bd20 Privacy Policy

1 Information We Collect

bd20 collects personal data from players in Bangladesh through several channels: directly from you when you register an account, deposit funds, place bets, or contact our support team; automatically through the Platform as you interact with it; and from trusted third-party verification and payment partners where necessary to fulfil our obligations.

1.1 Account Registration Data

When you create a bd20 account, we collect the following information:

• Full legal name (as it appears on your National Identity Card)
• Date of birth (for mandatory 18+ age verification)
• Residential address (city and district — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar)
• Email address (for account communications, password reset, and promotional updates where you have opted in)
• Bangladeshi mobile phone number (for SMS OTP authentication and account security)
• Chosen username and encrypted password

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process — required before processing withdrawals above ৳10,000 or when triggered by our compliance review system — we may additionally collect:

• Copy of your Bangladesh National Identity Card (NID) — front and back
• Copy of your Bangladesh Passport (photo page), if provided as an alternative identity document
• Proof of residential address — utility bill, bank statement, or similar document dated within the last 90 days
• Proof of payment method ownership — for example, a screenshot showing the registered name on your bKash or Nagad account
• Selfie photograph for liveness verification, where required by our KYC partner

1.3 Financial Transaction Data

bd20 records all deposit and withdrawal transactions associated with your account, including: the date and time of each transaction; the payment method used (bKash, Nagad, Rocket, Upay, bank transfer); the masked transaction reference number; and the BDT amount. This data is retained for financial audit, regulatory compliance, and dispute resolution purposes.

1.4 Betting and Gaming Activity Data

bd20 logs all wagering activity conducted through your account, including: markets and events wagered on (e.g., BPL matches, IPL fixtures, T20 World Cup outcomes, live casino rounds, Aviator crash game sessions, slot game spins); stake amounts; odds accepted; and settlement outcomes. This data is used to calculate your account balance, detect fraudulent patterns, assess responsible gaming risk, and improve Platform products.

1.5 Technical and Device Data

When you access bd20.ws, our servers automatically collect limited technical data including: your IP address; browser type and version; operating system; device type (mobile, tablet, desktop); time zone setting; session duration; and pages visited within the Platform. This data is used for security monitoring, fraud prevention, and Platform performance analytics.

1.6 Customer Support Communications

When you contact bd20 support via email ([email protected]) or live chat, we retain records of the communication including the content of messages, the date and time, and any resolution actions taken. These records are used to resolve disputes, train support staff, and improve service quality.

2 How We Use Your Data

bd20 processes your personal data only for legitimate, specified purposes directly connected to the operation of the Platform and the provision of betting and casino services to players in Bangladesh. The primary purposes for which we use your data are set out below.

2.1 Automated Decision-Making

bd20 uses automated systems to flag accounts for fraud review, responsible gaming intervention, or KYC escalation based on defined risk criteria. These automated processes do not make final account closure decisions without human review by our compliance team. If you believe an automated flag has been applied to your account in error, you may request a manual review by contacting [email protected].

3 Sharing Your Information

bd20 does not sell or rent your personal data to any third party. We share your data only with the categories of recipients described below, and only to the extent necessary for the stated purpose. All third-party recipients with whom bd20 shares personal data are required to maintain appropriate data security standards and to use the data only for the specified purpose.

3.1 Payment Service Providers

To process deposits and withdrawals, bd20 shares limited transaction data — including your registered mobile number and transaction reference — with the relevant payment provider (bKash, Nagad, Rocket, Upay, or your nominated bank). This sharing is strictly limited to the information required to execute the specific transaction. bd20 does not share your full account profile or betting history with payment providers.

3.2 KYC and Identity Verification Partners

Where bd20 uses a third-party KYC verification service to process identity documents, copies of your NID, passport, and related documents may be transmitted securely to that provider for verification processing. KYC partners are contractually bound to process your data only for identity verification purposes and to delete documents upon completion of the verification workflow or upon bd20's instruction.

3.3 Fraud Prevention and AML Services

bd20 may share limited account and transaction data with third-party fraud detection and anti-money laundering screening services. These services analyse data patterns to identify potentially fraudulent activity. Any data shared for this purpose is subject to strict confidentiality obligations and is not used for marketing or profiling.

3.4 Legal and Regulatory Disclosure

bd20 may disclose your personal data to law enforcement authorities, regulatory bodies, or other government agencies where required to do so by applicable law, court order, or where disclosure is necessary to protect bd20's legal rights or to prevent or report criminal activity. In all cases, bd20 will disclose only the minimum data required to satisfy the legal obligation.

3.5 Business Transfers

In the event that bd20 undergoes a corporate restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to the relevant successor entity as part of that transaction. bd20 will provide notice of any such transfer via the registered email address on your account before your data is subject to a materially different privacy policy.

4 Cookies & Tracking Technologies

bd20.ws uses cookies and similar tracking technologies to deliver a functional, secure, and consistent experience for players accessing the Platform from Bangladesh and elsewhere. The following types of cookies are used on the Platform.

4.1 Essential Cookies

These cookies are strictly necessary for the Platform to function. They maintain your login session, store your language and currency preference settings, and preserve your betting slip and casino game state across page loads. Without essential cookies, core Platform features cannot operate. These cookies cannot be disabled without significantly degrading your experience.

4.2 Performance and Analytics Cookies

bd20 uses aggregated, anonymised analytics data to understand how players navigate the Platform — including which pages are visited most frequently, which game categories attract the most sessions, and where players commonly encounter difficulties. This data helps us improve Platform design, page load speed, and content relevance. No personally identifiable information is included in analytics data sets.

4.3 Functional Cookies

Functional cookies remember preferences you have set on the Platform — for example, your preferred deposit method (bKash, Nagad, etc.), your most recently played game categories, and your preferred sports betting market views (e.g., BPL, IPL, T20). These cookies improve convenience but are not strictly necessary for Platform operation.

