35bdt Privacy
Policy

This Privacy Policy ("Policy") describes how 35bdt ("we", "us", "our") collects, uses, stores, and shares personal data from individuals ("you", "your", "user") who access or use the 35bdt online betting and gaming platform, including its website, mobile-optimised interface, and any associated services (collectively, the "Platform").

35bdt is committed to protecting the privacy and personal data of all users, with particular regard to the rights and expectations of players based in Bangladesh. We process personal data in a lawful, fair, and transparent manner, and only for purposes that are clearly defined in this Policy.

By registering an account on 35bdt, making a deposit, placing a bet, or using any feature of the Platform, you acknowledge that you have read, understood, and agreed to the collection and use of your personal data as described in this Privacy Policy. This Policy is to be read alongside the 35bdt Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

Effective Date: This Policy is effective from January 2026. The "Last Updated" date will be revised each time a material change is made. It is your responsibility to review this Policy periodically to remain informed of any updates.

35bdt collects personal data from users through several channels: directly during account registration and use of the Platform, automatically through technical systems when you browse or interact with the Platform, and from trusted third-party partners such as payment processors and KYC verification providers. The categories of personal data we collect are described below.

2.1 Registration & Account Data

• Full legal name — as it appears on your government-issued identity document.
• Date of birth — used to verify that you meet the 21+ age requirement for use of the Platform.
• Residential address — your current address in Bangladesh (city, district, and postal area).
• Mobile number — your registered Bangladeshi mobile number, used for account verification, OTP delivery, and support contact.
• Email address — used for transactional communications, security alerts, and optional promotional messages.
• Username and password — your chosen account credentials (passwords are stored in hashed, non-reversible form).

2.2 Identity Verification (KYC) Data

• Copy of National Identity Card (NID), passport, or other government-issued photo ID.
• Proof of address document (where requested), such as a utility bill or bank statement dated within 90 days.
• Proof of payment method (where requested), such as a screenshot of your bKash or Nagad account confirming ownership.
• Selfie or liveness check image (where required) to match against photo ID.

2.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and transaction reference numbers.
• Payment method identifiers (e.g., bKash wallet number, Nagad number, Rocket account, Visa/Mastercard last four digits) — full card or account numbers are never stored by 35bdt.
• Transaction history, including wins, losses, and bonus credits.

2.4 Betting & Gaming Activity Data

• Bet placement records including market, stake, odds, and outcome.
• Casino game session data including game title, session duration, and results.
• Responsible gaming tool settings you configure on your account (e.g., deposit limits, self-exclusion periods).

2.5 Technical & Device Data

• IP address at the time of login and bet placement.
• Device type, operating system, and browser type and version.
• Session timestamps and duration.
• Pages visited and features used within the Platform.
• Cookies and similar tracking technologies (see Section 6 — Cookies & Tracking).

2.6 Communications Data

• Records of live chat conversations with 35bdt support agents.
• Email correspondence sent to or received from [email protected].
• Any feedback, complaints, or dispute records submitted through the Platform.

35bdt does not knowingly collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes) unless this is strictly required for responsible gaming compliance or fraud prevention, in which case it will only be processed with your explicit consent or as required by law.

35bdt uses the personal data it collects for the specific, legitimate purposes described below. We do not use your data for purposes that are incompatible with those stated at the time of collection.

You may opt out of promotional communications at any time by contacting 35bdt support at [email protected]. Opting out of marketing will not affect transactional or security-related communications, which are necessary for the operation of your account.

35bdt processes personal data on the following legal bases:

• Contractual necessity: Processing required to create and manage your account, verify your identity, process payments, and deliver the core services of the Platform in accordance with the Terms & Conditions you agreed to at registration.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, age verification requirements, and record-keeping duties.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where these interests are not overridden by your rights and freedoms.
• Consent: Processing for optional marketing communications and non-essential cookies, where we have obtained your explicit and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Where we rely on legitimate interests as the legal basis for processing, we conduct a balancing assessment to ensure that our interests do not override your fundamental rights or cause undue harm to you as a data subject.

35bdt does not sell, rent, or otherwise trade your personal data to third parties for their own commercial use. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank, BRAC Bank, and other supported payment providers receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and are bound by financial data protection obligations.
• KYC and identity verification partners: Where we use a licensed third-party KYC provider to verify your identity, we share the relevant identity documents and data solely for that purpose. KYC partners are contractually bound to process data only on our instructions and not to retain data beyond the verification process.
• Game content providers: Third-party game providers including Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming may receive session identifiers and game activity data necessary for the delivery of their games within the 35bdt Platform. They do not receive your full personal profile.
• IT and hosting infrastructure providers: Our technology partners who host and maintain the Platform may have access to personal data as part of their service delivery. These partners are bound by strict data processing agreements and may not use your data for their own purposes.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so — for example, in connection with an anti-money laundering investigation or a court order. We will only disclose the minimum data required to satisfy the legal obligation.
• Business transfers: In the event of a merger, acquisition, or sale of assets involving 35bdt, personal data held by 35bdt may be transferred to the acquiring entity, subject to equivalent privacy protections being applied. Users will be notified of any such transfer in advance where possible.

