Privacy Policy – How kdbd Collects, Uses, and Protects Your Personal Data

01 Introduction

kdbd is Bangladesh's leading online betting and casino platform, serving players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. As a platform that processes financial transactions and holds sensitive personal data on behalf of its registered players, kdbd treats data privacy as a matter of the highest operational importance.

This Policy applies to all personal data collected through the kdbd website at kdbd.io, including data collected during account registration, identity verification, deposit and withdrawal processing, customer support interactions, and voluntary communications with kdbd staff. It also covers data collected automatically through cookies, device identifiers, and analytics systems when you browse the platform.

This Policy does not apply to third-party websites, payment processors, or game providers that you may interact with through the kdbd platform. Those parties operate under their own independent privacy policies, and kdbd encourages you to review those policies directly. kdbd is not responsible for the data practices of any third party.

02 Data Controller

For the purposes of this Privacy Policy, kdbd acts as the data controller in respect of all personal data collected from players using the kdbd platform. As data controller, kdbd determines the purposes and means by which personal data is processed and is responsible for ensuring that processing activities comply with applicable data protection principles.

All data protection enquiries, access requests, correction requests, and erasure requests must be directed to the kdbd Data Protection contact point:

• Email: [email protected] — mark the subject line "Data Protection Request".
• Live Chat: Available 24/7 on the kdbd platform — identify your request as a data protection matter at the start of the conversation.
• Response timeframe: kdbd will acknowledge all data protection requests within 5 business days and will provide a substantive response within 30 calendar days of receipt.

03 Data We Collect

kdbd collects personal data in the following categories. The table below summarises the type of data, the context in which it is collected, and whether it is mandatory or optional:

kdbd does not intentionally collect sensitive personal data beyond what is required for identity verification and regulatory compliance. If you voluntarily disclose additional sensitive information (for example, in a support communication), it will be handled with the same level of security as all other personal data and will not be used for any purpose beyond resolving your support matter.

04 How We Use Your Data

kdbd uses the personal data it collects for the following specific and documented purposes:

• Account creation and management: To register your account, verify your identity, authenticate your logins, and maintain accurate account records throughout the duration of your use of the platform.
• Transaction processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — and to maintain a complete and auditable transaction history for each account.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, multiple account registrations, money laundering, bonus abuse, and unauthorised access. Technical data and usage data play a significant role in this function.
• Regulatory compliance: To comply with applicable anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and any reporting obligations that arise under applicable laws. This may include retaining transaction records for a minimum of 5 years.
• Customer support: To respond to your queries, resolve disputes, process responsible gaming requests, and improve the quality of our support service. Support interactions may be recorded and reviewed for quality assurance purposes.
• Platform improvement: To analyse usage patterns, game preferences, and navigation behaviour (in aggregate and anonymised form where possible) to improve the design and performance of the kdbd platform.
• Marketing communications: To send you promotional offers, bonus notifications, and updates about new games and features — but only where you have given explicit consent to receive marketing communications. See Section 13 for full details.
• Responsible gaming: To monitor account behaviour for indicators of problem gambling, to apply responsible gaming tools you have activated, and to enforce any self-exclusion or cooling-off periods on your account.

05 Legal Basis for Processing

kdbd processes personal data on the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: Processing is necessary to perform the contract between kdbd and the Player — specifically, to operate and maintain the Player's account, process transactions, and deliver the gaming services the Player has engaged kdbd to provide.
• Legal obligation: Processing is necessary to comply with kdbd's legal obligations, including AML compliance, KYC verification, and the retention of financial records as required by applicable regulatory frameworks.
• Legitimate interests: Processing is necessary for kdbd's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and the improvement of platform performance — provided that these interests are not overridden by the Player's own privacy rights.
• Consent: Where processing is based on consent — for example, the sending of marketing communications — kdbd will always obtain a clear, affirmative opt-in from the Player before processing commences. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

