3 collects personal data through the following channels:

• Direct submission: Information you actively provide when completing the registration form, submitting KYC documents, making a deposit, contacting the support team, or responding to a survey or promotion.
• Automated technical collection: Technical and behavioural data collected automatically via cookies, web beacons, server logs, and session tracking technologies when you access and navigate the platform. See Section 8 for full details on cookies.
• Third-party sources: Identity verification data confirmed by third-party KYC service providers; fraud risk signals from anti-fraud partners; transaction confirmation data from payment processors such as bKash, Nagad, Rocket, and Upay.
• Game Provider systems: Gameplay outcome data, bet logs, and session data generated by certified Game Providers (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt) and transmitted to bdg3 in real time for account settlement and responsible gaming monitoring.

05 How We Use Your Data

bdg3 uses your personal data solely for the following defined purposes:

• Account creation and management: Creating and maintaining your player account, verifying your identity, processing your registration, and enabling you to access platform services.
• Payment processing: Facilitating deposits and withdrawals in BDT via your chosen payment method, verifying payment ownership, and maintaining accurate transaction records.
• KYC and age verification: Confirming that you meet the 21+ minimum age requirement and verifying that the identity information you provided during registration is accurate and belongs to you.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, account hacking, bonus abuse, and other prohibited conduct outlined in the bdg3 Terms & Conditions.
• Responsible gaming monitoring: Analysing behavioural and gameplay data to identify indicators of problem gambling and to apply or recommend appropriate responsible gaming interventions in accordance with our obligations and your welfare.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints, and communicating platform updates that affect your account.
• Platform improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, user experience, and technical infrastructure.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform news — only where you have provided explicit consent and only through the channels you have opted into. See Section 12 for opt-out details.
• Legal compliance: Retaining records and disclosing data as required by applicable laws, regulatory bodies, court orders, or competent law enforcement authorities.

bdg3 does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review. Where automated risk-scoring tools are used as part of fraud prevention or responsible gaming monitoring, any consequential account action (such as account restriction or enhanced due diligence) involves a human review step before being applied.

06 Legal Basis for Processing

bdg3 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the player agreement between you and bdg3, including account creation, payment processing, KYC verification, and customer support.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money-laundering requirements, age verification obligations, fraud reporting duties, and record-keeping mandates.
• Legitimate interests: Processing carried out in pursuit of bdg3's legitimate business interests, provided those interests are not overridden by your fundamental rights. This includes fraud prevention, platform security, responsible gaming monitoring, and internal analytics. bdg3 has conducted legitimate interest assessments for all processing activities falling under this basis.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. See Section 12 for how to withdraw marketing consent.

07 Sharing Your Data

bdg3 does not sell, rent, or trade your personal data. We share your data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Identity verification providers: Third-party KYC and anti-money-laundering service providers who verify the authenticity of identity documents and confirm that submitted details match official records.
• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other financial institutions or payment service providers required to process your deposits and withdrawals. These providers receive only the minimum data necessary to complete the transaction.
• Game Providers: Certified third-party game studios (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt) who may receive your account identifier and session data to deliver and settle game rounds. Game Providers do not receive your full identity or payment data.
• Fraud prevention and security partners: Specialist providers of device fingerprinting, IP reputation analysis, and behavioural fraud detection services used to protect the platform and all of its players.
• IT and hosting providers: Cloud infrastructure, hosting, and database management providers who store and process platform data under strict confidentiality obligations and data processing agreements with bdg3.
• Legal and regulatory authorities: Law enforcement agencies, financial intelligence units, courts, and regulatory bodies where disclosure is required by law, court order, or regulatory instruction. bdg3 will notify you of such disclosures where legally permitted to do so.
• Professional advisers: Legal counsel, auditors, and accountants who are subject to professional confidentiality obligations and who access personal data only to the extent required to provide their professional services to bdg3.

All third-party data processors engaged by bdg3 are required to enter into a formal data processing agreement that obliges them to process personal data only on bdg3's documented instructions, to maintain appropriate technical and organisational security measures, and to delete or return data upon termination of the engagement.

08 Cookies & Tracking Technologies

bdg3 uses cookies and similar tracking technologies to operate the platform effectively, maintain session continuity, and understand how players use the site. The following types of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, last-visited game categories, and responsible gaming tool configurations. These improve your experience but are not essential.
• Analytics cookies: Collect aggregated, anonymised data about how visitors navigate the platform — pages visited, time spent, error pages encountered — to help bdg3 improve site performance and layout. No individual player is identified in analytics reports.
• Security cookies: Support fraud detection and session integrity verification, including detection of concurrent sessions from different geographic locations.

bdg3 does not use third-party advertising cookies or retargeting cookies that track your activity across other websites. You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the platform.

