21bd Privacy Policy

21bd is committed to protecting the privacy of every user on its platform. We understand that entrusting us with your personal information is a significant act of confidence, and we take the responsibility that comes with that seriously. This Policy has been written in plain language wherever possible to make it accessible and clear.

This Policy applies to all personal data collected through the 21bd website at 21bd.io, including data collected during account registration, payment processing, customer support interactions, and general platform usage. It applies to all Users regardless of their location, though our Services are primarily directed at residents of Bangladesh.

21bd is the data controller in respect of the personal data described in this Policy, meaning we determine the purposes for which, and the manner in which, your personal data is processed. We are committed to processing personal data lawfully, fairly, and transparently, collecting it only for specified, explicit, and legitimate purposes, and ensuring it is kept accurate, secure, and not retained for longer than necessary.

If you have any questions about how we handle your personal data, or if you wish to exercise any of your data rights described in Section 9, please contact us at [email protected].

We collect personal data in the following categories, depending on how you interact with the 21bd platform:

We do not intentionally collect sensitive special-category data (such as racial origin, religious beliefs, health data, or political opinions) as part of normal platform operations. Where such data appears incidentally in a support communication or document submission, it is treated with the highest level of confidentiality and is not processed for any purpose beyond the immediate query.

We do not collect data directly from or about third parties. All data collected relates solely to the registered account holder.

Personal data collected by 21bd is used for the following purposes:

• Account Management: To create, maintain, and administer your 21bd account, including processing your registration, verifying your identity, and managing your account settings and preferences.
• Service Delivery: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and partner banks; to settle bets and game rounds; and to provide access to the full range of 21bd sportsbook, casino, and slot games.
• Age and Identity Verification: To verify that you meet the 21+ age requirement and to confirm your identity as part of our KYC obligations. This is a legal requirement and cannot be waived.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, multi-accounting, money laundering, and other prohibited activities as defined in the Terms & Conditions.
• Regulatory Compliance: To meet our obligations under applicable anti-money-laundering (AML), counter-terrorist financing (CTF), and financial record-keeping regulations, which require us to maintain transaction records and respond to lawful requests from competent authorities.
• Customer Support: To respond to your queries, resolve disputes, and provide technical assistance.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the performance, features, and user experience of the 21bd platform.
• Responsible Gaming: To monitor gambling behaviour patterns that may indicate problem gambling, and to administer deposit limits, loss limits, session reminders, and self-exclusion tools at your request.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates, subject to your marketing preferences (see Section 11).

Every instance of personal data processing by 21bd rests on one or more of the following legal bases:

• Contractual Necessity: The majority of data processing is required to fulfil our contractual obligations to you under the 21bd Terms & Conditions — specifically to operate your account, process payments, and deliver gaming services. Without this data, we cannot provide the Services.
• Legal Obligation: Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and record retention — are required by applicable law. We have no discretion to waive these requirements.
• Legitimate Interests: We process Technical Data and Usage Data on the basis of our legitimate interest in maintaining platform security, preventing fraud, improving our services, and conducting internal analytics. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental privacy rights.
• Consent: For marketing communications and the use of non-essential cookies, we rely on your explicit, freely given, and revocable consent. You may withdraw consent for marketing at any time (see Section 11) and adjust cookie preferences at any time.

21bd does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial use. Data is shared in the following limited and controlled circumstances only:

• Payment Service Providers: Your financial data is shared with bKash, Nagad, Rocket, Upay, and our partner banks (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) solely to process transactions you have authorised. Each provider operates under its own privacy policy and data protection obligations.
• Game Studios and Technology Providers: To deliver casino and slot games, technical session data (including your account identifier and balance information) is shared with our licensed game studio partners including Pragmatic Play, Microgaming, NetEnt, Spribe, Evolution Gaming, and Ezugi. These providers act as data processors under contractual data processing agreements with 21bd.
• Identity Verification Services: Where KYC verification is required, identity documents and personal data may be shared with third-party identity verification service providers. These providers process data on our behalf and are bound by strict confidentiality and data security obligations.
• Law Enforcement and Regulatory Authorities: We will disclose personal data to competent authorities, regulators, or law enforcement agencies where required to do so by law, court order, or legitimate official request. We will notify you of any such disclosure where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of the 21bd business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights in relation to it.

21bd uses cookies and similar tracking technologies to operate the platform, maintain session state, and improve the user experience. The following categories of cookies are in use:

• Strictly Necessary Cookies: These cookies are essential for the platform to function correctly. They maintain your login session, remember your language and currency settings, and enable secure payment flows. These cookies cannot be disabled without preventing you from using the platform.
• Performance and Analytics Cookies: These cookies collect anonymised data about how users interact with the platform — which pages are visited most frequently, how long users spend on each section, and where errors occur. This information helps us identify improvements. These cookies are set only with your consent.
• Functional Cookies: These cookies remember your preferences (such as game lobby view settings and responsible gaming limits) to provide a more personalised experience. They are set with your consent.
• Targeting and Marketing Cookies: With your consent, we may use cookies to deliver promotional content and bonus offers that are relevant to your activity on the platform. We do not use third-party advertising networks that place cookies for cross-site tracking.

You can manage your cookie preferences at any time by adjusting your browser settings. Most browsers allow you to refuse all cookies, accept only certain types, or delete existing cookies. Note that disabling strictly necessary cookies will impair your ability to use the 21bd platform.

We do not use fingerprinting, pixel tags, or cross-device tracking technologies beyond what is disclosed in this section.

21bd implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and 21bd servers is encrypted using industry-standard SSL/TLS protocols. The 21bd.io domain maintains a valid SSL certificate at all times.
• Encrypted Data Storage: Sensitive data — including payment account references, identity document images, and authentication credentials — is stored in encrypted form at rest. Encryption keys are managed separately from the data they protect.
• Access Controls: Access to personal data within 21bd's systems is restricted to authorised personnel on a strict need-to-know basis. Role-based access controls are enforced, and all access is logged and subject to audit.
• Two-Factor Authentication: 21bd supports two-factor authentication (2FA) via OTP for all account holders and applies mandatory 2FA for administrative access to platform systems.
• Regular Security Audits: 21bd conducts periodic security assessments of its infrastructure, including vulnerability scans and penetration testing, to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: 21bd maintains a documented data breach incident response plan. In the event of a confirmed breach affecting your personal data, we will notify affected users and take immediate remedial action in accordance with applicable law.

21bd retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following retention periods and principles:

• Active Account Data: Identity, contact, and financial data associated with an active account is retained for the duration of the account's active status and for a period of five (5) years following permanent account closure. This retention period is required by applicable financial and anti-money-laundering regulations.
• Transaction Records: Records of all deposits, withdrawals, bets, and game rounds are retained for a minimum of seven (7) years from the date of the transaction to satisfy financial record-keeping obligations.
• KYC and Verification Documents: Copies of identity documents submitted for KYC verification are retained for five (5) years following account closure. In cases where a suspicious activity report has been filed, documents may be retained for longer at the direction of competent authorities.
• Support Communications: Records of customer support interactions, including chat transcripts, emails, and dispute records, are retained for three (3) years from the date of the interaction.
• Technical and Usage Data: Anonymised analytics data may be retained indefinitely. Individually identifiable Technical Data (including IP address logs) is retained for a maximum of twelve (12) months from collection.
• Marketing Preferences: Records of your marketing consent and opt-out instructions are retained indefinitely to ensure compliance with your preferences.

At the end of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any individual. We do not retain personal data in identifiable form beyond the periods stated above except where required by law.

As a user of the 21bd platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]":

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being used and with whom it has been shared. We will respond to access requests within twenty (20) business days.
• Right to Rectification: If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. Where possible, you may update certain data directly via your account settings.
• Right to Erasure: You may request deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; or (c) the data has been processed unlawfully. This right is subject to our legal retention obligations — we may not be able to delete all data immediately where legal requirements mandate retention.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have contested is being verified, or where you have objected to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We will not charge a fee for exercising your data rights in ordinary circumstances. Where a request is manifestly unfounded, repetitive, or excessive, we reserve the right to charge a reasonable administrative fee or decline to act on the request, providing written reasons for this decision.

The 21bd platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21.

• Account registration requires confirmation that the applicant is aged 21 or above. All registration submissions are subject to age verification checks as part of the KYC process.
• If we become aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and close the associated account. Any funds held in such an account will be returned to the originating payment method after deducting any winnings, which will be forfeited in accordance with our Terms & Conditions.
• If you are a parent or guardian and you believe that your child may have registered an account on 21bd without your knowledge, please contact us immediately at [email protected] so that we can investigate and take appropriate action.
• 21bd strongly supports the use of parental control tools and filtering software to prevent minors from accessing online gambling platforms. We recommend that devices used by minors be appropriately secured.

