Privacy Policy — How bdru Handles Your Personal Data

1 Who We Are

bdru operates an online betting and casino platform available at bdru.io, designed specifically for players in Bangladesh. We offer sports betting (including cricket and other major sports), live casino games, slots, crash games, and strategy game formats. Our platform is accessible via web browser and is optimised for both desktop and mobile devices.

For the purposes of this Privacy Policy, bdru is the data controller responsible for the personal data you provide when you register, deposit, play, or otherwise interact with the platform. Our designated contact for data privacy matters is reachable at [email protected].

2 Data We Collect

We collect the following categories of personal data in the course of operating the bdru platform:

2.1 Identity & Registration Data

• Full legal name as it appears on government-issued identification
• Date of birth (used to verify the 21+ age requirement)
• Gender (optional, where provided)
• Nationality and country of residence
• National ID card number, passport number, or driving licence number (collected during identity verification)
• Photograph of identity document and, where required, a selfie for liveness verification

2.2 Contact Data

• Mobile phone number (primary contact channel and used for OTP authentication)
• Email address
• Residential address, including division, district, and postal code (Bangladesh)

2.3 Financial & Payment Data

• bKash, Nagad, Rocket, or Upay mobile wallet numbers linked to your account
• Bank account number and bank name (where bank transfer is used)
• Visa or Mastercard details (card number is tokenised; we do not store full card numbers)
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference numbers

2.4 Account & Activity Data

• Username and hashed password
• Betting and gaming history: markets wagered on, stake amounts, outcomes, session durations
• Bonus and promotion usage records
• Responsible gaming tool settings (deposit limits, self-exclusion status, cooling-off periods)
• Support communications: chat transcripts, email correspondence, complaint records

2.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Session timestamps and time-zone information
• Cookie identifiers and similar tracking technologies (see Section 7)
• Referral URL (the page from which you navigated to bdru.io, if applicable)

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data (beyond identity-document selfies used solely for age and identity verification), or health data — except where a player voluntarily discloses a health condition in the context of a responsible gaming request.

3 How We Collect Your Data

We collect personal data through the following channels:

Collection Channel	Data Collected
Account Registration Form	Name, date of birth, mobile number, email address, username, password
Identity Verification (KYC)	ID document images, selfie, address details, document numbers
Deposit & Withdrawal Flows	Payment method details, transaction amounts and timestamps
Platform Interaction	Betting history, game session data, login timestamps, feature usage
Support Channels	Live chat logs, email content, complaint details
Automated Technologies	Cookies, session tokens, IP address, device fingerprint data
Third-Party Verification Partners	Identity verification results, fraud screening outcomes

We do not purchase data from data brokers or obtain personal data from social media platforms without your explicit knowledge and consent.

4 Legal Basis for Processing

Every data processing activity carried out by bdru rests on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between bdru and the player — including account creation, payment processing, game operation, and withdrawal handling.
• Legal Obligation: Processing required to comply with applicable law — including identity verification, anti-money-laundering checks, fraud prevention, and record-keeping obligations.
• Legitimate Interests: Processing carried out in the legitimate interests of bdru or third parties, where those interests are not overridden by your rights — including platform security monitoring, responsible gaming risk assessment, and product analytics.
• Consent: Processing based on your freely given, informed, and specific consent — primarily for marketing communications. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

5 How We Use Your Data

The personal data we collect is used exclusively for the following purposes:

5.1 Account Operations

To create, manage, and secure your bdru account; to authenticate your identity at login; to process deposits and withdrawals; and to credit winnings and bonuses to your balance.

5.2 Identity Verification & Compliance

To verify that you meet the 21+ age requirement and to perform Know Your Customer (KYC) checks as required under anti-money-laundering obligations. Your identity documents are reviewed by our verification team and/or an automated third-party verification service and are not used for any other purpose.

