38bd Privacy Policy

1 Introduction

This Privacy Policy ("Policy") applies to all personal data collected and processed by 38bd ("we", "us", "our") in connection with the operation of the 38bd online casino and sports betting platform accessible at https://38bd.io (the "Platform"). It applies to all registered players, visitors to the Platform, and any other individuals whose personal data we process in the course of operating our business.

38bd is committed to handling personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. We process personal data only for the purposes described in this Policy, and we take reasonable technical and organisational measures to protect the data we hold from unauthorised access, loss, or misuse.

This Policy should be read alongside the 38bd Terms & Conditions and Responsible Gaming Policy, which together form the complete set of governing documents for the use of the Platform. Terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

2 Data Controller

For the purposes of this Privacy Policy, 38bd acts as the data controller in respect of all personal data collected through the Platform. As data controller, 38bd determines the purposes and means by which your personal data is processed.

If you have any questions about this Policy or wish to exercise any of your data rights, you may contact us at: [email protected] (plain text — not a clickable link). Our data-related enquiries team is available 24/7, aligned to Bangladesh Standard Time (BST, UTC+6), and will respond to privacy requests within 14 business days.

3 Personal Data We Collect

38bd collects the following categories of personal data. We collect only what is necessary for the purposes described in Section 5 of this Policy.

38bd does not knowingly collect or process special categories of sensitive personal data (such as health data, religious beliefs, or biometric data) unless required to do so under applicable law or with your explicit consent.

4 How We Collect Your Data

38bd collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated collection: Data collected automatically when you access or use the Platform, including IP address, device identifiers, browser information, and usage behaviour, via server logs, cookies, and similar tracking technologies.
• Third-party sources: Data received from payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank) to confirm transaction status; from identity verification service providers to confirm the authenticity of KYC documents; and from fraud prevention databases to screen for high-risk activity.
• Game providers: Aggregated game session data (wager amounts, win/loss outcomes, session duration) received from third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe, for the purpose of account record maintenance and dispute resolution.

5 How We Use Your Personal Data

38bd uses the personal data we collect for the following specific purposes:

• Account management: To create and maintain your player account, process login requests, and manage account settings and preferences.
• Identity and age verification: To confirm that you meet the minimum age requirement of 21 years and to verify your identity in compliance with our KYC obligations.
• Transaction processing: To process deposits, withdrawals, and bonus credits accurately and securely via your chosen payment method.
• Customer support: To respond to your enquiries, resolve disputes, handle complaints, and provide technical assistance.
• Fraud and AML prevention: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible gaming: To monitor betting patterns and usage data for indicators of problem gambling behaviour, and to apply responsible gaming tools (deposit limits, cooling-off, self-exclusion) where appropriate.
• Legal compliance: To fulfil record-keeping obligations, respond to lawful requests from law enforcement bodies and financial intelligence units, and comply with applicable anti-money laundering and counter-terrorism financing regulations.
• Platform improvement: To analyse usage patterns and technical performance in order to improve the features, stability, and user experience of the Platform.
• Marketing communications: To send promotional offers, bonus notifications, and platform news to players who have consented to receive marketing communications. See Section 13 for full details.
• Personalisation: To tailor the Platform experience, including game recommendations and promotional offers, based on your usage history and stated preferences, where you have consented to this use.

6 Legal Basis for Processing

38bd processes personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and 38bd — including account creation, transaction processing, and customer support — is carried out on the basis of contractual necessity. Without this processing, we could not deliver the Services to you.
• Legal obligation: Processing carried out to comply with applicable legal requirements, including KYC/AML obligations, financial record-keeping, and lawful requests from authorities, is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, platform security, and general platform improvement is carried out on the basis of our legitimate interests, balanced against your data protection rights. We conduct proportionality assessments to ensure this balance is maintained.
• Consent: Processing carried out for marketing communications and non-essential personalisation is carried out on the basis of your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Third Parties

38bd does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following circumstances, and only to the minimum extent necessary:

• Payment processors: We share financial data with payment processors including bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and City Bank solely for the purpose of processing your deposits and withdrawals. These providers process your data in accordance with their own privacy policies and applicable financial regulations.
• Identity verification providers: We share identity document data with certified KYC/AML service providers for the sole purpose of verifying your identity and age as required by our compliance obligations. These providers act as data processors under our instruction.
• Fraud prevention services: We may share technical data (IP address, device fingerprint, transaction patterns) with fraud detection and risk scoring services to protect the integrity of the Platform and all its users.
• Game providers: Game studios (Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, Spribe) receive session-level data necessary to operate game rounds and return results. They do not receive your full personal profile.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, financial intelligence units, courts, or regulatory bodies where required to do so by law or by a valid legal order.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of 38bd's assets, player data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Affected players will be notified before their data is transferred and becomes subject to a different privacy policy.

