27bd Privacy Policy

This Privacy Policy ("Policy") describes how 27bd ("27bd", "we", "us", "our") collects, processes, stores, discloses, and protects personal data relating to individuals ("you", "your", "Player", "User") who visit, register on, or interact with the 27bd platform at https://27bd.io, including all associated subdomains, mobile interfaces, APIs, and related digital services (collectively, the "Platform").

We are committed to handling your personal data responsibly and transparently, in accordance with applicable data protection principles. By registering an account on the 27bd platform, depositing funds, placing bets, or otherwise using any feature of the Platform, you acknowledge that you have read this Policy and that you consent to the collection and processing of your personal data as described herein.

This Policy should be read alongside the 27bd Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into this document.

27bd is an online betting and casino platform operated as an internationally licensed gambling service. The Platform offers sports betting (including cricket and football), live casino games, slot titles, and a BDT-denominated player wallet — serving players aged 21 and above, primarily in the Bangladesh market.

For the purposes of data protection, 27bd acts as the data controller in respect of personal data collected directly from players through the Platform. Where 27bd engages third-party service providers to process data on its behalf, those providers act as data processors under written data processing agreements.

For all privacy-related enquiries, you may contact us at: [email protected]

27bd collects personal data through several channels: information you provide directly during registration and verification; data generated automatically by your use of the Platform; and, in limited circumstances, data received from trusted third-party verification partners. The categories of personal data we collect are described below.

3.1 Registration Data

When you create a 27bd account, we collect the information you provide in the registration form, which typically includes:

• Full legal name
• Date of birth (to verify you are aged 21 or above)
• Email address
• Mobile phone number
• Chosen username and password (password is stored in hashed form and is never accessible to 27bd staff)
• Country and city of residence

3.2 Identity Verification (KYC) Data

To comply with anti-money-laundering (AML) obligations and to verify your age, 27bd may request and retain copies of identity documents including:

• National Identity Card (NID) or passport
• Driver's licence
• Utility bill or bank statement (proof of address, dated within 90 days)
• Screenshot or confirmation of ownership of the bKash, Nagad, or other payment account used for deposits

3.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates, and payment method identifiers
• bKash and Nagad mobile wallet numbers (partially masked in our systems after verification)
• Bank account details where bank transfer is used
• Transaction reference numbers issued by payment processors

3.4 Betting and Gaming Activity Data

• Bets placed, sports markets selected, odds accepted, and settlement outcomes
• Casino and slot game sessions, game titles played, wager amounts, wins, and losses
• Bonus claims, wagering progress, and promotion participation history
• Account balance snapshots and wallet transaction logs

3.5 Technical and Usage Data

When you access the 27bd Platform, our servers and analytics systems automatically record the following categories of technical data:

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session timestamps, pages visited, and navigation paths
• Referring URL (the URL from which you arrived at 27bd)
• Device fingerprint identifiers used for fraud detection and duplicate-account prevention
• Cookie identifiers and local storage tokens (see Section 07)

3.6 Communications Data

If you contact 27bd support, or communicate with us via any channel, we retain records of those communications — including email threads, live chat transcripts, and any attachments — for quality assurance, dispute resolution, and legal compliance purposes.

The table below summarises the primary data categories and their collection source:

27bd uses your personal data for the specific, defined purposes described below. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected.

• Account Management: To create and maintain your 27bd player account, authenticate your identity at login, process password resets, and manage your account settings and preferences.
• Age and Identity Verification: To confirm that you are aged 21 or above and to verify the accuracy of the personal information provided during registration, in compliance with our responsible gaming obligations.
• Transaction Processing: To process deposits, withdrawals, and refunds through your chosen payment method (bKash, Nagad, Rocket, bank transfer, or card) and to maintain accurate transaction records.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, duplicate account creation, and other prohibited conduct. This includes using device fingerprinting and IP analysis tools.
• Customer Support: To respond to your enquiries, resolve disputes, investigate complaints, and provide assistance with account issues.
• Regulatory Compliance: To fulfil our legal obligations under applicable anti-money-laundering, know-your-customer, and data protection frameworks, and to respond to lawful requests from regulatory or law enforcement authorities.
• Platform Improvement: To analyse aggregate usage patterns, identify technical issues, test new features, and improve the overall performance and user experience of the 27bd platform.
• Responsible Gaming: To monitor betting patterns that may indicate problematic gambling behaviour, to enforce self-exclusion requests, and to implement deposit limits and session reminders requested by players.
• Marketing Communications (opt-in only): To send you promotional offers, bonus notifications, seasonal promotions (such as Eid or BPL-related offers), and platform news — but only where you have explicitly opted in to receive such communications. You may withdraw consent at any time.

27bd relies on the following legal bases to process your personal data, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and 27bd — i.e., to operate your betting account, process your deposits and withdrawals, settle your bets, and deliver the services you have registered for.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money-laundering statutes, KYC requirements, and data retention mandates.
• Legitimate Interests: Processing that is necessary for 27bd's legitimate business interests, including fraud prevention, platform security, abuse detection, and internal analytics — provided those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — for example, sending you marketing communications or placing non-essential analytical cookies on your device. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

27bd does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Data is shared only in the following limited and controlled circumstances:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard receive only the transaction data necessary to process your specific payment instruction. These providers operate under their own privacy frameworks and are not permitted to use your data for any purpose beyond payment processing.
• KYC and Identity Verification Partners: Where 27bd uses a third-party identity verification service to cross-check your identity documents, that provider receives only the data necessary to perform the verification check and is contractually prohibited from retaining or repurposing it.
• Game Software Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymised player identifier to facilitate game delivery. They do not receive your full name, contact details, or financial data.
• IT Infrastructure and Cloud Hosting Providers: 27bd uses third-party hosting and infrastructure services to operate the Platform. These providers act as data processors under signed data processing agreements and access data solely to provide the agreed infrastructure services.
• Legal and Regulatory Authorities: 27bd may disclose personal data to governmental bodies, law enforcement agencies, courts, or regulators where required to do so by law, court order, or other binding legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of 27bd's business or assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the applicable privacy terms before your data is processed under a new controller.