All third parties with whom 35bdt shares personal data are required by contract to maintain appropriate security standards and to use your data only for the purposes described above. 35bdt remains responsible for ensuring that such sharing is lawful and proportionate.

35bdt uses cookies and similar tracking technologies to operate the Platform effectively, improve user experience, and gather aggregate analytics about how the Platform is used. Cookies are small text files stored on your device when you visit the Platform.

We use the following categories of cookies:

• Strictly necessary cookies: These are essential for the Platform to function. They maintain your login session, remember your preferences, and ensure that security features operate correctly. These cookies cannot be disabled without preventing core Platform functionality from working.
• Analytics cookies: These help us understand how users interact with the Platform — for example, which pages are most visited, how long sessions last, and where users encounter difficulty. Analytics data is aggregated and anonymised where possible. We use this information to improve the Platform for all users.
• Functional cookies: These remember your preferences (such as your preferred language or display settings) to personalise your experience on subsequent visits.

35bdt does not use third-party advertising cookies or behavioural profiling cookies that track you across external websites. You can control cookie behaviour through your browser settings. Disabling strictly necessary cookies will affect the Platform's ability to function correctly, including the ability to stay logged in.

35bdt retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status plus a period of five (5) years following account closure, to satisfy legal and audit obligations.
• KYC documentation: Retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years following the date of the transaction.
• Customer support communications: Retained for three (3) years from the date of the last interaction, or longer if the communication relates to an ongoing dispute.
• Betting and gaming activity logs: Retained for five (5) years for regulatory compliance and responsible gaming monitoring purposes.
• Technical and device data (logs): Retained for twelve (12) months from the date of collection, after which they are deleted or anonymised.
• Marketing consent records: Retained for the duration of your consent plus three (3) years following withdrawal of consent, as evidence of compliance.

Where personal data is no longer required for any lawful purpose, 35bdt will securely delete or anonymise it. Deletion requests submitted by users will be assessed against applicable legal retention obligations, and data that must be retained by law will not be deleted until the mandatory retention period has expired.

35bdt implements a comprehensive set of technical and organisational security measures designed to protect your personal data from unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform.
• Encrypted data storage for sensitive fields including passwords (stored as salted hashes), payment method identifiers, and KYC documents.
• Role-based access controls (RBAC) ensuring that only authorised 35bdt personnel can access personal data, and only to the extent required for their specific role.
• Multi-factor authentication (MFA) for internal administrative access to systems that hold personal data.
• Regular security assessments including vulnerability scanning and penetration testing of the Platform infrastructure.
• Incident response procedures that define how 35bdt identifies, contains, and reports data security incidents in a timely manner.
• Staff training — all 35bdt personnel who handle personal data receive regular data protection and security awareness training.

While 35bdt takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You also have a role in keeping your data safe: use a strong, unique password for your 35bdt account, do not share your login credentials or OTP codes with anyone, and contact 35bdt support immediately if you suspect unauthorised access to your account.

As a user of the 35bdt Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact the 35bdt data team via live chat or at [email protected]. We will respond to all data rights requests within 30 days of receipt.

35bdt will not charge a fee for processing data rights requests except in cases of manifestly unfounded or excessive requests, where a reasonable administrative fee may apply. We may request proof of your identity before processing a request to ensure that personal data is not disclosed to an unauthorised party.

The 35bdt Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from anyone under the age of 21. If 35bdt becomes aware that personal data has been collected from a person under 21 without verified parental or guardian consent, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and you believe that your child under 21 has provided personal data to 35bdt, please contact us immediately at [email protected] and we will act without delay. 35bdt enforces a strict 21+ only policy across all markets it serves, including Bangladesh.

The 35bdt Platform may contain references to third-party services such as payment providers (bKash, Nagad, Rocket, Upay) and game content studios (Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, Microgaming). Where links to external websites exist, please be aware that 35bdt has no control over the content or privacy practices of those external sites.

This Privacy Policy applies solely to data processed by 35bdt through its own Platform. Once you navigate away from 35bdt to a third-party website or service, that third party's own privacy policy governs the collection and use of your data. We strongly encourage you to review the privacy policy of any third-party service you interact with, particularly in connection with payment processing.

35bdt is not responsible for the privacy practices, security standards, or content of any third-party website, platform, or service — even where those services are integrated into or referenced from the 35bdt Platform.

35bdt reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the Platform. When we make material changes to this Policy, we will notify registered users by email and/or by posting a prominent notice on the Platform prior to the change becoming effective.

The "Effective Date" at the top of this Policy will be updated each time a new version is published. The most current version of this Policy is always available at https://35bdt.io/privacy-policy. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of those changes.

If you do not agree with any changes to this Privacy Policy, you should stop using the Platform and may request closure of your account by contacting 35bdt support. Outstanding balances will be settled in accordance with the Terms & Conditions prior to account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 35bdt handles your personal data, please contact our data protection team through any of the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line so your message is routed to the correct team.
• Live Chat: Available 24/7 directly on the 35bdt Platform. Our support agents can handle general privacy enquiries and escalate formal data rights requests to the data team.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 calendar days of receipt. Complex requests may require additional time, in which case we will notify you.
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6).