Your Privacy Matters to bd17 — How We Protect Your Personal Data

About This Policy

This Privacy Policy sets out how bd17 collects, processes, stores, shares and protects personal data relating to individuals who visit, register on or interact with the bd17 platform at https://bd17.io. It applies to all registered players and prospective players located in Bangladesh and any other eligible territory from which the platform is accessed.

By registering a bd17 account or continuing to use the platform after this policy has been published or updated, you acknowledge that you have read and understood its contents. If you do not agree with any part of this policy, you should discontinue use of the platform and contact support to arrange account closure.

This policy should be read alongside bd17's Terms & Conditions and Responsible Gaming page, which together form the complete framework governing your relationship with the bd17 platform.

Data We Collect

bd17 collects personal data through several channels: directly from you during registration and account management, automatically as you interact with the platform, and in limited circumstances from trusted third-party sources for identity verification purposes. The categories of data we collect are as follows:

bd17 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data or health information except where a player voluntarily discloses such information in the context of a responsible gaming self-assessment or support interaction.

How We Use Your Data

bd17 uses the personal data it collects for the following purposes. Each use is matched to the lawful basis on which we rely, as described in Section 04.

• Account creation and management: To create, maintain and administer your bd17 player account, including verifying your identity and age before account activation.
• Payment processing: To process BDT deposits and withdrawals via bKash, Nagad, Rocket, Upay and other approved payment methods, and to maintain an accurate record of your transaction history.
• Platform delivery: To provide access to casino games, sports betting markets, the Wallet feature and all other bd17 platform services, and to personalise your gaming experience where you have opted in to personalisation.
• Security and fraud prevention: To detect, investigate and prevent fraudulent transactions, multi-accounting, bonus abuse, money laundering, and other prohibited conduct as described in the bd17 Terms & Conditions.
• Legal and regulatory compliance: To comply with applicable anti-money-laundering (AML) obligations, know-your-customer (KYC) requirements, and any other legal obligations to which bd17 is subject.
• Responsible gaming: To monitor betting patterns that may indicate problem gambling behaviour and, where appropriate, to apply protective measures such as deposit limits or cooling-off periods in accordance with bd17's responsible gaming obligations.
• Customer support: To respond to queries, complaints and requests submitted through the bd17 support channel.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the functionality, performance and content of the bd17 platform.
• Marketing communications: To send promotional offers, bonus notifications and platform news to players who have opted in to marketing communications. See Section 11 for opt-out instructions.

Legal Basis for Processing

bd17 processes personal data only where a valid legal basis exists for doing so. The legal bases on which we rely are as follows:

• Contractual necessity: Processing that is necessary to perform the contract between bd17 and the player — specifically, operating the player's account, processing transactions and delivering gaming services.
• Legal obligation: Processing required to comply with applicable law, including AML regulations, KYC requirements and any lawful request from a competent authority.
• Legitimate interests: Processing that serves bd17's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring and internal analytics, provided those interests are not overridden by the player's fundamental rights and freedoms.
• Consent: Processing for which bd17 has obtained the player's freely given, informed and specific consent — principally the sending of marketing and promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Cookies and Tracking Technologies

The bd17 platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your login session, and to analyse how the platform is used. The following types of cookies are in use:

• Essential cookies: These are strictly necessary for the platform to function. They maintain your authenticated session, store your language and currency preferences, and ensure that security features operate correctly. These cookies cannot be disabled without preventing core platform functionality from working.
• Analytics cookies: These collect anonymised data about how players navigate the bd17 platform — which pages are visited most, how long sessions last, and where players encounter errors. This data is used solely to improve the platform. Analytics cookies do not identify individual players.
• Functional cookies: These remember player preferences such as game category filters and notification settings across sessions, improving the continuity of the player experience.
• Marketing cookies: These are placed only where a player has consented to receiving personalised promotional content. They help bd17 present relevant bonus offers based on a player's gaming activity. Players who have not consented to marketing will not receive marketing cookies.

Players can manage cookie preferences through their browser settings. Disabling essential cookies will impair the functionality of the bd17 platform and may prevent account access. Disabling analytics, functional or marketing cookies will not affect a player's ability to use core platform services.

Third-Party Data Sharing

bd17 does not sell, rent or otherwise transfer personal data to third parties for commercial or marketing purposes. Personal data is shared with third parties only in the following limited circumstances:

• Payment processors: bd17 shares the minimum necessary financial data with payment processing partners — including bKash, Nagad, Rocket and Upay — to execute deposit and withdrawal transactions. These partners process data under their own privacy policies and are independently responsible for their data handling practices.
• Identity verification providers: bd17 may use third-party KYC and AML screening services to verify player identity and age and to screen transactions for money-laundering risk. Data shared with these providers is limited to identity and transaction data required for the verification process.
• Game technology providers: Game data (bet amounts, game outcomes, session timestamps) may be shared with licensed game studios — including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt and Microgaming — to the extent required to deliver their games and resolve technical disputes.
• Platform technology providers: bd17 uses third-party cloud infrastructure, analytics and security technology providers. These providers process data on bd17's behalf as data processors and are bound by contractual obligations to process data only as instructed by bd17.
• Legal and regulatory authorities: bd17 will disclose personal data to competent legal, regulatory or law enforcement authorities where required to do so by applicable law, court order or lawful authority request. bd17 will notify the affected player of such a disclosure where it is legally permitted to do so.

