Privacy Policy — How 25bd9 Protects Your Data

25bd9 ("the Platform", "we", "us", "our") operates the online betting and casino platform accessible at https://25bd9.io and any associated subdomains or mobile-optimised versions thereof (collectively, "the Service"). 25bd9 is the data controller responsible for the personal information collected through the Service.

For all privacy-related enquiries, including data access requests, correction requests, or deletion requests, you may contact our designated privacy team at [email protected]. We aim to respond to all privacy correspondence within 30 calendar days of receipt.

25bd9 serves a primarily Bangladesh-based audience and operates with a strong commitment to the responsible handling of personal data belonging to players in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and across the country.

25bd9 collects personal data in the following categories. We collect only the minimum data necessary to deliver, secure, and improve the Service.

25bd9 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. If any such data is inadvertently provided (for example, in a document submitted for identity verification), it will not be used for any purpose other than verifying the document's authenticity.

25bd9 collects personal data through the following channels:

• Direct interactions: When you register an account, complete your profile, submit KYC documents, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion;
• Automated technologies: As you interact with our platform, we automatically collect Technical Data and Usage Data via cookies, server logs, pixel tags, and similar tracking technologies (see Section 9 for full details on cookies);
• Payment providers: When you transact via bKash, Nagad, Rocket, Upay, or a bank partner, that provider may share transaction confirmation data with us to reconcile your account;
• Identity verification services: Where we engage a third-party KYC provider to assist with document verification, that provider may share verification outcome data with us;
• Fraud prevention partners: We may receive data from fraud-detection services about IP reputation, device fingerprinting signals, and behavioural risk indicators to protect all users on the platform.

25bd9 uses your personal data for the following specific purposes:

25bd9 does not use personal data for any purpose not listed above without first seeking your explicit consent. Where we wish to use your data for a new purpose, we will update this Privacy Policy and notify you prior to commencing that new use.

25bd9 processes your personal data on one or more of the following legal bases depending on the specific processing activity:

• Contractual necessity: Processing your data is necessary to perform the contract we have with you — that is, to operate your 25bd9 account, process your bets and casino wagers, and handle your deposits and withdrawals;
• Legal obligation: We are required to process certain data (particularly identity and financial data) to comply with anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and other applicable regulatory duties;
• Legitimate interests: We process Technical and Usage Data to prevent fraud, secure the platform, improve user experience, and conduct analytics. We have assessed that these legitimate interests are not overridden by your privacy rights;
• Consent: Where we send you marketing communications or use non-essential cookies, we do so on the basis of your explicit consent. You may withdraw consent at any time by contacting [email protected] or adjusting your cookie preferences.

25bd9 does not sell your personal data. We may share your data with carefully selected third parties only in the following circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Islami Bank, City Bank, Sonali Bank, Visa, and Mastercard receive the minimum financial data necessary to process your transactions;
• KYC / identity verification providers: Where we use a third-party service to assist with document verification, that provider receives the verification documents you submit and returns a verification outcome to us;
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi receive your account session identifier and stake data to operate their games within the 25bd9 platform. These studios operate under strict data processing agreements with 25bd9;
• Fraud prevention and security vendors: We share hashed Technical Data with fraud-prevention partners to detect and block malicious activity across the platform;
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so or where disclosure is necessary to protect the safety of users or the integrity of the platform;
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 25bd9's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights under this policy will continue to apply.

All third parties with whom 25bd9 shares personal data are required to maintain appropriate technical and organisational security measures and to process the data only for the purposes for which it was shared.

25bd9 operates globally and some of our service providers are located outside Bangladesh. Where personal data is transferred to a country that may not provide the same level of data protection as Bangladesh, 25bd9 ensures appropriate safeguards are in place, including:

• Standard contractual clauses requiring the recipient to protect your data to an equivalent standard;
• Data processing agreements with all third-party processors that include obligations around cross-border data transfers;
• Restricting the scope of data transferred to only what is strictly necessary for the specific processing purpose.

By using the 25bd9 platform, you acknowledge that your data may be processed in countries outside Bangladesh. If you have concerns about specific international transfers, you may contact us at [email protected].

25bd9 retains your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted or irreversibly anonymised so that it can no longer be linked to you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes.

25bd9 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and analyse how users interact with our Service. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These enable your login session, maintain your account balance display, and remember your language and currency preferences. These cookies cannot be disabled without disrupting the Service;
• Functional Cookies: Remember choices you make such as game preferences, notification settings, and responsible gaming tool configurations. Disabling these cookies may affect personalisation features;
• Analytics Cookies: Used to collect anonymised data about how visitors navigate the 25bd9 platform — pages visited, time spent, click paths, and error events. This data helps us improve the Service. We use privacy-conscious analytics tools that do not share your data with third-party advertising networks;
• Security Cookies: Support our fraud detection and account security systems by tracking unusual access patterns and flagging suspicious login attempts.

As a 25bd9 user, you have the following rights in respect of your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.

• Right to Access: Request a copy of the personal data 25bd9 holds about you, along with information about how it is being used;
• Right to Rectification: Request correction of any inaccurate or incomplete personal data held about you;
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling reason for its continued processing. Note that regulatory retention obligations (see Section 8) may prevent deletion of certain data categories;
• Right to Restriction: Request that we temporarily suspend processing of your personal data while a dispute about its accuracy or legality is resolved;
• Right to Data Portability: Receive a copy of your personal data in a structured, machine-readable format so that it can be transferred to another service provider;
• Right to Object: Object to processing of your personal data based on our legitimate interests, including direct marketing communications;
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

25bd9 will not charge a fee for handling data rights requests unless requests are manifestly unfounded, repetitive, or excessive. In such cases we reserve the right to charge a reasonable administrative fee or decline the request, with written explanation.

The 25bd9 platform is strictly intended for adults. You must be at least 21 years of age to register and use the Service. 25bd9 does not knowingly collect personal data from any person under the age of 21.

If 25bd9 discovers or is informed that personal data has been collected from an individual under the age of 21, we will immediately close the relevant account, delete the personal data concerned, and — where applicable — return any funds in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a person under your care has provided personal data to 25bd9 without your knowledge, please contact us immediately at [email protected]. We treat all such reports with the utmost seriousness and will respond within 48 hours.

25bd9 implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• Encryption in transit: All data exchanged between your browser or app and our servers is encrypted using 256-bit SSL/TLS protocols;
• Encryption at rest: Sensitive data stored on our servers, including identity documents and financial records, is encrypted using AES-256 encryption;
• Access controls: Personal data is accessible only to 25bd9 personnel and authorised processors who have a demonstrable need to access it for legitimate business purposes. Access is governed by role-based permissions and audit logging;
• Intrusion detection: Our infrastructure is monitored 24/7 by automated intrusion detection systems that flag and quarantine suspicious activity in real time;
• Penet ration testing: We conduct regular security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited;
• Two-factor authentication: 25bd9 supports and encourages the use of two-factor authentication (2FA) on all player accounts to add an additional layer of login security beyond your password;
• Staff training: All 25bd9 personnel who handle personal data receive regular data protection training to ensure they understand their obligations and handle your information responsibly.

The 25bd9 platform may, from time to time, contain references to third-party services such as payment providers or game studios. These third parties operate their own websites and privacy policies, which are entirely independent of 25bd9's Privacy Policy.

25bd9 has no control over, and accepts no responsibility for, the privacy practices or content of third-party websites or services. We strongly encourage you to review the privacy policy of any third-party service before providing them with your personal data.

The inclusion of a reference or link to a third-party service within the 25bd9 platform does not constitute an endorsement of that party's privacy practices by 25bd9.

25bd9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, new regulatory requirements, or enhancements to the Service. The most current version of this Privacy Policy will always be accessible at https://25bd9.io/privacy-policy.

Where changes are material — meaning they significantly affect your rights or how we use your data — 25bd9 will notify you by email to the address registered on your account at least 14 days before the updated policy takes effect. Continued use of the Service after the effective date of the updated policy constitutes acceptance of the revised terms.

We recommend reviewing this Privacy Policy periodically, particularly before making a deposit or submitting new personal documents, to ensure you are always informed about how your data is being handled.

If you have any questions, concerns, or requests relating to this Privacy Policy or 25bd9's data practices, please reach out to our privacy team using the contact details below. All privacy correspondence is treated with strict confidentiality.

25bd9 is committed to resolving all privacy concerns fairly and transparently. If you remain unsatisfied with our response, you may escalate the matter to the relevant data protection authority in your jurisdiction.