25bd Privacy Policy

1. Information We Collect

25bd collects personal information from you in the course of providing its online gaming and sports betting services. The categories of information we collect depend on how you interact with the platform. We collect only the minimum data necessary for each purpose, in line with the principle of data minimisation.

1.1 Information You Provide Directly

When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion, you provide us with information that may include:

Data Category	Examples	When Collected
Identity Data	Full legal name, date of birth, nationality	Registration & KYC
Contact Data	Email address, mobile number, residential address	Registration
Document Data	NID card scan, passport copy, selfie for liveness check	KYC Verification
Financial Data	bKash number, Nagad number, bank account details, transaction history	Deposits & Withdrawals
Communications Data	Support chat transcripts, email correspondence	Customer Support

1.2 Information Collected Automatically

When you access 25bd via a browser or mobile device, we automatically collect certain technical information, including:

• Device & Browser Data: IP address, device type, operating system, browser version, screen resolution, and device language settings.
• Usage Data: Pages visited, games launched, betting markets accessed, session start and end times, click paths, and in-session wager amounts.
• Location Data: Country and city-level geolocation inferred from your IP address. 25bd does not access your device's GPS location without explicit permission.
• Cookie and Tracking Data: Session identifiers, authentication tokens, and analytics identifiers — see Section 4 for full cookie details.

1.3 Information from Third Parties

In limited circumstances, 25bd may receive information about you from third parties, including:

• Payment Processors: Transaction confirmation data from bKash, Nagad, Rocket, Upay, and card networks, used to match your deposit or withdrawal to your account.
• KYC Service Providers: Where we use a third-party identity verification partner, we may receive a verification result (pass/fail) and a reference ID — we do not store full document copies on behalf of the third-party provider's systems.
• Fraud Prevention Services: Signals from fraud screening tools that flag unusual account behaviour, such as known fraudulent IP ranges or device fingerprints associated with previous fraud incidents.

2. How We Use Your Data

25bd processes your personal information only where we have a lawful basis to do so. Our primary lawful bases are: (a) performance of a contract with you — operating your account and delivering our services; (b) compliance with a legal obligation — KYC, anti-money laundering record-keeping; and (c) our legitimate interests — fraud prevention, platform security, and service improvement, provided these do not override your rights.

The specific purposes for which we use your data are:

• Account Management: Creating and maintaining your 25bd account, authenticating your identity at login, and managing your account preferences and settings.
• Transaction Processing: Processing your deposits and withdrawal requests, reconciling payments, issuing bonus credits, and maintaining your account balance ledger.
• KYC & Compliance: Verifying your identity and age before processing your first withdrawal, screening against sanctions lists, and maintaining records as required by applicable anti-money laundering obligations.
• Customer Support: Responding to your enquiries, resolving disputes, processing responsible gaming requests such as deposit limits and self-exclusion, and following up on complaints.
• Platform Safety & Fraud Prevention: Detecting and investigating suspicious activity, preventing duplicate accounts, enforcing our Terms & Conditions, and protecting other players from collusion or manipulation.
• Service Improvement: Analysing aggregate usage patterns to improve platform performance, identify popular game categories, optimise the user interface, and prioritise feature development.
• Promotional Communications: Sending you information about bonuses, tournaments, and seasonal promotions by email or SMS, where you have not opted out. You may withdraw consent for marketing communications at any time through your account settings or by contacting support.
• Responsible Gaming: Monitoring account activity for patterns that may indicate problem gambling behaviour, and proactively offering responsible gaming tools or intervention where appropriate.

3. Data Sharing & Disclosure

25bd does not sell, rent, or barter your personal information to any third party. We share your data only in the limited circumstances described below, and always subject to appropriate data protection safeguards.

3.1 Service Providers

We engage trusted third-party service providers to help us operate the platform. These providers act as data processors on our behalf and may only process your data for the specific purpose for which they were engaged, under strict contractual obligations:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, and Mastercard — for payment processing only.
• KYC & Identity Verification: Third-party document verification providers used to confirm your identity before your first withdrawal.
• Cloud Infrastructure: Our platform is hosted on secure cloud servers. Infrastructure providers have access to server data but are contractually prohibited from accessing or using it for their own purposes.
• Analytics Providers: Anonymised or aggregated platform usage data may be processed by analytics tools to help us understand platform performance.
• Customer Support Tools: Our support chat and ticketing system provider processes support conversation data on our behalf.

3.2 Legal & Regulatory Disclosure

25bd may disclose your personal information to law enforcement agencies, government bodies, or regulatory authorities where required to do so by applicable law, court order, or regulatory direction. We will notify you of such a disclosure where we are legally permitted to do so. Where disclosure is required to prevent or investigate fraud, money laundering, or other serious criminal activity, notification may not be possible.

3.3 Business Transfers

In the event that 25bd undergoes a merger, acquisition, asset sale, or restructuring, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer by email and given the opportunity to request deletion of your data before the transfer completes, where this is reasonably practicable.

