33mbd Privacy
Policy

This Privacy Policy applies to all personal data processed by 33mbd in connection with the operation of its online betting and casino platform at 33mbd.io, including all associated sub-pages, mobile-optimised interfaces, and any communications conducted through official 33mbd channels such as live chat and email support.

This policy applies to all registered Players, visitors who browse the platform without registering, and individuals who contact 33mbd's support team through any available channel. It covers data collected directly from users as well as data obtained automatically through the use of standard web technologies.

33mbd serves the Bangladeshi market and processes data in accordance with internationally recognised principles of data protection, including purpose limitation, data minimisation, storage limitation, accuracy, and confidentiality. Where local data protection laws of Bangladesh apply, 33mbd complies with those obligations in full.

For the purposes of this Privacy Policy, 33mbd acts as the data controller in respect of all personal data collected from Players and visitors of the platform. As data controller, 33mbd determines the purposes and means by which personal data is processed.

All data protection enquiries, requests to exercise data subject rights, and formal complaints relating to the use of personal data should be directed to the 33mbd data protection team via the contact details provided in Section 14 of this policy.

33mbd collects the following categories of personal data in the course of operating the platform. The specific data collected depends on the nature of your interaction with 33mbd:

33mbd does not collect special categories of sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where an identity document submitted during KYC verification incidentally contains such information, in which case that information is not separately processed or stored.

33mbd collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide voluntarily when completing the account registration form, submitting KYC documentation, initiating a deposit or withdrawal, or contacting the support team via live chat or email.
• Automated collection: Technical data is collected automatically when you access the 33mbd platform through standard server logging, session management, and first-party analytics tools. This includes IP addresses, device identifiers, and behavioural data such as page views and click patterns.
• Payment provider data: When you initiate a transaction via an Approved Payment Method such as bKash, Nagad, or Rocket, the payment provider transmits a transaction confirmation reference and status to 33mbd. 33mbd does not receive or store your full mobile banking PIN or password — only the transaction reference and outcome are shared.
• Third-party verification services: Where 33mbd engages third-party identity verification providers to assist with KYC compliance and anti-money-laundering checks, those providers may return verification results and risk signals to 33mbd. Any such provider is contractually bound to process data only for the purposes of that verification service.
• Cookies and similar technologies: First-party cookies and session storage are used to maintain login state, remember user preferences, and gather aggregated analytics. Full details are provided in Section 10 of this policy.

33mbd processes personal data only for specific, explicit, and legitimate purposes. The primary purposes for which your data is used are as follows:

• Account creation and management: To register your account, verify your identity and age, maintain your account profile, and ensure the integrity of the one-account-per-person policy.
• Transaction processing: To process deposits and withdrawals in Bangladeshi Taka (৳) via Approved Payment Methods, maintain accurate financial records, and resolve payment disputes.
• Platform delivery and personalisation: To deliver the betting, casino, slots, and live dealer services you use on the platform, remember your preferences, and optimise your experience on the 33mbd interface.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and any other prohibited conduct as defined in the Terms & Conditions.
• Regulatory compliance: To meet applicable anti-money-laundering (AML) and know-your-customer (KYC) obligations, respond to lawful requests from competent authorities, and maintain records required under applicable law.
• Responsible gaming: To monitor player behaviour for signs of problem gambling, apply player-requested restrictions (deposit limits, cool-off periods, self-exclusion), and fulfil our commitments under the 33mbd Responsible Gaming framework.
• Customer support: To respond to your queries, investigate complaints, and maintain a record of support interactions for quality assurance and dispute resolution purposes.
• Marketing communications: To send you information about promotions, bonuses, and new features on the 33mbd platform, where you have given explicit consent to receive such communications. You may withdraw this consent at any time via your account settings or by contacting support.
• Platform improvement: To conduct aggregated, anonymised analysis of platform usage patterns to improve the user interface, game selection, and overall service quality.

33mbd does not use personal data for automated individual decision-making or profiling that produces legal or similarly significant effects without human review.