27bd uses cookies, web beacons, pixel tags, local storage tokens, and similar technologies ("Cookies") to operate and improve the Platform. Below is a description of the categories of Cookies we use and their purpose.

7.1 Strictly Necessary Cookies

These Cookies are essential for the Platform to function and cannot be disabled without breaking core functionality. They include session authentication tokens that keep you logged in, CSRF protection tokens, and load-balancing identifiers. No consent is required for these Cookies as they are necessary to deliver the service you have requested.

7.2 Functional Cookies

These Cookies remember your preferences and personalisation choices — for example, your preferred language, last visited section, and display settings. They improve the quality of your experience but are not strictly essential to the operation of the Platform.

7.3 Analytical Cookies

27bd uses analytical cookies to understand how players navigate the Platform in aggregate — which pages are most visited, where users encounter errors, and how different features are used. This data is processed in anonymised or pseudonymised form and is used solely to improve the Platform. These Cookies require your consent.

7.4 Fraud Prevention and Security Tokens

Certain identifiers stored locally on your device are used by our fraud detection systems to recognise your device across sessions and detect anomalous access patterns — for example, a login from an unrecognised device in an unusual location. These are considered strictly necessary from a security perspective.

27bd retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

After the applicable retention period has expired, personal data is either securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

27bd implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include, but are not limited to:

• Transport Encryption: All data transmitted between your browser or device and the 27bd Platform is encrypted using TLS 1.2 or TLS 1.3 protocols. Our SSL certificate is maintained and renewed automatically.
• Data-at-Rest Encryption: Sensitive data stored in our databases — including identity documents, payment references, and hashed passwords — is encrypted using AES-256 encryption with access controlled by hardware security modules.
• Access Controls: Access to personal data within 27bd's internal systems is strictly role-based. Only staff members with a verified operational need are permitted to access specific categories of data, and all access events are logged.
• Two-Factor Authentication: 27bd supports and encourages two-factor authentication (2FA) for all player accounts. Internal staff access to sensitive systems requires mandatory 2FA.
• Fraud Detection Systems: Automated systems monitor transaction patterns, login behaviour, and device signals in real time to detect and flag suspicious activity for manual review.
• Penetration Testing: 27bd conducts periodic security assessments including vulnerability scans and penetration tests to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to your rights, 27bd will notify affected players promptly and take immediate containment action.

As a player on the 27bd platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] from the email address registered to your account.

• Right of Access: You have the right to request a copy of the personal data that 27bd holds about you. We will provide this information within 30 days of a verified request, free of charge for the first request in any 12-month period.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You can update basic profile information directly within your account settings; for identity document corrections, please contact support.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to legal retention obligations — we cannot erase data we are legally required to retain.
• Right to Restrict Processing: You may request that 27bd restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed.
• Right to Object: You have the right to object to processing based on our legitimate interests. You also have an unconditional right to object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where 27bd processes your data on the basis of your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

The 27bd platform is strictly intended for adults aged 21 and above. 27bd does not knowingly collect personal data from individuals under the age of 21 under any circumstances. Age verification is a mandatory step during the account registration process and is repeated as part of the KYC verification procedure.

If 27bd discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, that account will be immediately suspended, all associated data will be reviewed, and the account will be permanently closed in accordance with our Terms & Conditions. Any deposited funds will be handled in accordance with applicable legal requirements.

If you are a parent or guardian and believe that a minor in your care has registered an account on 27bd, please contact us immediately at [email protected]. We will investigate and take prompt remedial action.

27bd operates as an internationally hosted platform. Your personal data may be stored on servers located outside Bangladesh, in jurisdictions where data protection standards may differ from those applicable in your country of residence.

Where such transfers occur, 27bd ensures that appropriate safeguards are in place to protect your data at a level equivalent to the protections described in this Policy. These safeguards include:

• Contractual data protection clauses with all international data processors, requiring them to apply data handling standards consistent with this Policy.
• Restricting international transfers to jurisdictions with robust and independently audited data protection frameworks.
• Conducting due diligence on all third-party processors before data is transferred, including reviewing their security certifications and incident history.

If you would like further information about the specific safeguards applicable to any international transfer of your personal data, please contact us at [email protected].

27bd reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal requirements. When material changes are made, we will:

• Update the "Effective Date" displayed at the top of this page.
• Notify registered players via the email address associated with their 27bd account, providing a summary of the key changes and a link to the updated Policy.
• Where a change requires fresh consent (for example, a new category of data processing that was not previously disclosed), we will present an explicit consent request before the new processing begins.

Your continued use of the 27bd platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes, you should cease using the Platform and contact [email protected] to request account closure before the revised Policy takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 27bd, please use the contact details below. All privacy-related communications must be sent from the email address registered to your 27bd account so that your identity can be confirmed before any account-related action is taken.

• Email: [email protected]
• Subject Line for Privacy Requests: Privacy Request – [Your Registered Email]
• Support Hours: 24 hours a day, 7 days a week, 365 days a year
• Response Time: Within 30 calendar days for data subject rights requests; within 24 hours for general privacy enquiries