4.4 Security Cookies

bd20 uses session security cookies to detect and prevent fraudulent login attempts, CSRF (cross-site request forgery) attacks, and session hijacking. These cookies are part of our infrastructure security layer and are essential for protecting your account from unauthorised access.

4.5 Managing Cookies

You can control which non-essential cookies are set on your device through your browser settings. Most modern browsers — including Chrome, Firefox, Samsung Internet, and Opera Mini (widely used by Bangladeshi players on Android devices) — allow you to view, block, or delete cookies via the browser's privacy or settings menu. Please note that blocking essential or security cookies may prevent you from logging in or using core Platform features.

5 Data Retention

bd20 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and financial record-keeping obligations, and to resolve any disputes that may arise after your account is closed. The following retention periods apply as a general guide:

After the applicable retention period has elapsed, bd20 will securely delete or anonymise your personal data so that it can no longer be associated with your identity. Anonymised and aggregated data that cannot identify you individually may be retained indefinitely for statistical and product development purposes.

6 Data Security Measures

bd20 applies a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. While no online platform can guarantee absolute security, bd20 applies industry-standard best practices throughout its infrastructure.

6.1 Encryption

All data transmitted between your device and bd20.ws is encrypted in transit using TLS 1.2 or higher (256-bit SSL). Sensitive data stored in bd20's databases — including passwords, NID document references, and financial identifiers — is encrypted at rest using AES-256 encryption. Passwords are stored as salted cryptographic hashes and are never recoverable in plain text.

6.2 Access Controls

Access to personal data held on bd20's systems is strictly limited to employees and contractors who require it to perform their specific job function. All staff with data access undergo background screening and are bound by confidentiality obligations. Access permissions are reviewed regularly and revoked immediately upon change of role or departure from bd20.

6.3 Two-Factor Authentication

bd20 supports SMS OTP (one-time password) two-factor authentication for player account logins. We strongly encourage all players — particularly those accessing the Platform from Dhaka, Chittagong, or other high-connectivity urban areas in Bangladesh where device theft risk may be higher — to enable SMS OTP verification on their accounts via the account security settings.

6.4 Fraud Monitoring

bd20 operates continuous automated monitoring of account login activity, transaction patterns, and betting behaviour to detect anomalies consistent with account compromise, fraud, or money laundering. Suspicious activity triggers an immediate security review and, where appropriate, a temporary account freeze to protect the player's funds pending investigation.

6.5 Security Incident Response

In the event of a personal data breach that is likely to result in a risk to affected players, bd20 will notify affected players via their registered email address within 72 hours of becoming aware of the breach. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps bd20 has taken or proposes to take to address the breach.

7 Your Privacy Rights

As a bd20 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact our privacy team at [email protected] with the subject line "Privacy Request — [Right Type]". bd20 will respond to all valid privacy rights requests within five (5) BST business days of receipt of a complete request.

7.1 Right of Access

You have the right to request a copy of the personal data bd20 holds about your account. Upon a verified access request, we will provide you with a summary of your registration data, KYC status, transaction history, betting log summary, and any marketing preferences on record. Access requests are provided free of charge for one request per twelve-month period.

7.2 Right to Rectification

If you believe that any personal data bd20 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For changes to core identity data (name, date of birth, NID number), bd20 will require supporting documentation before updating records to prevent fraudulent data modification.

7.3 Right to Erasure

You may request the deletion of your personal data where: (a) the data is no longer necessary for the purpose it was collected; (b) you have withdrawn consent and there is no other legal basis for processing; or (c) the data has been processed unlawfully. Erasure requests will be assessed against our legal retention obligations — we are required to retain certain financial records for up to seven years and therefore cannot honour erasure requests that conflict with those obligations during the mandatory retention period.

7.4 Right to Restrict Processing

You may request that bd20 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being disputed, or where you have objected to processing based on legitimate interest pending verification of whether bd20's legitimate grounds override your objection. During a processing restriction, bd20 may continue to store your data but will not use it for any purpose other than storage.

7.5 Right to Withdraw Marketing Consent

Where bd20 sends you promotional communications based on your consent (e.g., BPL bonus emails, Eid promotion notifications), you may withdraw that consent at any time by clicking the unsubscribe link in any marketing email, or by emailing [email protected] with the subject line "Unsubscribe". Withdrawal of marketing consent does not affect your account status or your ability to use the Platform.

7.6 Right to Lodge a Complaint

If you are dissatisfied with how bd20 has handled your personal data or a privacy rights request, you have the right to escalate a complaint directly to bd20's compliance team at [email protected]. bd20 will acknowledge all formal privacy complaints within two (2) BST business days and aim to provide a full response within fifteen (15) BST business days.

8 Updates to This Policy

bd20 reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, changes to the services offered on the Platform, and developments in applicable data protection standards. When material changes are made to this Privacy Policy, bd20 will:

• Update the "Last updated" date at the top of this page to reflect the effective date of the revised policy
• Send a notification email to all registered players at their registered email address, describing the nature of the key changes, at least seven (7) days before the updated policy takes effect
• Display a prominent notice on the bd20 Platform login screen and homepage for a period of not less than fourteen (14) days following publication of the revised policy

Your continued use of bd20 after the effective date of a revised Privacy Policy constitutes your acceptance of the updated policy. If you do not agree to the revised terms, you should stop using the Platform and request account closure in accordance with the account closure procedures described in the bd20 Terms & Conditions.

Minor updates — such as corrections to typographical errors, clarifications of existing practices that do not substantively change how your data is used, or updates to contact information — may be made without prior notice. The "Last updated" date will always reflect the most recent revision.