All third-party processors engaged by bd17 are required to maintain appropriate technical and organisational security measures commensurate with the sensitivity of the data they process on bd17's behalf.

Data Security

bd17 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include, but are not limited to:

• Transport encryption: All data transmitted between players and the bd17 platform is encrypted using 256-bit SSL/TLS protocols.
• Storage encryption: Sensitive data at rest — including identity documents and financial information — is stored in encrypted form using AES-256 encryption.
• Access controls: Access to personal data within bd17's systems is restricted to personnel who require it to fulfil their job function. All internal access is logged and subject to regular audit.
• Penetration testing: bd17 engages independent security professionals to conduct periodic penetration testing of its platform infrastructure.
• Incident response: bd17 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to the rights and freedoms of players, bd17 will notify affected players and relevant authorities within 72 hours of becoming aware of the incident.

While bd17 applies rigorous security controls, no digital platform can guarantee absolute security. Players are strongly encouraged to use a strong, unique password for their bd17 account and to notify support immediately if they suspect any unauthorised access.

Data Retention

bd17 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of the player's account and for a minimum of five years following permanent account closure, to comply with AML and financial record-keeping obligations.
• Transaction records: BDT deposit and withdrawal records are retained for a minimum of seven years from the date of the transaction in accordance with financial regulation requirements.
• KYC and identity documents: Retained for a minimum of five years from the date of submission or from the date of account closure, whichever is later.
• Support communications: Email and live chat records are retained for up to three years from the date of the interaction, unless the communication relates to an ongoing dispute or legal matter.
• Marketing consent records: Records of marketing opt-in and opt-out are retained for the duration of the account and for one year following account closure, as evidence of consent or its withdrawal.
• Technical and usage logs: Platform access logs and usage analytics are retained for up to 12 months, after which they are aggregated and anonymised or permanently deleted.

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted from bd17 systems or anonymised in a manner that prevents re-identification of the individual to whom it related.

Your Rights Over Your Personal Data

Players have the following rights in relation to personal data that bd17 holds about them. To exercise any of these rights, please contact the bd17 support team at [email protected] with your registered username and a description of your request. bd17 will respond within 30 days of receipt.

• Right of access: You may request a copy of the personal data bd17 holds about you, together with information about how and why it is being processed.
• Right to rectification: You may request that bd17 correct any inaccurate or incomplete personal data held about you. Where possible, corrections to account details can be made directly through your account settings.
• Right to erasure: You may request that bd17 delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other legal basis applies. This right is subject to bd17's legal retention obligations — bd17 may be unable to delete certain data during mandatory retention periods.
• Right to restriction: You may request that bd17 restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is contested or while a complaint is being investigated.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that bd17 provide your personal data in a structured, commonly used and machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring purposes. bd17 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
• Right to withdraw consent: Where processing is based on consent — for example, marketing communications — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Children's Privacy

The bd17 platform is strictly for individuals aged 21 years and above. bd17 does not knowingly collect, process or retain personal data relating to individuals under the age of 21. Any account found to belong to a person under the minimum age will be suspended immediately and all associated data will be deleted, subject to any legal obligations that require its retention for a defined period.

If you believe that a minor has accessed or registered on the bd17 platform, please notify us immediately at [email protected] so that appropriate action can be taken without delay.

Players who are parents or guardians are responsible for ensuring that minors in their household do not gain access to the bd17 platform or to any registered player account. bd17 strongly recommends the use of parental control software on shared devices as an additional safeguard.

Marketing Communications

bd17 may send promotional emails, bonus notifications and platform news to players who have consented to receive marketing communications at the time of registration or through their account settings. Marketing communications cover matters such as welcome bonuses, deposit match offers, seasonal promotions, and new game announcements.

Participation in marketing communications is entirely voluntary. Players may opt out of all marketing at any time using any of the following methods:

• Clicking the "Unsubscribe" link present in any bd17 marketing email.
• Updating notification preferences in the account settings panel.
• Contacting the support team at [email protected] and requesting removal from all marketing lists.

Opt-out requests are processed within five business days. Following opt-out, players will continue to receive essential transactional communications — such as deposit confirmations, withdrawal notifications, password reset emails and security alerts — as these are necessary for account management and cannot be disabled while an account remains active.

Policy Amendments

bd17 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality or data processing practices. Where changes are material, bd17 will provide reasonable advance notice to registered players via email or via a prominent notice on the platform.

The effective date of the current version of this Privacy Policy is stated at the top of this document. Players are encouraged to review this page periodically to remain informed of how bd17 handles their personal data. Continued use of the platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms.

Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise any of the data rights described in Section 09, or wish to raise a complaint about bd17's handling of your personal data, please contact the bd17 support team:

• Email: [email protected] (plain text — not a clickable link)
• Response time: bd17 aims to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within 30 calendar days.
• Language: Please submit privacy requests in English for the fastest and most accurate response.

When submitting a data rights request, please include your registered username, the email address associated with your account, a clear description of the right you wish to exercise, and any relevant supporting context. bd17 may request proof of identity before processing a data access or deletion request to ensure that personal data is not disclosed to or deleted at the request of an unauthorised party.