bbk33 Privacy Policy — How We Handle Your Data

This Privacy Policy ("Policy") is published by bbk33 ("the Company", "we", "us", "our") and applies to all personal data collected, processed, stored, and transferred in connection with the bbk33 platform at bbk33.io (the "Platform"), including the website, any mobile-optimised interfaces, customer support channels, and all associated services offered to registered players.

By registering an account, accessing the Platform, or otherwise engaging with bbk33's services, you ("the Player", "you", "your") acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. Where consent is the legal basis for a specific processing activity, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

This Policy should be read alongside the bbk33 Terms & Conditions and the Responsible Gaming policy, both of which form part of the overall agreement between you and bbk33.

bbk33 is the data controller responsible for the personal data of players who use the Platform. As data controller, bbk33 determines the purposes and means by which personal data is processed. All data subject rights requests and privacy-related inquiries should be directed to bbk33 using the contact details provided in Section 15 of this Policy.

Where bbk33 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, or fraud detection platforms — those third parties act as data processors under contractual obligations that require them to process data only on bbk33's documented instructions and to maintain appropriate technical and organisational security measures.

bbk33 collects the following categories of personal data from players, depending on the stage of the account lifecycle and the services used:

bbk33 collects personal data through the following means:

• Direct provision by the Player: Data you enter when registering an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or participating in any promotion or survey.
• Automated technical collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser characteristics, and session logs, via server logs, cookies, and similar tracking technologies as described in Section 8.
• Payment providers: Confirmation data from bKash, Nagad, Rocket, Upay, and bank transfer partners confirming the status of deposit and withdrawal transactions. bbk33 does not receive your full mobile banking PIN or password from these providers.
• Identity verification partners: Results and risk scores from third-party KYC and fraud screening services engaged to verify the authenticity of documents and the identity of players during the verification process.
• Publicly available sources: In limited circumstances, bbk33 may cross-reference information against publicly available records or databases for the purposes of fraud prevention and anti-money laundering compliance.

bbk33 processes personal data under the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract with you — including account registration, payment processing, game delivery, and customer support.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering obligations, age verification requirements, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing necessary for bbk33's legitimate business interests, including fraud prevention, platform security, abuse detection, and service improvement, provided those interests are not overridden by your privacy rights.
• Consent: Processing based on your explicit consent, such as the receipt of marketing communications. Where consent is the legal basis, you may withdraw it at any time by contacting [email protected] or updating your account communication preferences.

bbk33 uses the personal data it collects for the following specific purposes:

• To create, manage, and maintain your bbk33 player account.
• To verify your identity and confirm that you meet the minimum age requirement of 21 years.
• To process deposits and withdrawals in Bangladeshi Taka (৳ BDT) via your nominated payment method.
• To deliver the games, sports betting markets, and other Platform services you request.
• To administer bonuses, promotions, and loyalty rewards in accordance with their applicable terms.
• To detect, investigate, and prevent fraud, collusion, money laundering, and other prohibited activities as defined in the bbk33 Terms & Conditions.
• To comply with anti-money laundering obligations, including transaction monitoring and suspicious activity reporting where legally required.
• To provide customer support and resolve disputes, complaints, and account queries.
• To send you transactional notifications relating to your account, deposits, withdrawals, and security events (these communications are non-optional as they are essential to account management).
• To send you optional marketing communications about promotions and new features — only where you have provided explicit consent and only to the extent you have not opted out.
• To analyse aggregated, anonymised usage data to improve Platform performance, user experience, and game offerings.
• To enforce the bbk33 Terms & Conditions and to protect the rights, property, and safety of bbk33, its players, and the public.

bbk33 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited circumstances:

• Payment service providers: bKash, Nagad, Rocket, Upay, and participating banks receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are subject to their respective regulatory frameworks.
• Identity verification and KYC providers: Third-party services engaged to validate identity documents and screen against sanctions or politically exposed persons (PEP) databases receive the identity data necessary to complete verification. These providers are contractually bound to use your data solely for verification purposes.
• Fraud prevention and security services: Specialist providers who assist bbk33 in detecting fraudulent transactions, account takeovers, and other security threats receive technical and transactional data as necessary for this purpose.
• Game and technology providers: Third-party game studios (such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe) may receive technical session data necessary for game delivery and the resolution of disputed game rounds. These providers do not receive your identity or financial data.
• Legal and regulatory authorities: bbk33 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where it is legally required to do so, or where disclosure is necessary to protect the safety of persons or to prevent or detect criminal activity.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of bbk33's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party data processors engaged by bbk33 are required to enter into data processing agreements that impose obligations consistent with this Policy and require the implementation of appropriate technical and organisational security measures.

