bdc8 Privacy Policy

bdc8 ("we", "us", "our") operates the online betting and gaming platform accessible at https://bdc8.io (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or transacts on the Platform ("you", "your", "Member").

This Privacy Policy sets out, in clear and formal terms, the categories of personal data we collect, the purposes for which that data is processed, the legal grounds on which we rely to do so, and the rights you hold in relation to your own information. This Policy applies to all Members regardless of the device or method used to access the Platform, including desktop browsers, mobile browsers, and any bdc8-branded mobile application.

This Privacy Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference. In the event of any inconsistency between this Privacy Policy and the Terms & Conditions on a matter specifically relating to personal data, this Privacy Policy shall prevail.

bdc8 acts as the data controller in respect of personal data collected through the Platform. As data controller, bdc8 is responsible for determining the purposes and means of processing your personal data and for ensuring that such processing is carried out lawfully, fairly, and transparently.

Where bdc8 engages third-party service providers to process personal data on its behalf — including payment processors, identity verification providers, and game suppliers — those providers act as data processors under binding contractual agreements that require them to process personal data only on bdc8's instructions and to implement appropriate technical and organisational security measures.

If you have questions about how your personal data is controlled or processed, you may contact bdc8 directly using the details set out in Section 16 of this Policy.

bdc8 collects the following categories of personal data from Members and, where applicable, from third-party sources:

bdc8 does not intentionally collect special categories of sensitive personal data (such as health data, religious beliefs, or political opinions). If any such data is incidentally disclosed to us — for example in a support communication — we will not process it for any purpose other than resolving the specific communication in which it was shared.

bdc8 collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing identity verification, making deposits or withdrawals, placing bets, contacting customer support, or responding to surveys or promotions.
• Automated Collection: Data collected automatically when you access the Platform, including via cookies, web beacons, log files, and similar tracking technologies. This includes Technical Data and Usage Data as described in Section 3.
• Third-Party Sources: Data received from identity verification providers (used to confirm your age and identity), fraud prevention databases, payment processors (transaction confirmation data), and game providers (game session records and results).
• Public Sources: In limited circumstances, bdc8 may verify information against publicly available records for compliance or fraud prevention purposes.

bdc8 processes your personal data only where a lawful basis exists. The primary legal grounds on which we rely are as follows:

• Contractual Necessity: Processing required to create and administer your account, process transactions, and deliver the services you have requested under the Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering checks, age verification requirements, and fraud prevention reporting obligations.
• Legitimate Interests: Processing carried out in pursuit of bdc8's legitimate business interests — such as improving Platform security, detecting and preventing fraud, analysing usage patterns, and managing business relationships — where those interests are not overridden by your own rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of marketing communications. Where consent is the legal basis, you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

bdc8 uses the personal data described in Section 3 for the following purposes:

• Account Management: Creating, maintaining, and administering your bdc8 account, including processing login authentication and managing your account settings and preferences.
• Identity Verification: Verifying your age (21+) and identity in compliance with our age-gating obligations and to prevent fraudulent or unauthorised account registrations.
• Payment Processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, including communicating with payment service providers to confirm transaction status.
• Service Delivery: Enabling access to cricket betting markets, live casino games, slots, table games, and all other products and features offered on the Platform.
• Bonus & Promotion Administration: Crediting bonus funds, tracking wagering requirement progress, and determining eligibility for promotions including the 200% welcome bonus up to ৳20,000.
• Customer Support: Responding to enquiries, resolving disputes, processing complaints, and following up on support tickets submitted via email or live chat.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible Gaming: Monitoring account activity for indicators of problem gambling and administering self-exclusion, deposit limits, and session time-out features in accordance with our Responsible Gaming obligations.
• Platform Analytics & Improvement: Analysing usage data to understand how Members interact with the Platform, identify technical issues, and inform product development decisions.
• Legal & Regulatory Compliance: Retaining records necessary to comply with applicable anti-money laundering regulations, age verification requirements, and other legal obligations applicable to international offshore gaming operators.
• Marketing Communications: Sending promotional emails, SMS notifications, or push notifications about bdc8 bonuses, new games, and special events — only where you have provided explicit consent to receive such communications.