5.3 Customer Support

To respond to your enquiries, complaints, and requests submitted via live chat or email. Support records are retained to ensure continuity of service and to resolve disputes.

5.4 Responsible Gaming

To monitor your account activity for indicators of problem gambling behaviour; to apply and enforce deposit limits, cooling-off periods, and self-exclusion requests you have set; and to proactively reach out where our responsible gaming algorithms flag a potential concern.

5.5 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, money laundering, and other prohibited activities. This includes automated screening of transaction patterns and IP-based geolocation checks.

5.6 Platform Improvement

To analyse aggregated, anonymised usage data to improve the platform's performance, user experience, game selection, and payment processing reliability. No individually identifiable data is used for product analytics in a way that is not disclosed in this policy.

5.7 Marketing (With Consent)

To send you promotional offers, bonus notifications, and platform news via SMS, email, or in-platform notifications — but only where you have opted in to marketing communications. See Section 12 for full details on managing your marketing preferences.

6 Sharing Your Data

bdru does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

6.1 Service Providers

We engage carefully selected third-party service providers who process data on our behalf and under our instructions. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, and Mastercard network operators), identity verification partners, cloud hosting providers, customer support platform operators, and fraud detection services. All service providers are contractually bound to process data only as instructed by bdru and to implement appropriate security measures.

6.2 Game Providers

Casino and game content on the bdru platform is supplied by third-party studios including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe. When you play a game supplied by these studios, technical data necessary to operate the game session (such as session token, stake, and result data) is transmitted to the relevant provider's servers. Game providers do not receive your full identity or payment data.

6.3 Legal & Regulatory Disclosures

We may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies where we are legally compelled to do so — for example, in response to a lawful court order, anti-money-laundering investigation, or official regulatory request. We will notify you of such disclosures where we are legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, player data may be transferred to the acquiring entity as part of that transaction. We will provide notice via the platform prior to any such transfer and the receiving entity will be required to honour this Privacy Policy.

6.5 Aggregate & Anonymised Data

We may share aggregated, anonymised statistical data — such as the total number of active players or the most popular game categories — with business partners or in public communications. This data cannot be used to identify any individual player.

7 Cookies & Tracking Technologies

bdru uses cookies and similar tracking technologies to operate the platform reliably, maintain your login session, remember your preferences, and gather anonymised analytics data.

7.1 Types of Cookies We Use

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your authenticated session, remember language preference, enable payment flows	Session / up to 24 hours
Functional	Remember game lobby preferences, responsible gaming alerts, and display settings	Up to 90 days
Analytics	Measure page performance, navigation patterns, and feature engagement (anonymised)	Up to 12 months
Fraud Prevention	Device fingerprinting to detect suspicious login patterns and multi-accounting attempts	Up to 6 months

Strictly necessary cookies cannot be disabled as they are essential to the platform's core functions. You may manage functional and analytics cookies through your browser's cookie settings. Please note that disabling functional cookies may affect your platform experience.

We do not use third-party advertising cookies or behavioural tracking pixels that share your data with ad networks.

8 Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• Transaction and financial data: Retained for a minimum of 5 years from the date of each transaction.
• Support and communication records: Retained for 3 years from the date of last interaction, or longer where an open dispute or complaint remains unresolved.
• Marketing preferences: Retained until you withdraw consent or the account is closed, whichever is earlier.
• Technical and device data: Retained for up to 12 months from collection, unless retained longer as part of a fraud investigation.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data set may be retained indefinitely for statistical purposes as it no longer constitutes personal data.

