Privacy Policy — How 366bd Collects, Uses, and Protects Your Data

Introduction

This Privacy Policy describes how 366bd (referred to in this document as "366bd", "we", "us", or "our") handles the personal information of users (referred to as "you", "your", or "Player") who access and use the 366bd online betting and casino platform, including its website at 366bd.io and any associated mobile-optimised interfaces.

366bd is committed to protecting the privacy of all individuals who interact with its platform. We recognise that the personal information you share with us is provided in a context of trust, and we take that responsibility seriously. This Policy sets out, in plain and accessible English, the categories of data we collect, the purposes for which we use it, the safeguards we apply to protect it, and the rights available to you as a data subject.

This Privacy Policy should be read alongside the 366bd Terms & Conditions, which govern your use of the platform more broadly. By registering an account on 366bd, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

If you do not agree with any aspect of this Privacy Policy, you should not create or continue to use a 366bd account. You may request account closure at any time by contacting [email protected].

Data We Collect

366bd collects personal data across several categories. The scope of data collected depends on the nature of your interaction with the platform — browsing without an account results in minimal data collection, while operating a registered account involves a broader set of information necessary for regulatory compliance and service delivery.

We do not collect special category data (such as biometric data, health records, or political opinions) and have no legitimate reason to do so in the context of operating an online betting platform.

How We Collect Data

366bd collects personal data through the following mechanisms:

• Direct submission: Information you provide when registering an account, completing identity verification, contacting support, or participating in promotions. This is the primary source of your identity and contact data.
• Automated collection: Technical and usage data collected automatically when you browse or interact with the 366bd platform, including through cookies, server logs, and similar tracking technologies. See Section 7 for full details on cookies.
• Payment processors: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or any other supported payment method, the relevant payment provider shares transaction confirmation data with 366bd to reconcile your account balance.
• Identity verification partners: Where 366bd uses a third-party KYC service to verify your identity documents, that service returns a verification status and confidence score to 366bd. We do not store raw biometric data from these checks.
• Game data providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may return session-level data (e.g., round outcome, session duration, stake amounts) to 366bd for the purposes of account crediting, RTP auditing, and responsible gaming monitoring.
• Device and browser signals: Standard HTTP headers, JavaScript environment properties, and device fingerprinting signals are collected passively to support fraud detection and multi-account prevention systems.

How We Use Your Data

366bd uses personal data collected from players for the following defined purposes only. We do not use your data for any purpose not listed here without first obtaining your explicit consent:

• Account creation and management: To register your account, maintain your profile, process your settings preferences, and provide you with access to the 366bd platform.
• Identity and age verification: To confirm that you are who you say you are and that you meet the minimum age requirement of 21 years. This is a legal and operational obligation — no account may be activated without successful identity verification.
• Payment processing: To facilitate deposits and withdrawals via your registered payment method (bKash, Nagad, Rocket, Upay, bank transfer, or other supported channels), and to maintain accurate financial records associated with your account.
• Customer support: To respond to your enquiries, process complaints, resolve disputes, and provide technical assistance. Support communications may be retained for quality assurance and compliance purposes.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, identity theft, and other forms of platform abuse. This includes automated rule-based screening and human review of flagged accounts.
• Responsible gaming: To monitor player behaviour for signs of problem gambling, enforce self-exclusion and cooling-off restrictions, apply deposit limits, and generate alerts for accounts that may be at risk.
• Legal and regulatory compliance: To maintain records required under applicable financial and gaming regulations, respond to lawful requests from authorities, and enforce our Terms & Conditions.
• Platform improvement: To analyse aggregated usage data, identify technical issues, and make informed decisions about product development. Analytics data used for this purpose is anonymised or pseudonymised wherever possible.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have opted in to receive such communications. You may withdraw marketing consent at any time via your account settings or by contacting [email protected].

Legal Basis for Processing

Every data processing activity carried out by 366bd is grounded in one or more of the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the account agreement with you — including account management, payment processing, and game operation — is carried out on the basis that it is necessary to perform the contract between 366bd and you.
• Legal obligation: Certain processing activities — including identity verification, transaction record-keeping, and reporting obligations — are carried out to comply with applicable law. We have no discretion to omit these activities regardless of your preferences.
• Legitimate interests: Fraud prevention, platform security, responsible gaming monitoring, and product analytics are carried out on the basis of 366bd's legitimate interest in operating a safe, sustainable, and compliant platform. We apply a balancing test before relying on this basis and do not override your fundamental privacy rights.
• Consent: Marketing communications and non-essential cookies are processed on the basis of your explicit consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing

366bd does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Data sharing is limited to the following categories of recipients, each of whom is bound by appropriate data protection obligations:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and any other payment partner receive only the minimum data necessary to process your transaction — typically your wallet number or account reference and the transaction amount.
• Identity verification providers: KYC partners receive copies of your submitted identity documents and return a verification result. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose other than the verification task.
• Game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe, and other integrated game providers receive a pseudonymous session token rather than your full personal profile. They do not receive your name, mobile number, or financial account details.
• IT infrastructure and cloud providers: 366bd uses third-party hosting, database, and content delivery infrastructure. These providers act as data processors under contract and may not access or use player data for their own purposes.
• Legal and regulatory authorities: 366bd will disclose personal data to law enforcement agencies, financial intelligence units, or other authorities where required by a lawful order, court direction, or regulatory obligation. Where permissible, 366bd will notify the affected player prior to disclosure.
• Professional advisers: Lawyers, auditors, and compliance consultants may access personal data on a need-to-know basis in connection with their professional engagement with 366bd. All such parties are bound by confidentiality obligations.