06 Cookies and Tracking Technologies

kdbd uses cookies and similar tracking technologies on the kdbd.io platform to support essential functionality, analyse platform performance, and personalise your experience. A cookie is a small text file placed on your device when you access a website; it allows the website to recognise your device on subsequent visits.

kdbd uses the following categories of cookies:

• Strictly necessary cookies: These are essential for the platform to function correctly. They enable secure login sessions, maintain your account state, and support the operation of responsible gaming tools. These cookies cannot be disabled without impairing core platform functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how players use the platform — including pages visited, time spent on each page, and error messages encountered. This data is used solely to improve platform performance and is not linked to individual player identities.
• Functional cookies: These cookies remember your preferences — such as your preferred language and notification settings — to provide a more personalised experience on return visits.
• Marketing cookies: These cookies track your interaction with kdbd promotional content and may be used to deliver targeted bonus offers. These cookies are only placed where you have given explicit consent to receive marketing communications.

You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will affect your ability to use core platform features, including secure login.

07 Third-Party Data Sharing

kdbd does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared with third parties only in the following limited and documented circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive only the minimum transactional data necessary to process your deposits and withdrawals. These parties are contractually bound to process your data solely for payment purposes.
• Identity verification providers: Third-party KYC services may receive your Identity Data (name, NID or passport details, photograph) to perform automated age and identity verification checks. These providers are data processors acting under kdbd's instruction.
• Game providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, Habanero, and Play'n GO receive a pseudonymous player identifier to enable game session management. They do not receive your full name, NID, or financial data.
• Analytics providers: Anonymised and aggregated usage data may be shared with analytics platforms to support platform improvement activities. No personally identifiable information is shared in this context.
• Legal and regulatory authorities: kdbd may disclose personal data to law enforcement agencies, financial intelligence authorities, or other regulatory bodies where required to do so by applicable law, a valid court order, or as necessary to protect the rights and safety of kdbd players and staff.

08 International Data Transfers

Some of kdbd's third-party service providers — including certain game providers and analytics platforms — may be located outside Bangladesh and may process your personal data in jurisdictions other than your country of residence. Where such transfers occur, kdbd takes appropriate steps to ensure that your personal data receives a level of protection consistent with the standards set out in this Privacy Policy.

Safeguards used by kdbd for international data transfers include:

• Standard contractual data processing agreements with all third-party processors that include binding data protection obligations.
• Transfer only to jurisdictions or providers that maintain documented data protection frameworks equivalent in standard to those applied by kdbd.
• Pseudonymisation or anonymisation of data prior to transfer wherever the purpose of the transfer permits it.

Players may request information about the specific safeguards applied to any international transfer of their data by contacting kdbd at [email protected].

09 Data Retention

kdbd retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship plus a minimum of 5 years following account closure, to satisfy regulatory requirements and support any post-closure dispute resolution.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction, in accordance with applicable financial record-keeping obligations.
• Support communications: Retained for 2 years from the date of the communication, or longer if the communication relates to an ongoing dispute or legal matter.
• Technical and usage data: Retained in anonymised and aggregated form for up to 3 years for platform improvement purposes. Non-anonymised technical data (e.g., IP logs) is retained for 12 months.
• Marketing consent records: Retained for the duration of the Player's account and for 2 years following withdrawal of consent, as evidence of the consent status at any given time.
• Responsible gaming records: Self-exclusion history, deposit limit records, and cooling-off period records are retained for 6 years following the end of the relevant restriction, to enable enforcement of re-application requests and to support responsible gaming audits.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Players may not request early deletion of data that kdbd is legally obligated to retain.