bbk33 uses cookies and similar tracking technologies on the Platform to support essential functionality, improve performance, and — where you have provided consent — to deliver relevant content. The categories of cookies used are as follows:

You may manage optional cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. bbk33 does not use third-party advertising cookies or cross-site tracking technologies.

bbk33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and bbk33 servers.
• AES-256 encryption at rest for all stored personal and financial data.
• Role-based access controls ensuring that internal access to personal data is restricted to authorised personnel on a documented need-to-know basis.
• Multi-factor authentication for all bbk33 internal system access and available as an optional security feature for player accounts.
• Intrusion detection and prevention systems (IDS/IPS) monitoring the Platform infrastructure continuously for anomalous activity.
• Regular penetration testing and security audits conducted by independent security professionals to identify and remediate vulnerabilities.
• Incident response procedures to detect, contain, and notify affected parties in the event of a personal data breach, in accordance with applicable obligations.

bbk33 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any overriding legal, regulatory, or compliance obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with bbk33's data disposal procedures.

As a player whose personal data is processed by bbk33, you hold the following rights with respect to your data:

• Right of Access: You have the right to request a copy of the personal data bbk33 holds about you, together with information about how it is being used.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data is corrected without undue delay.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes it was collected, or where you withdraw consent and no other legal basis for processing applies. This right is subject to retention obligations described in Section 10.
• Right to Restriction of Processing: You have the right to request that bbk33 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, and to opt out of direct marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, submit a written request to [email protected]. bbk33 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. In complex cases, the response period may be extended by a further 30 days, in which case bbk33 will notify you of the extension and the reasons for it.

The bbk33 Platform is strictly restricted to individuals aged 21 years and above. bbk33 does not knowingly collect personal data from any person under the age of 21. The Platform employs age verification procedures at the point of registration and during the KYC process to confirm eligibility.

If bbk33 discovers or is notified that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended, all associated data will be reviewed, and any data held in relation to that individual will be deleted in accordance with applicable obligations. If you have reason to believe that a minor has registered an account on bbk33, please contact [email protected] immediately.

bbk33 primarily processes and stores player data within secure infrastructure. In certain circumstances, personal data may be transferred to or accessed by third-party service providers whose operations are based outside Bangladesh — for example, game technology providers, cloud infrastructure partners, or identity verification services. Where such transfers occur, bbk33 takes appropriate steps to ensure that your data receives an equivalent level of protection, including through:

• Contractual data processing agreements that impose obligations consistent with this Policy.
• Technical controls — including encryption in transit and at rest — applied uniformly regardless of the geographic location of data processing.
• Due diligence assessments of third-party providers to confirm that their security and privacy practices meet bbk33's standards prior to engagement.

By using the bbk33 Platform, you acknowledge that your personal data may be transferred and processed in locations outside your country of residence as described in this section, subject to the protections described above.

bbk33 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — affecting the categories of data collected, the purposes for which data is used, or the rights available to players — bbk33 will provide advance notice to registered players via the email address on file no less than 7 days before the amended Policy takes effect.

Non-material changes, such as typographical corrections, clarifications of existing practices, or structural reorganisation that does not alter the substance of the Policy, may be applied immediately upon publication. The effective date shown in the hero section of this page will be updated accordingly on every revision.

Your continued use of the bbk33 Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not accept the amended Policy, you should cease using the Platform and may request account closure as described in the bbk33 Terms & Conditions.

For any queries, concerns, or formal requests relating to this Privacy Policy or the personal data bbk33 holds about you, please contact the bbk33 privacy team using the details below. All communications must be in English.

Privacy and Data Requests: [email protected]

Please include "Privacy Request" in the subject line of your email and provide your registered username, the nature of your request (e.g., access, rectification, erasure), and any relevant details that will assist bbk33 in locating and processing your request efficiently.

• Acknowledgement: Within 5 business days of receipt.
• Substantive response: Within 30 calendar days of receipt (extendable to 60 days for complex requests).
• Data subject access request delivery format: Secure email attachment or account portal download, in PDF or CSV format as appropriate.