bad33 Privacy Policy — How We Protect Your Data

1 Who We Are

bad33 is an online betting and casino platform accessible at https://bad33.io, offering sports betting — with a particular focus on cricket markets including the Bangladesh Premier League (BPL), IPL, ICC T20 World Cup, and all Bangladesh national team fixtures — alongside live casino, slot games, and other gaming products. bad33 is operated as a safe and reliable platform committed to fair play and player protection, serving the Bangladesh market with 24/7 English-language customer support.

For the purposes of this Privacy Policy, bad33 acts as the data controller in respect of all personal data collected from players and visitors. Our designated data protection contact is reachable at [email protected]. All data protection queries, requests, and complaints should be directed to this address.

2 Data We Collect

bad33 collects the following categories of personal data from players and platform visitors:

2.1 Identity Data

Full legal name, date of birth, gender, and government-issued identification numbers (such as National Identity Card number or passport number) collected during account registration and Know Your Customer (KYC) verification.

2.2 Contact Data

Mobile phone number, email address, and residential address (including district, division, and postcode within Bangladesh). This information is required to create and verify your account, process withdrawals, and communicate with you about your account activity.

2.3 Financial Data

Mobile banking account identifiers associated with bKash, Nagad, Rocket, and Upay; bank account details for players using Dutch-Bangla Bank, City Bank, or BRAC Bank; and transaction records including deposit amounts, withdrawal amounts, dates, and reference numbers. All financial data is expressed in Bangladeshi Taka (BDT). bad33 does not store full payment card numbers or mobile banking PINs.

2.4 Account Activity Data

Betting history, casino game history, wager amounts, win and loss records, bonus usage, session durations, login timestamps, and responsible gaming tool activations (such as deposit limits, cooling-off periods, and self-exclusion requests).

2.5 Technical Data

IP address, device type, operating system, browser type and version, screen resolution, device identifiers, and geolocation data (country and region level only). This data is collected automatically when you access the bad33 platform and is used for security, fraud prevention, and platform optimisation purposes.

2.6 Communications Data

Records of all communications between you and the bad33 support team, including live chat transcripts, email correspondence, and any attachments submitted as part of a KYC or dispute resolution process.

2.7 KYC Documentation

Copies of government-issued identity documents (National Identity Card, passport, driving licence), proof-of-address documents, and selfie photographs submitted for identity verification purposes. These documents are stored securely and are not used for any purpose other than identity verification and regulatory compliance.

3 How We Collect Your Data

bad33 collects personal data through the following channels:

• Direct provision by you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a promotional communication.
• Automated collection — through cookies, web beacons, server logs, and similar tracking technologies that operate automatically when you access the bad33 platform (see Section 7 for full details).
• Third-party sources — from identity verification providers, fraud detection agencies, and payment processing partners who share data with us in the course of processing your transactions or verifying your identity.
• Publicly available sources — in limited circumstances, bad33 may verify information against publicly available databases to confirm the accuracy of the data you have provided.

4 Why We Use Your Data

bad33 uses the personal data it collects for the following specific purposes:

Purpose	Data Categories Used
Account registration and management	Identity, Contact
Identity verification (KYC)	Identity, KYC Documentation
Processing deposits and withdrawals	Financial, Identity
Fraud detection and prevention	Technical, Financial, Account Activity
Anti-money-laundering compliance	Identity, Financial, KYC Documentation
Responsible gaming monitoring	Account Activity, Contact
Customer support and dispute resolution	Identity, Contact, Communications
Platform security and access control	Technical, Identity
Service personalisation and improvement	Account Activity, Technical
Promotional communications (with consent)	Contact, Account Activity

bad33 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

5 Legal Basis for Processing

bad33 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil the agreement between you and bad33, including account management, payment processing, and game operation.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering regulations, identity verification obligations, and responsible gaming requirements.
• Legitimate interests: Processing necessary for bad33's legitimate business interests — such as fraud prevention, platform security, and service improvement — provided those interests are not overridden by your privacy rights.
• Consent: Processing for purposes such as promotional communications, where we rely on your explicit, freely given, informed, and revocable consent. You may withdraw consent for marketing communications at any time by contacting [email protected].

6 Data Sharing and Disclosure

6.1 Service Providers

bad33 shares personal data with carefully selected third-party service providers who assist in the operation of the platform. These include identity verification and KYC providers, payment processing partners (including mobile financial service operators such as bKash, Nagad, Rocket, and Upay), fraud detection and risk management providers, customer support platform providers, and cloud infrastructure and data hosting providers. All third-party service providers are contractually bound to process your data exclusively for the purposes instructed by bad33 and to apply data security standards equivalent to those set out in this Privacy Policy.

6.2 Legal and Regulatory Disclosure

bad33 may disclose personal data to competent authorities, law enforcement bodies, regulators, or courts where required to do so by applicable law, court order, or regulatory directive. bad33 will, where legally permitted, notify the affected player of any such disclosure.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of bad33's business, personal data held by bad33 may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer that materially affects their privacy rights, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

6.4 No Sale of Data

bad33 does not sell, rent, lease, or otherwise commercially exploit your personal data to third parties for their own marketing or commercial purposes. This prohibition is absolute and applies without exception.