Cookies & Tracking

366bd uses cookies and similar technologies (including local storage, session storage, and device fingerprinting signals) to operate and improve the platform. The following categories of cookies are in use:

You may manage your cookie preferences at any time via your browser settings or the 366bd cookie preference panel accessible from your account settings page. Please note that disabling strictly necessary or security cookies will impair or prevent your access to the platform.

Data Retention

366bd retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data: Retained for the full duration of your account's active status plus a post-closure period. This covers your identity documents, account history, betting records, and financial transactions.
• Financial transaction records: Retained for a minimum of five (5) years following the transaction date, in accordance with financial record-keeping obligations applicable to payment intermediaries operating in Bangladesh.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable anti-money laundering regulations.
• Support and communications records: Retained for three (3) years from the date of the communication, or until any associated dispute is fully resolved, whichever is later.
• Technical and usage logs: Server access logs and device fingerprint data are retained for up to twelve (12) months for security and fraud prevention purposes, after which they are deleted or anonymised.
• Marketing consent records: Retained for the duration of your account plus three (3) years post-closure, to demonstrate compliance with consent obligations.
• Self-excluded accounts: Identity data associated with self-excluded accounts is retained for the duration of the exclusion period plus five (5) years to prevent re-registration under the same identity.

When personal data is no longer required, it is deleted from active systems and purged from backup systems during the next scheduled backup rotation cycle.

Data Security

366bd applies a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• Transport encryption: All data transmitted between your device and the 366bd platform is encrypted using TLS 1.2 or higher. HTTPS is enforced site-wide with HSTS headers to prevent protocol downgrade attacks.
• Data-at-rest encryption: Sensitive data fields — including identity document references, payment wallet numbers, and password hashes — are encrypted at rest using AES-256 encryption.
• Password security: Passwords are never stored in plaintext. All passwords are hashed using a modern adaptive hashing algorithm (bcrypt or equivalent) with per-account salts. 366bd staff cannot retrieve your password — only reset it via a verified flow.
• Access controls: Access to player personal data is restricted to 366bd personnel who require it to fulfil their job function. Role-based access control (RBAC) policies are enforced across all internal systems. All access is logged.
• Network security: The 366bd platform infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation services. Penetration testing is conducted periodically by qualified security professionals.
• Incident response: In the event of a personal data breach that poses a risk to your rights and freedoms, 366bd will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

Your Rights

As a data subject, you have the following rights in relation to the personal data held about you by 366bd. To exercise any of these rights, contact [email protected] with your account username and a description of your request. We will respond within 30 days:

• Right of access: You may request a copy of all personal data 366bd holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Identity-linked corrections may require re-verification before taking effect.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (for consent-based processing), or where you object to processing on legitimate interest grounds. Note that erasure requests cannot override retention obligations imposed by law — financial and KYC records will be retained for the required statutory period even following account closure.
• Right to restriction: You may request that 366bd restricts processing of your data while a dispute is being investigated or while an erasure/rectification request is being considered.
• Right to data portability: You may request a machine-readable export of the personal data you provided to 366bd directly (e.g., account registration data and transaction history). This export will be provided in CSV or JSON format within 30 days of a valid request.
• Right to object: You may object to processing carried out on legitimate interest grounds. 366bd will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications, analytics cookies), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Children's Privacy

The 366bd platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. All account registrations require age verification as part of the KYC process, and accounts that cannot be verified as belonging to an adult aged 21 or older will be declined or suspended.

If you believe that a person under the age of 21 has registered an account on 366bd, or that a minor has gained access to an existing account, please notify us immediately at [email protected]. Upon receiving such a report, 366bd will investigate and, where confirmed, immediately deactivate the account and delete all associated personal data in accordance with applicable law.

Third-Party Services

The 366bd platform integrates with a number of third-party services to deliver its full range of features. While these integrations are necessary to operate the platform, 366bd takes care to ensure that data shared with third parties is limited, proportionate, and governed by appropriate contractual protections.

Third-party services currently integrated into the 366bd platform include game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe), payment processors (bKash, Nagad, Rocket, Upay), identity verification services, cloud infrastructure providers, and fraud detection tools. Each of these providers has its own privacy policy governing how it processes data within its own systems.

366bd is not responsible for the privacy practices of third-party providers acting in their capacity as independent data controllers. Where a provider acts as a data processor on behalf of 366bd, we maintain a data processing agreement that requires the provider to process data only on our documented instructions, maintain appropriate security measures, and not engage sub-processors without our consent.

The 366bd platform does not embed third-party advertising networks, social media tracking pixels, or affiliate tracking cookies without your prior consent. Any referral tracking used for promotional attribution is limited to session-scoped tokens that do not persist beyond your current browsing session.

Changes to This Policy

366bd reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will notify registered players via the email address on file and by displaying a prominent notice on the platform at least 7 days before the revised Policy takes effect.

The current version of this Privacy Policy, along with its effective date, is always accessible at 366bd.io/privacy-policy. We encourage you to review this page periodically. Continued use of the platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you object to any changes made to this Privacy Policy, you should cease using the platform and request account closure by contacting [email protected]. We will process your closure request and handle any retained data in accordance with the retention periods described in Section 8.

Contact Us

If you have any questions, concerns, or complaints relating to this Privacy Policy or the way 366bd handles your personal data, please contact our support team. All data-related enquiries are handled in English and receive a response within one business day.

For concerns about responsible gaming or to activate self-exclusion, you may also contact the Bangladesh national mental health helpline on 16789. All data access and erasure requests are handled in strict confidence and will not affect the operational status of your account unless you specifically request account closure.