3.4 Aggregate and Anonymised Data

25bd may share aggregated or anonymised data — from which you cannot be personally identified — with partners, industry bodies, or in public reports. Such data is not personal data and is not subject to the restrictions in this Privacy Policy.

4. Cookies & Tracking Technologies

25bd uses cookies and similar technologies (such as local storage tokens and session identifiers) to ensure the platform functions correctly, to maintain your logged-in state, and to collect anonymised analytics data that helps us improve the platform.

4.1 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the platform to function. They include session authentication tokens that keep you logged in while you navigate between pages, and security cookies that help protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These remember your preferences — such as your preferred language, currency display (BDT or INR), and lobby filter settings — so you do not need to reset them on each visit.
• Analytics Cookies: These collect anonymised information about how visitors use the platform — which pages are visited most, where users drop off in the registration funnel, and which game categories are most popular. This data is aggregated and cannot be used to identify you individually.

4.2 What We Do Not Use

25bd does not deploy advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not share cookie data with advertising networks. We do not use cookies to build a profile of your interests for the purpose of serving targeted advertisements on third-party websites.

4.3 Managing Cookies

You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, accept only first-party cookies, or delete stored cookies on exit. Please note that disabling strictly necessary cookies will prevent you from logging in and using core platform features. Instructions for managing cookies are available in the help documentation for your browser (Chrome, Firefox, Safari, Edge, Opera).

5. Data Security

25bd implements a layered security architecture to protect your personal information against unauthorised access, disclosure, alteration, and destruction. Our key security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and 25bd's servers is encrypted in transit using TLS 1.3, the current industry standard for secure web communications.
• At-Rest Encryption (AES-256): Personal data stored in our databases — including account details, transaction records, and KYC documents — is encrypted at rest using AES-256 symmetric encryption.
• Access Controls: Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis. All internal access is logged and monitored. Administrative access requires multi-factor authentication (MFA).
• Penetration Testing: 25bd conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach incident response plan. In the event of a security incident that affects your personal data, we will notify affected users promptly and take immediate remediation steps.

6. Data Retention

25bd retains your personal data for as long as necessary to fulfil the purpose for which it was collected, and to comply with applicable legal and regulatory obligations. Our standard retention periods are:

Data Category	Retention Period	Basis
Account & Identity Data	Duration of account + 5 years after closure	Legal / AML obligation
KYC Documents	5 years from date of submission	Legal / AML obligation
Transaction Records	7 years from transaction date	Financial record-keeping
Support Communications	3 years from last interaction	Dispute resolution
Analytics Data	26 months (anonymised after 6 months)	Legitimate interest
Marketing Preferences	Until opt-out or account closure	Consent

Following the expiry of the applicable retention period, personal data is either securely and permanently deleted from our systems or irreversibly anonymised so that it can no longer be linked to you as an individual. Anonymised aggregate data may be retained indefinitely for statistical and research purposes.

7. Your Privacy Rights

As a 25bd player, you have the following rights over your personal data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Subject Request". We will acknowledge your request within 5 business days and respond in full within 30 days.

• Right of Access: You may request a copy of all personal data we hold about you, along with information about how it is used and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other lawful basis applies), or where you object to processing based on legitimate interests. Note that erasure requests may be limited where retention is required by law — for example, AML record-keeping obligations require us to retain certain financial records for 5 to 7 years regardless of account closure.
• Right to Restriction: You may request that we restrict processing of your data — meaning we retain it but do not actively use it — while a dispute about its accuracy or the lawfulness of its processing is resolved.
• Right to Data Portability: Where processing is based on your consent or a contract with you, you may request that we provide your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service.
• Right to Object to Marketing: You have an unconditional right to object to the processing of your personal data for direct marketing purposes at any time. We will cease marketing processing within 5 business days of receiving your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

8. Policy Updates & Contact

8.1 Policy Updates. 25bd may update this Privacy Policy from time to time to reflect changes in our data practices, operational changes, or evolving legal requirements. When we make a material change to this policy, we will update the "Effective Date" at the top of the page and notify registered players via their registered email address or through an in-platform notice. We encourage you to review this page periodically. Your continued use of the 25bd platform after a policy update constitutes your acceptance of the revised Privacy Policy.

8.2 Children's Privacy. The 25bd platform is strictly for adults aged 18 and over. We do not knowingly collect personal data from persons under 18 years of age. If we become aware that a person under 18 has submitted personal data to us, we will delete that data promptly and close the associated account. If you are a parent or guardian and believe a minor has created a 25bd account, please contact us immediately at [email protected]. 18+

8.3 Third-Party Links. The 25bd platform does not contain links to external third-party websites. In the event that any such link is present (for example, to a game studio's fair play certification), 25bd is not responsible for the privacy practices of that third-party site and encourages you to review their privacy policy independently.

8.4 Contact. If you have any questions, concerns, or complaints about this Privacy Policy or about how 25bd handles your personal data, please contact our support team:

• Email: [email protected]
• Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)
• Response Time: Within 1 business day for general privacy enquiries; within 30 days for formal data subject requests.