9 Data Security

bdru implements a layered security framework to protect your personal data against unauthorised access, loss, disclosure, or destruction. Key security measures in place include:

• Encryption in Transit: All data transmitted between your device and the bdru platform is encrypted using TLS 1.2 or higher (SSL). The padlock icon in your browser confirms this connection is secure.
• Encryption at Rest: Sensitive personal data — including identity documents, payment method identifiers, and passwords — is encrypted at rest using strong, industry-standard encryption algorithms. Passwords are stored as salted hashes and are never stored in plain text.
• Access Controls: Access to personal data within bdru's internal systems is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to confidentiality obligations and regular access reviews.
• Fraud Monitoring: Automated systems continuously monitor for unusual login patterns, transaction anomalies, and device changes that may indicate account compromise.
• Vulnerability Management: We conduct regular security assessments of our platform infrastructure. Known vulnerabilities are patched promptly in accordance with our internal patch management policy.

While we apply rigorous technical and organisational safeguards, no internet-based platform can guarantee absolute security. In the event of a data breach that poses a high risk to your rights and freedoms, we will notify affected players promptly and take immediate remedial action.

10 Your Rights

As a bdru player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data. For account details such as mobile number and email address, you may update these directly in your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal retention obligations (see Section 8) and will not apply where data must be retained to comply with anti-money-laundering law.
• Right to Restriction: You may request that we restrict the processing of your data in certain circumstances — for example, while an accuracy dispute is being resolved.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, and to object at any time to the processing of your data for direct marketing purposes.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We will not charge a fee for handling data rights requests unless a request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or refuse to act.

11 Children & Minors

The bdru platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is performed as part of the account registration and KYC process.

If we discover that personal data has been collected from a person under the age of 21, that account will be immediately closed, all balances will be handled in accordance with our Terms & Conditions, and the personal data collected will be securely deleted to the extent permitted by law.

If you believe that a person under the age of 21 has registered a bdru account, please notify us immediately at [email protected].

12 Marketing Communications

bdru may send you promotional communications — including bonus offers, game announcements, and seasonal promotions (such as Eid or Pohela Boishakh specials) — via SMS, email, or in-platform notification, but only where you have given your explicit consent to receive marketing at the time of registration or subsequently through your account settings.

12.1 Opting Out

You may withdraw your consent to marketing communications at any time by:

• Updating your notification preferences in your bdru account dashboard under "Communication Settings"
• Clicking the unsubscribe link included in any marketing email
• Contacting our support team at [email protected] and requesting removal from all marketing lists

Opt-out requests are processed within 5 business days. Please note that transactional and account-related communications (such as deposit confirmations, withdrawal notifications, and security alerts) are not marketing communications and will continue to be sent regardless of your marketing preference settings.

12.2 Profiling for Marketing

We may use aggregated account activity data to personalise the promotional offers we send you — for example, sending cricket betting offers to players who regularly wager on cricket markets. This personalisation is based on your activity with us and does not involve sharing your data with external marketing platforms.

13 Third-Party Links

The bdru platform may contain references to third-party game providers and payment partners. While we take care to work only with reputable partners, bdru does not control the privacy practices of third-party services and is not responsible for their privacy policies or data-handling practices. We recommend reviewing the privacy policy of any third-party service you interact with directly.

14 Amendments to This Policy

bdru reserves the right to update this Privacy Policy at any time. When a material change is made — such as a change to the categories of data we collect, a new data-sharing arrangement, or a change to retention periods — we will notify registered players by email and display a prominent notice on the platform at least 14 days before the change takes effect.

The revised policy will be published on this page with an updated effective date. Continued use of the bdru platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy. If you do not agree with any changes, you must cease using the platform and contact support to arrange account closure.

For minor, non-material changes such as typographical corrections or clarifications that do not alter the substance of our data-handling practices, we will update this page without prior notice but will update the effective date accordingly.

15 Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way bdru processes your personal data, please contact our privacy team using the following details:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" for faster routing
• Live Chat: Available 24/7 via your bdru account dashboard
• Response Target: We aim to respond to all privacy-related enquiries within 48 hours and to data rights requests within 30 calendar days
• Support Hours: 24/7 — Bangladesh Standard Time (UTC+6)

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection authority or seek resolution through applicable legal channels in your jurisdiction.