With your consent, 21bd may send you marketing communications relating to promotions, bonuses, new game releases, seasonal offers (such as Eid and Pohela Boishakh specials), and platform updates. The following terms govern marketing communications:

• Opt-In: Marketing communications are sent only to Users who have provided explicit consent during registration or subsequently via account settings. We do not send unsolicited marketing messages.
• Communication Channels: Marketing communications may be delivered via email, SMS to the mobile number linked to your account, or via in-platform notifications. You may manage your preferences for each channel separately via account settings.
• Opt-Out: You may withdraw consent for marketing communications at any time by: (a) clicking the "Unsubscribe" link in any marketing email; (b) adjusting your notification preferences in account settings; or (c) contacting support at [email protected] with the subject line "Marketing Opt-Out". Opt-out requests are processed within five (5) business days.
• Service Communications: Please note that opting out of marketing communications does not affect transactional or service communications. We will continue to send you essential account notifications — such as deposit confirmations, withdrawal processing updates, password change alerts, and security notifications — regardless of your marketing preferences. These communications are not marketing in nature and are sent on the basis of contractual necessity.
• Personalisation: Where you have consented, we may use your Usage Data and game history to personalise the promotional offers we send you. You may opt out of personalised marketing while remaining opted in to general marketing by contacting support.

21bd's primary servers and data infrastructure are located in secure data centres. Certain third-party service providers — including game studio partners and identity verification providers — may process data in jurisdictions outside Bangladesh. The following safeguards apply to all international data transfers:

• Data is transferred to third-party processors in other jurisdictions only where such transfers are necessary to deliver the Services and where adequate data protection safeguards are in place.
• All international data transfers are governed by contractual data processing agreements that impose data protection standards equivalent to those described in this Policy on the receiving party.
• We do not transfer personal data to jurisdictions that lack adequate data protection frameworks without first implementing appropriate contractual safeguards.
• Where you submit KYC documents for identity verification, those documents may be processed by verification partners in their operating jurisdictions. All such partners are contractually bound to process documents solely for the purpose of verification and to delete them after the verification process is complete, subject to our retention instructions.

The 21bd platform may contain references to or integrations with third-party services — such as payment processors and game providers — whose own privacy policies and data practices are separate from and independent of this Policy. The following applies:

• 21bd is not responsible for the privacy practices or content of any third-party services. The inclusion of a third-party integration on the 21bd platform does not constitute an endorsement of that party's privacy practices.
• When you initiate a payment via bKash, Nagad, Rocket, Upay, or any partner bank, you will be interacting with that provider's own platform and systems. We strongly encourage you to review the privacy policy of any payment service you use before submitting personal or financial information.
• Game studio providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may collect certain technical session data as part of their game delivery systems. This data collection is governed by each provider's own data processing practices and our contractual agreements with them.
• If you follow any external link from 21bd content to a third-party website, your activity on that website is governed entirely by that website's own privacy policy. 21bd has no visibility into or control over how third-party websites handle your data.

21bd reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable law. The following process governs all updates to this Policy:

• The "Last Updated" date at the top of this Policy will be revised each time a change is made. The most current version of the Privacy Policy will always be accessible at 21bd.io/privacy-policy.
• Where a change is material — meaning it significantly affects how we collect, use, or share your personal data, or meaningfully alters your rights — we will notify you by email to the address registered to your account no less than fourteen (14) days before the change takes effect.
• Minor updates, such as corrections of typographical errors, clarifications that do not alter the substance of any provision, or updates required by changes in applicable law with immediate effect, may be made without advance notice. The "Last Updated" date will still be revised in all cases.
• Your continued use of the 21bd platform following the effective date of any update to this Policy constitutes your acknowledgement of the revised Policy. If you do not agree to the updated terms, you may request closure of your account by contacting [email protected].
• We recommend that you review this Privacy Policy periodically to stay informed about how 21bd collects and uses your data. Archived versions of previous policies are available on request by contacting support.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 21bd handles your personal data, please contact us using the details below. All correspondence must be submitted in English.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Privacy Request — [Your Account Username]"
• Subject Line for Complaints: "Privacy Complaint — [Your Account Username]"
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Response Time: General privacy enquiries are acknowledged within 24 hours and receive a substantive response within five (5) business days. Formal data subject requests are handled within twenty (20) business days of receipt.