10 Your Data Rights

As a kdbd player, you have the following rights with respect to your personal data. These rights may be exercised at any time by contacting kdbd at [email protected] with the subject line "Data Protection Request":

• Right of access: You have the right to request a copy of all personal data that kdbd holds about you, together with information about how that data is being used and with whom it has been shared.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. We will action correction requests within 14 days of receipt.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis for processing applies. Note that certain data cannot be erased where kdbd has a legal obligation to retain it.
• Right to restriction of processing: You may request that kdbd restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is under dispute or while an objection to processing is being assessed.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.
• Right to object: You have the right to object to processing of your personal data based on legitimate interests, including profiling. You also have an unconditional right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11 Security Measures

kdbd implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls in place at kdbd include:

• 256-bit SSL/TLS encryption: All data in transit between your device and kdbd servers is encrypted using industry-standard TLS protocols. The kdbd platform operates exclusively over HTTPS.
• AES-256 encryption at rest: All personal data stored on kdbd servers is encrypted at rest using AES-256 encryption. This includes account data, financial records, and identity verification documents.
• Access controls: Access to personal data within kdbd's internal systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data categories required for their specific job function.
• Multi-factor authentication: All internal kdbd administrative accounts require multi-factor authentication. Players are strongly encouraged to enable two-factor authentication on their own accounts for additional protection.
• Regular security audits: kdbd conducts regular internal security audits and periodic third-party penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Staff training: All kdbd staff with access to personal data receive mandatory data protection and security training upon onboarding and on a recurring annual basis.
• Incident response: kdbd maintains a documented data breach incident response plan. In the event of a confirmed breach affecting player data, affected players will be notified within 72 hours and provided with clear guidance on protective steps they can take.

Despite these measures, no internet-based platform can guarantee absolute data security. Players are advised to maintain the security of their own login credentials, avoid using public Wi-Fi networks for financial transactions, and report any suspected unauthorised access to their account immediately via [email protected].

12 Children and Minors

kdbd is strictly a 21+ platform. We do not knowingly collect, process, or retain personal data from any individual under the age of 21. The kdbd registration process includes mandatory date-of-birth verification, and identity verification is required before any financial transaction is processed.

If kdbd becomes aware that personal data has been collected from an individual who is under 21 years of age, that account will be immediately suspended, all associated data will be securely deleted, and any deposited funds will be returned to the originating payment method. If you believe that a minor has registered on the kdbd platform, please contact us immediately at [email protected].

13 Marketing Communications

kdbd may send you promotional communications — including bonus offers, new game announcements, and seasonal promotions tied to events such as the BPL, IPL, T20 World Cup, Eid, and Pohela Boishakh — via SMS, email, or push notification. These communications will only be sent where you have explicitly opted in to receive marketing messages from kdbd.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email from kdbd.
• Replying "STOP" to any marketing SMS message.
• Adjusting your communication preferences in the account dashboard under "Notification Settings".
• Contacting kdbd directly at [email protected] with the subject line "Marketing Opt-Out".

Withdrawal of marketing consent will not affect the delivery of transactional communications — such as deposit confirmations, withdrawal updates, security alerts, and responsible gaming notifications — which kdbd sends as a necessary part of account management and which do not require separate consent.

14 Changes to This Policy

kdbd reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, the introduction of new platform features, or updates to applicable legal requirements. The "Last Updated" date at the top of this page will always reflect when the most recent revision was made.

Where a change to this Policy is material — meaning it significantly affects how your personal data is used, your rights, or the parties with whom your data is shared — kdbd will notify you directly via email or an in-platform notification at least 14 days before the change takes effect. Continued use of the kdbd platform after a notified change takes effect constitutes acceptance of the revised Policy.

We encourage all players to review this Privacy Policy periodically to stay informed about how kdbd protects their personal data. The current version of this Policy is always available at kdbd.io/privacy-policy.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way kdbd handles your personal data, please contact our Data Protection team using the details below. All communications are handled in strict confidence and responded to within the timeframes stated in Section 10.

• Email: [email protected] — subject line: "Data Protection Request"
• Live Chat: Available 24/7 on the kdbd platform — identify your request as a data protection matter at the start of the conversation
• Operating hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Coverage: Serving players across all Bangladesh regions including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar