26bd Privacy Policy — How We Protect Your Personal Data

26bd ("we", "us", "our") operates the online betting and casino platform accessible at https://26bd.io (the "Platform"). We are committed to safeguarding the privacy and personal data of every individual who accesses or uses our Platform, including all registered account holders and visitors based in Bangladesh and elsewhere.

This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by 26bd. This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference.

By registering an account on 26bd, making a deposit, placing a bet, or otherwise accessing the Platform, you acknowledge that you have read, understood, and consented to the practices described in this Privacy Policy. If you do not agree with this Policy, you must not use the Platform.

26bd collects several categories of personal data from users of the Platform. The specific data collected depends on how you interact with us and the services you use. The categories are as follows:

2.1 Identity Data

• Full legal name (as it appears on your National ID Card, passport, or driving licence)
• Date of birth (used to verify the 21+ age requirement)
• Gender (optional, collected during KYC verification)
• Copies of government-issued identity documents submitted during KYC verification

2.2 Contact Data

• Mobile phone number registered to a Bangladeshi mobile network (bKash, Nagad, Grameenphone, Robi, Banglalink, Teletalk)
• Email address (used for account communications and support)
• City or district of residence within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar)

2.3 Financial Data

• Mobile money account references (bKash, Nagad, Rocket, Upay) — stored as tokenised identifiers, never in plain text
• Bank account references (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank) where applicable
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used — all denominated in Bangladeshi Taka (৳ / BDT)
• Wallet balance history and bonus credit records

2.4 Betting & Gaming Activity Data

• Bet history: markets wagered on, stakes, odds, outcomes, and settlement records
• Casino game history: games played, rounds completed, stakes, and results
• Session activity: login timestamps (Bangladesh Standard Time, UTC+6), session duration, and logout timestamps
• Responsible gaming settings: deposit limits, session time limits, self-exclusion status

2.5 Technical Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Cookie identifiers and session tokens (see Section 8)
• Platform interaction logs: pages visited, features used, click patterns, and error reports

2.6 Communications Data

• Records of customer support interactions via live chat, email, and WhatsApp
• Complaints, dispute records, and associated correspondence
• Responses to voluntary surveys or feedback requests

26bd collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, placing a bet, contacting customer support, or participating in a promotion.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar tracking technologies (see Section 8).
• Payment processors: Confirmation data passed back from bKash, Nagad, Rocket, Upay, and partner banks when a financial transaction is initiated or completed.
• Identity verification partners: Data returned by third-party KYC and identity verification service providers when we verify your identity documents.
• Fraud and security systems: Data generated by our internal risk management and anti-fraud systems, which monitor transactions and betting patterns for irregular activity.

26bd processes personal data only for legitimate, specified purposes. The following table sets out the primary purposes for which we process your data and the legal basis for that processing:

26bd does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following limited, necessary circumstances:

5.1 Service Providers & Data Processors

We engage carefully selected third-party service providers who process personal data on our behalf and strictly under our instruction. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and card network partners (Visa, Mastercard) — for the purpose of processing financial transactions only.
• KYC and identity verification providers: Third-party services that verify the authenticity of identity documents submitted during account verification.
• Game studios: Evolution Gaming, Ezugi, Pragmatic Play, Microgaming, NetEnt, and Spribe receive anonymised session identifiers necessary to deliver live dealer and RNG game content. Full identity data is not shared with game studios.
• Fraud and risk management systems: Automated third-party services that analyse transaction and behavioural data to detect suspicious activity.
• Cloud infrastructure and hosting providers: Secure server infrastructure partners who store encrypted data under binding data processing agreements.

All third-party processors are contractually bound to process data solely for the specified purpose, to maintain appropriate security standards, and to delete or return data upon termination of the engagement.

5.2 Legal & Regulatory Disclosure

26bd may disclose personal data to competent governmental, regulatory, or law enforcement authorities where required by law, court order, or regulatory direction. This includes cooperation with financial intelligence units investigating money laundering or fraud, and with authorities investigating match-fixing or sports corruption in relation to the BPL, IPL, T20 World Cup, or other sporting events offered on the Platform.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of 26bd's business, personal data held by 26bd may be transferred to the acquiring entity. In such circumstances, we will provide reasonable advance notice to registered users and ensure that the receiving entity is bound by privacy obligations no less protective than those set out in this Policy.

26bd retains personal data for as long as is necessary to fulfil the purpose for which it was collected, to comply with legal obligations, and to resolve disputes or enforce agreements. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual.

26bd implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our current security infrastructure includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform, covering account registration, login, deposit and withdrawal flows, and customer support chat.
• Payment credential tokenisation: bKash, Nagad, Rocket, and Upay account references are stored as encrypted tokens. Raw payment account numbers are never retained in plain text on 26bd servers.
• One-Time Password (OTP) verification for logins from unrecognised devices, adding a second layer of authentication to protect accounts from unauthorised access.
• Role-based access controls: Internal access to personal data is restricted strictly to authorised 26bd personnel with a documented operational need. Access is logged and periodically reviewed.
• Encrypted data storage: Personal data at rest is stored in encrypted form on access-controlled servers.
• Regular security audits: 26bd conducts periodic internal security reviews and engages third-party security specialists for vulnerability assessments.
• Incident response procedures: In the event of a confirmed personal data breach that poses a risk to affected users, 26bd will notify impacted account holders and take immediate remediation steps without undue delay.

26bd uses cookies and similar tracking technologies to operate the Platform effectively, improve user experience, and analyse usage patterns. A cookie is a small text file stored on your device by your browser when you visit the Platform. Cookies do not contain executable code and cannot access other data stored on your device.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and cookies that remember your responsible gaming settings. These cookies cannot be disabled without preventing core Platform functionality.
• Functional Cookies: Store your preferences such as preferred language, display settings, and notification preferences so you do not need to re-enter them on each visit.
• Analytics Cookies: Allow us to understand how users navigate the Platform — which pages are visited most frequently, how long sessions last, and where users encounter difficulties. This data is aggregated and anonymised. We use this information solely to improve Platform performance.
• Marketing Cookies: Used only for users who have explicitly opted in to promotional communications. These cookies help us deliver relevant offers and avoid showing the same promotion repeatedly.

8.2 Managing Cookies

You may control cookie settings through your browser's privacy or settings menu. Most browsers allow you to view, block, or delete cookies at any time. Please note that disabling strictly necessary cookies will impair or prevent your ability to log in and use the Platform. Disabling analytics or marketing cookies will not affect your ability to place bets or access your account.

26bd does not use third-party advertising networks or retargeting pixel technologies on the Platform. Analytics data collected via cookies is processed internally and is not shared with social media platforms or external advertising systems.

As a user of the 26bd Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request — [Your Username]". We will respond within a reasonable period, typically within 30 calendar days.

• Right of Access: You may request a copy of the personal data 26bd holds about you, including the categories of data, the purposes for which it is processed, and any third parties to whom it has been disclosed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to overriding legal obligations — for example, financial transaction records must be retained for regulatory compliance periods regardless of an erasure request.
• Right to Restriction of Processing: You may request that 26bd restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing of your personal data carried out on the basis of legitimate interest, including profiling for fraud detection purposes. 26bd will assess whether its legitimate interests override your objection.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The 26bd Platform is strictly for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from any individual under the age of 21. The Platform implements age verification controls at the point of registration and during KYC review to enforce this requirement.

If 26bd becomes aware that personal data has been collected from an individual who is under 21 years of age, the relevant account will be immediately suspended, all associated bets voided, and all personal data associated with that account will be deleted from our systems as promptly as operationally possible, subject to any overriding legal retention obligations.

The 26bd Platform may contain references to third-party services, payment providers, and game studios. While 26bd does not embed external links to third-party websites within its main content pages, users who access game studio interfaces (such as those provided by Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, or Ezugi) are interacting with software and interfaces operated by those third parties under their own privacy policies and data processing terms.

26bd is not responsible for the privacy practices of third-party game studios or payment processors. We recommend that you review the privacy policies of any third-party service with which you interact in connection with your 26bd account. 26bd's contractual arrangements with game studios and payment processors include data protection obligations, but 26bd cannot guarantee or be held liable for the independent practices of those entities.

26bd reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. The revised Policy will be published on this page with an updated "Last Updated" date at the top of the document.

Where changes to this Policy are material — that is, where they significantly affect the rights of existing account holders or introduce new categories of data processing — 26bd will endeavour to provide advance notice to registered users via email to their registered address or via an in-platform notification. Your continued use of the Platform following publication of an updated Policy constitutes your acceptance of the revised terms.

We encourage all users to review this Policy periodically to stay informed about how 26bd protects their personal data. The current version of the Policy is always accessible at https://26bd.io/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by 26bd, please contact our support team using the details below. All privacy-related enquiries should include your registered username and a brief description of your request to allow us to respond promptly.

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the Support section of the Platform
• WhatsApp: +880 1700 000000 (plain text — not a clickable link)
• Response Time: We aim to acknowledge all privacy-related requests within 2 business days (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.

26bd is committed to resolving all privacy concerns fairly and transparently. Where a user is not satisfied with our response to a data rights request, they retain the right to seek redress through applicable legal or regulatory channels.