Each processing activity conducted by 33mbd is carried out on one or more of the following recognised legal bases:

• Contractual necessity: Processing required to perform the contract between 33mbd and the registered Player — including account creation, transaction processing, and platform delivery — is carried out on the basis that it is necessary for the fulfilment of that contract.
• Legal obligation: Processing necessary for 33mbd to comply with its legal obligations, including AML/KYC verification, record-keeping requirements, and responding to lawful authority requests.
• Legitimate interests: Processing conducted for fraud prevention, security monitoring, platform analytics, and responsible gaming oversight, where 33mbd's legitimate interests in operating a safe and compliant platform are not overridden by the data subject's privacy interests.
• Consent: Processing for marketing communications is conducted solely on the basis of your explicit, freely given, and withdrawable consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before that withdrawal.

33mbd does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own marketing or commercial purposes. Personal data is shared only in the following limited circumstances:

• Payment providers: Transaction data is shared with Approved Payment Methods (bKash, Nagad, Rocket, Upay, Visa, Mastercard, and relevant banks) strictly to the extent necessary to process your deposit or withdrawal. These providers operate under their own privacy policies and are independently regulated financial services entities.
• Identity verification partners: Where third-party KYC or AML screening services are used, the minimum data necessary to conduct a verification check is shared with that provider under a data processing agreement. Verification results are returned to 33mbd and the data is not retained by the provider beyond the period required for the check.
• Game content providers: Game studios and content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session identifiers and stake/result data necessary to operate their games within the 33mbd environment. These providers do not receive your full identity or financial data.
• Legal authorities: 33mbd will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by a lawful order, subpoena, or applicable legal obligation. 33mbd will, where legally permitted, notify the affected Player of any such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the 33mbd business, personal data held by 33mbd may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified prior to any such transfer and before their data becomes subject to a materially different privacy policy.

All third-party processors engaged by 33mbd are bound by contractual data processing agreements that restrict their use of your data to the specific purpose for which it was shared and require them to maintain appropriate security standards.

33mbd retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:

• Active account data: Retained for the duration of your registration with 33mbd plus a minimum of five (5) years following account closure, to meet AML record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with standard anti-money-laundering requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction. Individual transaction records may be retained longer where they are relevant to a pending dispute, investigation, or legal proceeding.
• Support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your opt-in status plus two (2) years after consent withdrawal, as evidence of your prior consent.
• Technical and analytics data: Aggregated and anonymised after thirteen (13) months. Raw session logs may be retained for up to six (6) months for fraud and security analysis before being deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

33mbd applies a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. The principal technical and organisational measures in place include:

• Encryption in transit: All data transmitted between your device and the 33mbd platform is encrypted using TLS 1.3 with AES-256 cipher suites. Older, insecure protocol versions (TLS 1.0, TLS 1.1) are disabled at the server level.
• Encryption at rest: Sensitive personal data and financial records stored in 33mbd's databases are encrypted at rest using AES-256 encryption. Database encryption keys are managed through a dedicated key management system with strict access controls.
• Password security: Account passwords are stored using bcrypt hashing with individual, randomly generated salts. Plain-text passwords are never stored and cannot be retrieved by any member of the 33mbd team. In the event of a credential reset, a new password must be set by the Player through the secure reset flow.
• Access controls: Access to systems containing personal data is restricted to 33mbd personnel with a demonstrable business need. Role-based access controls (RBAC) are enforced, and all privileged access is subject to multi-factor authentication (MFA) and comprehensive audit logging.
• Penetration testing and vulnerability management: The 33mbd platform undergoes regular security assessments, including vulnerability scanning and periodic third-party penetration testing. Critical and high-severity findings are remediated within defined SLA windows.
• Incident response: 33mbd maintains a documented data breach incident response procedure. In the event of a confirmed breach that is likely to result in a risk to the rights and freedoms of Players, affected individuals will be notified without undue delay.