7 Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. bad33 uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the platform, maintain your login session, detect fraud, and understand how players interact with the site in order to improve the user experience.

7.2 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in while you navigate between pages. These cookies cannot be disabled without preventing you from using the platform.
• Functional Cookies: Used to remember your preferences, such as your preferred language setting, display options, and responsible gaming tool configurations. Disabling these may reduce the quality of your experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the platform — for example, which game categories are most visited, average session duration, and device types. This data helps bad33 improve its services.
• Security Cookies: Used by bad33's fraud detection systems to identify unusual access patterns and protect accounts from unauthorised access.

7.3 Cookie Management

You can control cookie settings through your web browser's privacy preferences. Most modern browsers allow you to block, delete, or restrict cookies. However, please note that disabling strictly necessary cookies will prevent you from accessing your bad33 account and using the platform's core functions. bad33 does not use third-party advertising cookies and does not participate in cross-site behavioural advertising networks.

8 Data Security

bad33 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the bad33 platform.
• Encrypted storage of sensitive data, including KYC documentation and financial records, in access-controlled server environments.
• Strict role-based access controls ensuring that bad33 staff can only access personal data on a need-to-know basis relevant to their specific job function.
• Automated anomaly detection and intrusion prevention systems monitoring the platform 24 hours a day, 7 days a week.
• Regular security audits and vulnerability assessments conducted by qualified information security professionals.
• Staff training on data protection obligations and secure data handling practices.

While bad33 employs industry-best-practice security measures, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your own account credentials. If you suspect that your bad33 account has been compromised, contact [email protected] immediately.

9 Data Retention

bad33 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data and KYC documentation: Retained for a minimum of five (5) years following permanent account closure, in compliance with anti-money-laundering and financial record-keeping obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Responsible gaming records (including self-exclusion requests and deposit limit settings): Retained for the duration of the self-exclusion or restriction period plus five (5) years thereafter.
• Communications records (support tickets, live chat transcripts): Retained for three (3) years from the date of each communication.
• Technical and session data (IP logs, device logs): Retained for twelve (12) months from collection date.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual. Where anonymised data is retained for statistical or analytical purposes, it no longer constitutes personal data and falls outside the scope of this Privacy Policy.

10 Your Data Rights

As a bad33 player, you have the following rights in relation to your personal data. To exercise any of these rights, contact our data protection team at [email protected] with the subject line "Data Rights Request" and your registered account username.

• Right of Access: You have the right to request a copy of the personal data bad33 holds about you. We will provide this within 30 days of receiving a valid request.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to bad33's legal retention obligations (see Section 9).
• Right to Restriction: You have the right to request that bad33 restricts the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to bad33 in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where bad33 relies on its legitimate interests as the legal basis for processing. You also have an absolute right to object to the use of your personal data for direct marketing at any time.
• Right to Withdraw Consent: Where bad33 processes your data on the basis of your consent (for example, for promotional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

bad33 will respond to all data rights requests within 48 hours of receipt and will fulfil requests within the timeframes prescribed above. Where a request is complex or numerous, we may extend the fulfilment period by a further 30 days, in which case we will notify you of the extension and the reason for it.

11 Children's Privacy

bad33 is strictly a 21+ platform. The bad33 Services are not directed at, and are not intended to be used by, any person under the age of 21. bad33 does not knowingly collect personal data from individuals under 21 years of age. If bad33 discovers that personal data has been collected from a person under 21, that account will be immediately closed, all associated funds will be subject to a compliance review, and the personal data will be securely deleted as soon as it is no longer required for investigative purposes.

If you believe that a person under 21 has opened an account on bad33, please report this immediately to [email protected]. bad33 takes underage gambling with the utmost seriousness and will act promptly on any such report.

12 Third-Party Links

The bad33 platform may contain references to third-party game providers, payment partners, or other services. While bad33 takes care in selecting its partners, this Privacy Policy applies exclusively to personal data processed by bad33 itself. bad33 is not responsible for the privacy practices of third-party providers, and we encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the bad33 platform.

13 Changes to This Privacy Policy

bad33 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, bad33 will update the effective date displayed at the top of this document and will, where reasonably practicable, notify active players of the change via the email address registered to their account or via an on-platform notification.

Your continued use of the bad33 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Privacy Policy, you must cease using the platform and may request account closure by contacting our English-language support team. We recommend reviewing this Privacy Policy periodically to stay informed of how bad33 protects your data.

14 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or about how bad33 handles your personal data, please contact our data protection team using the details below:

• Email: [email protected]
• Subject Line: Privacy Policy Enquiry / Data Rights Request
• Support Hours: 24 hours a day, 7 days a week, 365 days a year
• Language: English
• Response Time: Within 48 hours for all privacy and data rights matters

All privacy correspondence should include your registered bad33 username and a brief description of your query or request so that our team can locate your account and respond as efficiently as possible. bad33 is committed to handling all privacy matters fairly, transparently, and in full respect of your rights as a player.