Privacy Policy — How 449bdt Protects Your Personal Data

449bdt collects personal data through several channels: directly from you when you register an account or interact with the platform; automatically through your use of the website and associated technology; and, in limited circumstances, from trusted third-party sources used for identity verification and fraud prevention. We collect only the information that is reasonably necessary for us to provide our services, comply with legal obligations, and maintain a safe platform for all users.

Registration & Account Data

When you create a 449bdt account, we collect the following information:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you meet the 18+ age requirement).
• Residential address, including city, postal code, and country.
• Email address (used for account communications, promotional messages where consented, and security alerts).
• Mobile phone number (used for two-factor authentication and account recovery).
• Username and encrypted password credentials.

Identity Verification (KYC) Data

To comply with Know Your Customer (KYC) obligations and to protect our players from identity fraud, we may request copies of the following documents at various stages of your account lifecycle:

• National Identity Card (NID) — the primary verification document accepted for Bangladeshi players.
• Valid passport or driver's licence where NID is unavailable or supplementary verification is required.
• Proof of residential address such as a utility bill or bank statement issued within the past three months.
• Proof of payment method ownership (e.g., screenshot of your bKash or Nagad account confirming registered name).

Financial Transaction Data

We record details of all financial transactions carried out through your 449bdt account, including deposit amounts, withdrawal requests, payment method identifiers (such as the registered mobile number associated with your bKash or Nagad account), transaction timestamps, and transaction reference numbers. Full payment card numbers are never stored on 449bdt servers; card payments are processed through PCI-DSS compliant third-party payment gateways that handle sensitive card data directly.

Usage & Behavioural Data

When you use the 449bdt platform, our servers and analytics systems automatically collect certain technical and behavioural information, including your IP address, device type and operating system, browser type and version, pages visited, games played, session duration, betting history, and in-app interaction patterns. This data is used to improve platform performance, personalise your experience, and detect unusual activity that may indicate fraud or security threats.

449bdt does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes under any circumstances. We share personal data with third parties only where it is strictly necessary to deliver our services, comply with legal requirements, or protect the security of the platform and its users.

The categories of third parties with whom we may share your data, and the reasons for doing so, are as follows:

• Payment Service Providers: We share transactional data with payment processors including bKash, Nagad, Rocket, Upay, and card network processors (Visa, Mastercard) solely for the purpose of processing your deposits and withdrawals. These providers operate under their own privacy policies and data protection obligations.
• Identity Verification Partners: Where automated KYC verification is used, we may share identity document images and registration data with specialist third-party KYC service providers operating under strict data processing agreements with 449bdt.
• Game Software Providers: Your gameplay data (game sessions, bet amounts, outcomes) is shared with our game content providers (such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming) to the extent necessary for game delivery and fair play verification. These providers do not receive your name, contact details, or financial data.
• Analytics & Security Providers: Anonymised or pseudonymised usage data may be shared with analytics and cybersecurity partners to help us understand platform performance and detect threats.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, financial intelligence units, or courts where we are legally compelled to do so by a valid legal order, warrant, or regulatory directive.

All third-party data processors with whom 449bdt shares personal data are subject to contractual obligations that require them to process that data only for the specified purpose, to maintain appropriate security standards, and to refrain from onward transfer without authorisation from 449bdt.

449bdt retains your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable legal, regulatory, accounting, or reporting obligations. The specific retention periods applicable to different categories of data are outlined below.

• Active Account Data: Personal data associated with an active 449bdt account (registration data, contact details, preferences) is retained for the duration of your account and for a minimum period of five (5) years following account closure, in line with standard anti-money laundering record-keeping requirements.
• KYC Verification Documents: Identity documents submitted for KYC verification are retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Financial Transaction Records: All records of deposits, withdrawals, and in-platform transactions are retained for a minimum of seven (7) years to comply with financial record-keeping obligations.
• Support Communications: Records of customer support interactions (chat logs, email correspondence, WhatsApp messages where stored) are retained for three (3) years from the date of the interaction.
• Usage & Analytics Data: Aggregated and anonymised analytics data may be retained indefinitely for internal business intelligence purposes. Identifiable usage logs (containing IP addresses or device identifiers) are retained for a maximum of twelve (12) months.
• Marketing Consent Records: Records of your marketing consent or opt-out decisions are retained for the duration of your account plus three (3) years, to enable us to demonstrate compliance with consent obligations.

When personal data is no longer required and its retention period has expired, 449bdt will securely delete or anonymise that data in a manner that makes re-identification impossible. Deletion processes are carried out on a regular schedule and are subject to internal audit oversight.

449bdt takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, alteration, disclosure, or destruction. No method of electronic transmission or storage is completely secure; however, we apply industry-standard controls and continuously review our security posture to address emerging threats.

The security measures currently in place at 449bdt include, but are not limited to:

• TLS/SSL Encryption: All data transmitted between your browser or app and the 449bdt platform is encrypted using Transport Layer Security (TLS 1.2 or higher), ensuring that data in transit cannot be intercepted by third parties.
• Password Hashing: Account passwords are never stored in plain text. They are hashed using a modern cryptographic hashing algorithm with per-account salting, making stored password data computationally infeasible to reverse-engineer.
• Access Controls: Access to systems that process personal data is restricted to authorised 449bdt personnel on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-Factor Authentication: 449bdt strongly recommends that all players enable 2FA on their accounts. This adds a second layer of protection beyond your password for login and withdrawal confirmation.
• Infrastructure Security: Our servers are hosted in secure data centres with physical access controls, redundant power systems, and 24/7 monitoring. Regular vulnerability assessments and penetration tests are conducted by independent security specialists.
• Incident Response: 449bdt maintains a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, we will notify affected players within 72 hours of becoming aware of the incident, in line with best-practice incident response standards.