8 Data Retention

38bd retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:

Where a longer retention period is mandated by a specific legal obligation or ongoing legal proceeding, the longer period will apply. At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9 Your Data Rights

Subject to applicable law, you have the following rights in relation to the personal data that 38bd holds about you. To exercise any of these rights, please contact us at [email protected]. We will respond within 14 business days of receiving a valid request.

• Right of access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will provide this in a clear, structured format.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Some corrections can be made directly in your account settings; others require verification before being applied.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. This right is subject to our legal retention obligations — data required for AML compliance cannot be deleted before the applicable retention period expires.
• Right to restriction: You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format.
• Right to object: You have the right to object to processing of your personal data carried out on the basis of our legitimate interests, including for direct marketing purposes. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting our support team or adjusting your account settings. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

10 Cookies & Tracking Technologies

38bd uses cookies and similar tracking technologies on the Platform to ensure the Platform functions correctly, to maintain your login session, and to gather analytical data that helps us improve the user experience. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function. They enable core features such as session management, login state, and security token validation. These cookies cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: These cookies collect aggregated, anonymised information about how players use the Platform — including which pages are visited most frequently and whether users encounter error messages. This data is used solely to improve platform performance and stability.
• Functional cookies: These cookies remember your preferences (such as language settings and previously selected payment methods) to provide a more personalised experience during your session and on return visits.
• Security cookies: These cookies support our fraud detection systems by identifying unusual patterns of behaviour — such as rapid account switching or abnormal login locations — that may indicate unauthorised access attempts.

38bd does not use advertising or cross-site tracking cookies. No cookie data collected on the 38bd Platform is shared with third-party advertising networks or data brokers.

You may adjust your browser settings to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform.

11 Security Measures

38bd implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL (TLS 1.3) encryption for all data in transit between your device and our servers.
• One-way cryptographic hashing (bcrypt) for all stored account passwords — passwords are never stored in plain text and cannot be retrieved even by 38bd staff.
• Role-based access controls that limit internal staff access to personal data to those with a documented operational need.
• Regular automated security scans and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Real-time intrusion detection systems that monitor platform infrastructure for unusual access patterns.
• Segregated storage of financial data, identity documents, and game history to limit the scope of any potential data incident.
• Incident response procedures that include notification obligations — in the event of a data breach that is likely to result in a high risk to your rights, 38bd will notify affected players without undue delay.

While 38bd takes all reasonable technical precautions, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Players are responsible for maintaining the security of their own account credentials and for notifying 38bd immediately at [email protected] if they suspect unauthorised access to their account.

12 Minors

The 38bd Platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If 38bd becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended, the data will be deleted to the extent permitted by our legal obligations, and the matter will be investigated in accordance with our age verification procedures.

Parents and guardians are encouraged to monitor the online activities of individuals in their care. If you believe a minor has registered or attempted to register an account on the 38bd Platform, please contact us immediately at [email protected] so we can investigate and take appropriate action.

13 Marketing Communications

38bd sends promotional communications — including bonus offers, new game announcements, seasonal promotions (Eid, Pohela Boishakh, BPL season specials), and platform news — only to players who have explicitly opted in to receive marketing communications at the time of registration or through their account settings.

Marketing communications are sent via SMS to your registered mobile number and/or via email to your registered email address, depending on your preferences. 38bd does not send unsolicited marketing communications to unregistered individuals.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your account settings dashboard.
• Clicking the unsubscribe link included in any marketing email.
• Contacting the 38bd support team at [email protected] and requesting removal from all marketing lists.

Withdrawal of marketing consent takes effect within 48 hours. It does not affect transactional communications such as withdrawal confirmation messages, account security alerts, or responses to support enquiries, which are sent regardless of marketing preference as they are necessary for the operation of your account.

14 Changes to This Policy

38bd reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform operations. When material changes are made, we will update the "Last updated" date at the top of this document and, where practicable, notify registered players via their registered mobile number or email address.

Your continued use of the 38bd Platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure through the support team.

We encourage you to review this Policy periodically to stay informed about how 38bd protects your personal data.

15 Contact Us

If you have any questions, concerns, or requests in relation to this Privacy Policy or the way 38bd handles your personal data, please contact our privacy team using the details below. All privacy-related enquiries are handled with priority and strict confidentiality.

When submitting a data rights request, please include your registered account username, the email address associated with your account, and a clear description of your request. We may ask for additional information to verify your identity before processing the request.