While 33mbd employs comprehensive security measures, no system connected to the internet can guarantee absolute security. Players are reminded to use strong, unique passwords for their 33mbd account and to report any suspected unauthorised access to support immediately.

33mbd uses first-party cookies and browser session storage to support the operation of the platform. No third-party advertising or cross-site tracking cookies are deployed by 33mbd. The cookies used fall into the following categories:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your login session, store your language and display preferences, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core platform functionality.
• Functional cookies: These cookies remember your interface preferences such as your preferred game categories, responsible gaming settings, and notification preferences, so that you do not have to re-enter them on each visit.
• Analytics cookies: First-party analytics cookies collect aggregated, non-identifiable data about how Players navigate and interact with the platform. This data is used exclusively to improve page performance, navigation flows, and game load times. Individual player identifiers are not included in analytics reports.

33mbd does not use pixels, web beacons, or fingerprinting techniques for cross-site tracking. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to log in and use the platform.

As a Player whose personal data is processed by 33mbd, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact the 33mbd data protection team using the contact details in Section 14:

• Right of access: You have the right to request a copy of all personal data held about you by 33mbd, along with information about the purposes of processing, the categories of data held, and the recipients to whom your data has been disclosed.
• Right to rectification: You have the right to request the correction of any inaccurate or incomplete personal data held about you. Where data accuracy affects your account status or a pending transaction, 33mbd will prioritise the correction.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to retention obligations under applicable law — for example, financial transaction records required for AML compliance cannot be deleted before the statutory retention period expires.
• Right to restriction of processing: You may request that 33mbd restricts the processing of your data in certain circumstances, such as during a period in which the accuracy of the data is contested.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing. Where you object to direct marketing, 33mbd will cease that processing immediately and without requiring justification.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

33mbd will respond to all verified data subject requests within 30 calendar days. Where a request is complex or high in volume, this period may be extended by a further 60 days, in which case 33mbd will notify you of the extension and its reason within the initial 30-day window.

The 33mbd platform is strictly restricted to individuals aged 21 years and above. 33mbd does not knowingly collect, process, or retain personal data from any individual under the age of 21.

Age verification is conducted as part of the standard registration and KYC process. Where 33mbd has reasonable grounds to suspect that an account is held by a person under the age of 21, the account will be suspended immediately pending verification. If the account holder is confirmed to be under 21, the account will be permanently closed, all associated balances will be returned to the depositing payment method (net of any withdrawals already processed), and any bonus funds will be voided.

If you believe that a minor has registered an account on the 33mbd platform, please contact the support team immediately at [email protected] so that the matter can be investigated and resolved without delay.

33mbd recommends that parents and guardians use available parental control tools at the device and network level to restrict minors from accessing online gambling platforms. Responsibility for supervising minors' internet use at home rests with the parent or guardian.

33mbd reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, the platform's data processing activities, or its operational practices. When material changes are made to this policy, 33mbd will notify registered Players by email to the address held on file and by displaying a prominent notice within the platform upon login.

The effective date of the current version of this Privacy Policy is stated at the top of the document. Continued use of the 33mbd platform following the effective date of any revised policy constitutes acceptance of that revised version. If you do not agree with an update, you must discontinue use of the platform and contact support to request account closure before the updated policy takes effect.

The most current version of this Privacy Policy is always available at 33mbd.io/privacy-policy. Prior versions may be requested by contacting the support team.

For all privacy-related queries, requests to exercise data subject rights, or complaints regarding the handling of your personal data by 33mbd, please use the following contact details:

If you submit a formal written complaint regarding our data protection practices and you are not satisfied with the resolution provided by 33mbd within the timeframes stated above, you retain the right to escalate your complaint to the relevant data protection authority or regulatory body with jurisdiction over 33mbd's processing activities.

33mbd takes all privacy complaints seriously and is committed to resolving them fairly, transparently, and in a timely manner. We encourage Players to contact us directly in the first instance so that we have the opportunity to address the concern before any external escalation is pursued.