bdc8 does not use your personal data for fully automated decision-making that produces legal or similarly significant effects without human review. Where automated processes are used to flag accounts for fraud or responsible gaming intervention, a member of the bdc8 compliance team will review the flagged case before any material action is taken.

bdc8 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your personal data may be shared with the following categories of third parties only to the extent necessary to operate the Platform and fulfil our legal obligations:

• Game Providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Play'n GO, and Ezugi receive session data necessary to deliver their games on the Platform. These providers are contractually required to process such data only for game delivery purposes.
• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transaction data necessary to process deposits and withdrawals. Each processor is governed by its own privacy policy and is independently regulated.
• Identity Verification Providers: Third-party KYC (Know Your Customer) services receive identity document data and may cross-reference it against fraud prevention databases to confirm a Member's age and identity.
• IT & Infrastructure Partners: Cloud hosting providers, database management services, and cybersecurity vendors that support the technical infrastructure of the Platform, each subject to contractual data processing agreements.
• Legal & Regulatory Authorities: bdc8 may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, court order, or lawful regulatory request. bdc8 will take reasonable steps to notify affected Members of such disclosure where permitted to do so by law.
• Professional Advisers: Legal counsel, auditors, and compliance consultants who are bound by professional confidentiality obligations and who require access to certain data in the course of providing their services to bdc8.

Any third party that receives personal data from bdc8 is required, by contract, to implement appropriate technical and organisational security measures and to process that data only for the specified, lawful purpose for which it was shared.

bdc8 uses cookies and similar tracking technologies on the Platform to ensure the correct functioning of the site, remember your preferences, maintain your session, and gather anonymised analytics data. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as login session management, account security tokens, and payment processing redirects. These cookies cannot be disabled without materially impairing the functionality of the Platform.
• Preference Cookies: These cookies remember your platform preferences — such as your chosen language variant, display settings, and last-accessed game categories — so you do not need to re-configure them on each visit.
• Analytics Cookies: These cookies collect anonymised information about how Members navigate and interact with the Platform. The data generated is used in aggregate form to improve the Platform's design, content, and performance. No personally identifiable information is attached to analytics data.
• Security Cookies: These cookies support our fraud detection and account security systems by recording session integrity signals, device fingerprint data, and anomalous activity indicators.

You can manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in and using core Platform features. Disabling other cookie categories will not prevent access but may reduce the quality of your experience. bdc8 does not use cookies to serve third-party advertising or to track your browsing activity on websites outside the Platform.

bdc8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in any event for no shorter than the minimum retention periods required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your membership and for a period of at least five (5) years following account closure, in order to satisfy anti-money laundering record-keeping obligations.
• Identity Verification Documents: Retained for a minimum of five (5) years following the end of the business relationship, consistent with standard KYC record-keeping requirements applicable to international gaming operators.
• Transaction Records: Retained for a minimum of five (5) years following the date of each transaction.
• Support Communications: Retained for a minimum of two (2) years following the resolution of the relevant support ticket or complaint.
• Marketing Consent Records: Retained for the duration of the consent plus one (1) year following withdrawal of consent, to maintain a record of your preferences and any opt-out requests.
• Technical & Usage Data: Typically retained in identifiable form for up to twelve (12) months, after which it is anonymised and may be retained indefinitely in aggregate form for analytics purposes.

Where you request deletion of your personal data under Section 11 of this Policy, bdc8 will delete or anonymise your data subject to any legal retention obligations that require us to keep certain records for a longer period.

bdc8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and the bdc8 platform is encrypted using industry-standard 256-bit SSL/TLS protocols. You can verify this by checking for the padlock symbol in your browser's address bar when visiting https://bdc8.io.
• Encryption at Rest: Sensitive personal data, including identity documents and financial records, is encrypted at rest using AES-256 encryption within our secure data storage infrastructure.
• Access Controls: Access to personal data within bdc8's internal systems is restricted on a strict need-to-know basis. Each team member's access rights are reviewed regularly and revoked immediately upon departure from the organisation.
• Password Security: Member passwords are stored in hashed, salted form. bdc8 does not store plaintext passwords and cannot retrieve your password — only reset it through a secure verification process.
• Penetration Testing & Audits: The Platform infrastructure undergoes periodic security assessments and vulnerability testing to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: bdc8 maintains a documented data breach incident response procedure. In the event of a confirmed personal data breach that poses a risk to affected Members, bdc8 will notify impacted individuals in accordance with applicable legal obligations.

