Your Privacy Matters at 35db

1 Introduction

35db is an online betting and casino entertainment platform serving players in Bangladesh. We are committed to handling your personal information responsibly, transparently, and securely. This Policy has been written in plain English so that you can clearly understand what data we hold about you and how we use it.

Privacy is not an afterthought at 35db — it is built into the architecture of our platform. Every data collection decision is evaluated against the principle of proportionality: we ask whether the benefit of collecting a given piece of information justifies the privacy impact on our players. Where it does not, we do not collect it.

This Policy uses the term "personal data" to mean any information that identifies you or could reasonably be used to identify you — this includes your name, mobile number, email address, National ID number, payment wallet details, device identifiers, and IP address.

2 Data Controller

For the purposes of this Privacy Policy, 35db is the data controller — the entity that determines the purposes and means by which your personal data is processed. All data rights requests, privacy queries, and consent withdrawal notices should be directed to:

3 What We Collect

The categories of personal data we may collect from you include, but are not limited to, the following:

We do not knowingly collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric data beyond what is strictly required for identity verification purposes (e.g., a facial photograph matched against a government-issued ID).

4 How We Collect Your Data

35db collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting our support team, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access and use the 35db platform, via server logs, session trackers, and analytics tools.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, and Upay when you initiate a deposit or withdrawal.
• Identity verification partners: Data returned by our KYC verification service provider when it cross-checks the documents you submit against authoritative sources.
• Fraud prevention services: Device fingerprint data and risk scores returned by third-party fraud detection tools to protect the integrity of our platform.
• Cookies and similar technologies: Session and behavioural data collected via cookies placed on your browser when you visit 35db.io. See Section 8 for full details.

5 How We Use Your Data

35db uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and securing your 35db account, including verifying your identity and age at registration and at subsequent KYC checkpoints.
• Service delivery: Processing deposits and withdrawals via bKash, Nagad, Rocket, and Upay; crediting winnings; applying bonuses; and resolving bet or game disputes.
• Fraud prevention and security: Detecting and preventing unauthorised access, account takeover, multi-account abuse, bonus fraud, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Legal and regulatory compliance: Meeting our obligations under anti-money laundering (AML) requirements, maintaining financial transaction records, and responding to lawful requests from authorities.
• Responsible gaming: Monitoring betting and gaming patterns to identify players who may be exhibiting signs of problem gambling, and proactively offering responsible gaming tools including deposit limits, self-exclusion, and reality checks.
• Customer support: Handling your enquiries, resolving disputes, and providing technical assistance via our support team at [email protected].
• Platform improvement: Analysing aggregated, anonymised usage data to understand how players interact with 35db and to improve the design, performance, and content of our services.
• Marketing communications: Sending you promotional offers, bonus notifications, and event information (e.g., BPL cricket betting promotions, Eid special offers) where you have consented to receive such communications. You may opt out at any time.

35db does not use automated decision-making — including profiling — that produces legal or similarly significant effects on you without human review. Where automated systems flag an account for investigation, a member of the 35db team manually reviews the case before any action is taken.

6 Legal Basis for Processing

Each data processing activity carried out by 35db rests on one of the following legal bases:

• Contract performance: Processing necessary to fulfil our obligations under the account agreement with you — for example, processing a withdrawal request or settling a bet outcome.
• Legal obligation: Processing required to comply with applicable law — for example, retaining transaction records for AML compliance or responding to a verified law enforcement request.
• Legitimate interests: Processing carried out to protect 35db's business interests and the safety of our platform, where those interests are not overridden by your rights — for example, fraud detection, security monitoring, and platform analytics.
• Consent: Processing based on your express, freely given, specific consent — for example, sending you marketing emails or SMS messages about promotions. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7 Sharing Your Data

35db shares personal data with third parties only where strictly necessary and only in the categories described below. We do not sell personal data to any third party.

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum necessary transaction data (account identifier, amount, reference) to process deposits and withdrawals on your behalf.
• KYC and identity verification providers: Your identity documents and related data are shared with our licensed KYC partner to verify your identity and age. This partner is contractually bound to use the data solely for verification purposes.
• Game content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe, and other licensed game developers receive session tokens and anonymised player identifiers necessary to deliver their games. They do not receive your full identity data.
• Fraud detection and cybersecurity services: Technical data including device fingerprints and IP addresses may be shared with fraud prevention partners to protect the platform and all of its players.
• Legal and regulatory authorities: 35db will disclose personal data where required by a valid court order, regulatory directive, or law enforcement request. We will, where legally permitted, notify you of such a disclosure.
• Business transfers: In the event that 35db undergoes a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to this Privacy Policy that result from it.

All third-party service providers who handle your personal data on behalf of 35db are required to sign data processing agreements that obligate them to process your data only on our documented instructions, to apply appropriate technical and organisational security measures, and to delete or return the data at the end of the service engagement.