09 Data Security

bdg3 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data fields at rest within our database infrastructure.
• Role-based access controls ensuring that internal staff can access personal data only to the extent required by their specific role and responsibilities.
• Multi-factor authentication requirements for all internal systems that process personal data.
• Regular third-party security audits and penetration testing of platform infrastructure.
• Automated monitoring systems that detect and alert on anomalous access patterns or data exfiltration attempts in real time.
• Formal incident response procedures that require notification to affected players in the event of a data breach that creates a high risk to their rights and interests.

While bdg3 employs industry-standard security practices, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying bdg3 promptly if you suspect that your account has been compromised.

10 Data Retention

bdg3 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal or regulatory obligations. The following general retention periods apply:

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual. Anonymised, aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and platform improvement purposes.

11 Your Data Rights

As a data subject, you have the following rights in relation to your personal data held by bdg3. To exercise any of these rights, please contact the support team using the details in Section 16. bdg3 will respond to all valid requests within 30 calendar days:

• Right of access: You have the right to request a copy of all personal data bdg3 holds about you, along with information about how it is being used. This is known as a Subject Access Request (SAR).
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. Many details can be updated directly in your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. This right is subject to legal obligations that may require bdg3 to retain certain data for a defined period.
• Right to restriction of processing: You may request that bdg3 restrict the processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data where bdg3 relies on legitimate interests as the legal basis. bdg3 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

bdg3 will not charge a fee for handling data rights requests unless a request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply. We may request proof of identity before processing a Subject Access Request to ensure that personal data is not disclosed to an unauthorised third party.

12 Marketing Communications

bdg3 will send you promotional emails, bonus notifications, and platform news only where you have provided explicit opt-in consent during registration or subsequently via your account settings. Marketing communications will be sent to the email address registered on your account and/or via the mobile number registered on your account, depending on your stated preferences.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link present in the footer of any marketing email you receive from bdg3.
• Updating your communication preferences in the notification settings section of your account dashboard.
• Contacting the support team directly and requesting removal from all marketing lists.

Please note that opting out of marketing communications does not prevent bdg3 from sending you essential service communications — such as account security alerts, KYC verification requests, deposit confirmation notices, withdrawal updates, and amendments to Terms & Conditions — which are sent on the basis of contractual necessity rather than marketing consent.

13 Third-Party Links

The bdg3 platform may contain references to third-party services, payment providers, or Game Providers. While bdg3 takes care to work with reputable partners, we have no control over the privacy practices of third-party platforms and accept no responsibility for the content or data handling of external services. This Privacy Policy applies solely to personal data collected and processed by bdg3 in connection with the bdg3 platform. If you access any third-party service via a link or integration on the platform, we recommend that you review that provider's privacy policy independently.

14 Children's Privacy

The bdg3 platform is strictly restricted to individuals aged 21 and above. bdg3 does not knowingly collect, store, or process the personal data of anyone under 21 years of age. Age verification is a mandatory step in the KYC process for every registered account.

If bdg3 becomes aware that an account is registered to, or is being operated by, a person under 21, the account will be immediately suspended, all personal data associated with that account will be deleted as soon as legally permissible, and any funds held in the account will be handled in accordance with applicable legal requirements. If you believe that a person under 21 has registered on the bdg3 platform, please notify us immediately at [email protected] so that appropriate action can be taken without delay.

15 Policy Updates

bdg3 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform operations. When a material change is made to this policy, bdg3 will notify registered players by email to the address on file and by displaying a prominent notice on the platform for a minimum of 14 days following the update.

The date of the most recent revision is displayed at the top of this page under "Last Updated." Continued use of the bdg3 platform after the effective date of any policy update constitutes your acceptance of the revised Privacy Policy. If you do not agree with a material change, you have the right to close your account and request deletion of your personal data in accordance with the retention obligations outlined in Section 10.

We encourage you to review this Privacy Policy periodically to stay informed about how bdg3 is protecting your information. Archived versions of previous policies are available on request from the support team.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way bdg3 processes your personal data, please contact our support team. All privacy-related enquiries are handled with priority by our data protection contact:

When submitting a Subject Access Request or any other formal data rights request, please include your registered email address and account username so that we can verify your identity and locate your records accurately and efficiently.