While bdc8 takes every reasonable precaution to protect your personal data, no system of data transmission or storage over the internet can be guaranteed to be entirely free from risk. You acknowledge this inherent limitation when using the Platform and accept responsibility for maintaining the security of your own account credentials.

Subject to applicable law, you have the following rights in relation to the personal data that bdc8 holds about you:

• Right of Access: You may request a copy of the personal data bdc8 holds about you, together with information about how it is processed. bdc8 will respond to access requests within 30 days of receipt.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. You may also update basic account information (such as your contact email or address) directly through your account settings panel.
• Right to Erasure: You may request that bdc8 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to legal retention obligations that may require bdc8 to retain certain records for a specified period notwithstanding your erasure request.
• Right to Restrict Processing: You may request that bdc8 restrict processing of your personal data in certain circumstances — for example, while you dispute the accuracy of the data or while a complaint is being investigated.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of bdc8's legitimate interests, including profiling for fraud prevention purposes. bdc8 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent — particularly in the context of marketing communications — you may withdraw that consent at any time by contacting [email protected] or by using the unsubscribe link included in all marketing emails. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit a written request to [email protected], clearly stating the right you wish to exercise and providing sufficient information to verify your identity. bdc8 will acknowledge your request within 5 business days and respond substantively within 30 days. In complex cases, this period may be extended by a further 30 days, of which you will be notified.

bdc8 operates as an international offshore platform. As a result, personal data collected from Members in Bangladesh may be transferred to and processed in countries outside Bangladesh, including the jurisdiction in which bdc8's operating entity is incorporated and the jurisdictions in which its infrastructure and service providers are located.

Where personal data is transferred internationally, bdc8 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection principles. These safeguards include contractual data processing agreements with all third-party processors that incorporate standard data protection clauses.

By creating a bdc8 account and providing your personal data, you acknowledge and consent to the transfer, storage, and processing of your personal data outside Bangladesh as described in this Policy.

bdc8 operates a strict minimum age policy. The Platform is intended solely for adults aged 21 years and above. bdc8 does not knowingly collect personal data from any person under the age of 21.

If bdc8 discovers that personal data has been collected from a person under 21 years of age — whether through registration, identity verification review, or any other means — the relevant account will be closed immediately, all associated funds will be forfeited, and all personal data held in connection with that account will be deleted as quickly as is practicable, subject to any legal retention obligations.

If you believe that a person under the age of 21 has registered an account on the bdc8 platform, please report this immediately to [email protected] so that the appropriate action can be taken without delay.

The bdc8 Platform may contain references to third-party services, including payment providers and game studios. Where such references involve navigating away from the bdc8 Platform to a third-party website or application, please be aware that this Privacy Policy does not apply to the third-party destination.

bdc8 has no control over the content, privacy practices, or data handling of third-party websites and applications, and accepts no responsibility or liability for the privacy practices of any such third party. We recommend that you review the privacy policy of any third-party platform before providing your personal data to it.

bdc8 reserves the right to update or amend this Privacy Policy at any time. The effective date of the current version is stated at the top of this document. When material changes are made to this Policy, bdc8 will notify active Members via a notice posted on the Platform or by email to the address registered on your account.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must cease using the Platform and contact [email protected] to close your account. Prior to account closure, any personal data collected under previous versions of this Policy remains subject to the terms under which it was originally collected.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data bdc8 holds about you, please contact us using the details below. All contact details are provided as plain text only and are not clickable links.

• General & Privacy Enquiries: [email protected]
• Responsible Gaming & Self-Exclusion: [email protected]
• Support Hours: 24 hours a day, 7 days a week, 365 days a year (Bangladesh Standard Time, UTC+6)

bdc8 aims to acknowledge all privacy-related enquiries within 5 business days and to provide a substantive response within 30 days of receipt. Complex requests — particularly those involving erasure, portability, or objection to processing — may require additional time , of which you will be notified in advance.

bdc8 is committed to resolving all privacy-related concerns promptly and professionally. If you feel that your concern has not been adequately addressed, you retain the right to escalate the matter to the relevant data protection authority in your jurisdiction.