8 Cookies & Tracking Technologies

35db uses cookies and similar technologies (including local storage and session tokens) to operate the platform securely, remember your preferences, and understand how players use our services. The cookies we use fall into the following categories:

Strictly necessary cookies cannot be disabled, as they are essential for the platform to function. You may control functional and analytics cookies through your browser settings or by contacting [email protected]. Note that disabling certain cookies may affect the functionality or personalisation of the 35db platform experience.

35db does not use third-party advertising cookies or permit ad networks to place tracking pixels on our platform. We do not engage in cross-site behavioural advertising.

9 Data Retention

We retain personal data for as long as is necessary to fulfil the purposes set out in this Policy, to maintain your account, and to comply with our legal obligations. The following retention periods apply:

• Active account data (identity, contact, financial data): Retained for the full duration of your account relationship with 35db, plus a minimum of five years following account closure.
• Transaction records (deposit, withdrawal, betting history): Retained for a minimum of five years from the date of each transaction, in compliance with AML record-keeping requirements.
• KYC documents (scanned NID, passport, selfie): Retained for a minimum of five years following the verification date or account closure, whichever is later.
• Support communications (emails, chat transcripts): Retained for three years from the date of the communication, unless the subject matter relates to an open dispute or investigation.
• Technical and usage logs (IP addresses, session data): Retained for 13 months from the date of collection, then deleted or anonymised.
• Marketing preferences: Retained indefinitely to honour your opt-out preferences and prevent accidental re-subscription, unless you request deletion of all records.

When a retention period expires, 35db securely deletes the data using industry-standard data destruction methods, or anonymises it so that it can no longer be associated with any individual.

10 Security Measures

35db implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS 1.2 / 1.3 encryption for all data in transit between your browser and our servers.
• AES-256 encryption for sensitive data at rest, including identity documents and financial records.
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific job function.
• Multi-factor authentication (MFA) for all internal systems and administrative access points.
• Regular third-party penetration testing and vulnerability assessments of the 35db platform infrastructure.
• 24/7 monitoring of platform infrastructure for anomalous access patterns, intrusion attempts, and data exfiltration indicators.
• A documented and tested incident response plan, including player notification procedures in the event of a confirmed data breach.

11 Your Data Rights

As a user of the 35db platform, you have the following rights with respect to your personal data:

• Right of access: You may request a copy of all personal data 35db holds about you. We will provide this in a structured, commonly used format within 30 days.
• Right to rectification: If any of your personal data is inaccurate or incomplete, you have the right to request that we correct it. For account details, you may update many fields directly in your account settings.
• Right to erasure: You may request that we delete your personal data. This right is subject to our legal retention obligations — for example, we cannot delete transaction records that we are legally required to retain for AML compliance. We will inform you clearly if any portion of your erasure request cannot be fulfilled and explain why.
• Right to restrict processing: In certain circumstances — for example, while you dispute the accuracy of your data — you may request that we restrict the processing of your personal data to storage only.
• Right to data portability: You have the right to receive the personal data you have provided to 35db in a machine-readable format (e.g., CSV or JSON) so that it can be transferred to another service provider.
• Right to object: You may object to processing of your personal data where that processing is based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

12 Minors

If you believe that a minor has registered an account on 35db or that their personal data has been collected by our platform, please contact us immediately at [email protected]. We take this matter extremely seriously and will act within 24 hours of receiving a verified report.

Our KYC verification process — which requires submission of a government-issued identity document confirming date of birth — is our primary mechanism for preventing underage access to the platform. This process is applied to every account before withdrawal privileges are enabled, and may be applied at registration at our discretion.

13 Third-Party Links

The 35db platform may contain references to third-party game providers and payment services. While we take care to work only with reputable, licensed partners, 35db is not responsible for the privacy practices of those third parties. This Privacy Policy applies solely to data collected and processed by 35db through the 35db.io platform.

Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi operate under their own privacy frameworks and data governance policies. When you interact with a game delivered by one of these providers within the 35db platform, the game session is facilitated via a secure API integration. Your full identity data is never passed to game providers — only anonymised session tokens are used.

Payment partners including bKash, Nagad, Rocket, and Upay are independent data controllers in respect of data you provide directly to them when initiating wallet transactions. We encourage you to review the privacy policies of those services independently.

14 Changes to This Policy

35db reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page and in the sidebar.
• Display a prominent notice on the 35db platform for a minimum of 14 days following the update.
• Send a notification to your registered email address if the changes materially affect your rights or the way we use your data.

Your continued use of the 35db platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Policy, you should discontinue use of the platform and may request account closure by contacting [email protected].

We recommend reviewing this Privacy Policy periodically to stay informed of how 35db protects your personal information. Historical versions of this Policy are available upon request.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 35db processes your personal data, please reach out to our dedicated privacy team. We are committed to responding to all legitimate privacy enquiries thoroughly and within the timeframes stated in this Policy.

For urgent security matters — such as suspected unauthorised access to your account or a potential data breach — please use the same email address and mark your subject line as "URGENT – Security Issue". Our security team monitors this inbox around the clock, Bangladesh Standard Time (BST, UTC+6).