Privacy Policy — How db365 Collects, Uses, and Protects Your Personal Data

1 Introduction & Scope

1.1 This Privacy Policy applies to all personal data processed by db365 in connection with the operation of the db365 online betting and casino platform, including the website at db365.io, any associated mobile-optimised interfaces, and all customer support channels operated by db365.

1.2 This Policy applies to all current and former players who have registered a db365 account, as well as to individuals who browse the db365 website without registering ("visitors"). Where distinctions exist between the data processing activities applicable to registered players and unregistered visitors, those distinctions are noted in the relevant clause.

1.3 This Policy does not apply to third-party websites, payment processors, or services that may be linked to or integrated with the db365 platform. db365 is not responsible for the privacy practices of third parties, including bKash, Nagad, Rocket, Upay, game providers such as Pragmatic Play, Evolution Gaming, Ezugi, and Spribe, or any other external service provider. Players should review the privacy policies of those third parties independently.

1.4 This Policy is to be read alongside the db365 Terms & Conditions and the Responsible Gaming Policy, both of which are available on the db365 website and are incorporated into the overall framework governing your relationship with db365.

2 Data Controller

2.1 For the purposes of this Privacy Policy, db365 is the data controller — the entity that determines the purposes and means by which your personal data is processed. db365 is the operator of the db365 platform and bears responsibility for ensuring that personal data is handled in accordance with this Policy.

2.2 If you have any questions about how db365 processes your personal data, or if you wish to exercise any of the rights described in Clause 11 of this Policy, you may contact the db365 Data Protection team at the following address:

3 Personal Data We Collect

3.1 db365 collects the following categories of personal data, depending on the nature of your interaction with the platform:

3.1.1 Identity Data

• Full legal name as it appears on your National Identity Card (NID), passport, or birth certificate;
• Date of birth (for mandatory age verification — db365 is a 21+ platform);
• Government-issued identification number (NID number, passport number);
• Photograph (where submitted as part of KYC documentation).

3.1.2 Contact Data

• Email address;
• Mobile telephone number (including the number registered to your bKash, Nagad, Rocket, or Upay mobile wallet);
• Residential address (city, district — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar) where required for KYC.

3.1.3 Financial & Transaction Data

• Deposit history including amount (in Bangladeshi Taka ৳), date, time, and payment method used;
• Withdrawal history including amount, destination payment method, and processing status;
• Account balance at any given time;
• Bonus amounts claimed and wagering progress records.

3.1.4 Technical Data

• IP address at time of registration, login, and each session;
• Device type, operating system, browser type, and version;
• Session identifiers and authentication tokens;
• Geolocation data at the city or district level (derived from IP address — db365 does not use GPS-level tracking).

3.1.5 Usage & Behavioural Data

• Pages visited, links clicked, time spent on each page;
• Games launched, bets placed, bet amounts, game outcomes, and session duration;
• Responsible gaming tool usage (deposit limits set, cool-off periods activated, self-exclusion requests).

3.1.6 Communications Data

• Content of live chat messages, email correspondence, and any other communications with db365 support or compliance teams;
• Records of marketing emails sent and whether they were opened or acted upon (only where consent to marketing has been given).

4 How We Collect Your Data

4.1 db365 collects personal data through the following channels:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, respond to surveys, or participate in promotions;
• Automated technologies: Technical and usage data collected automatically as you browse and use the db365 platform, via cookies, server logs, and session tracking technologies (see Clause 10);
• Third-party payment providers: Transaction confirmation data received from bKash, Nagad, Rocket, and Upay when you initiate a deposit or withdrawal — db365 receives only the confirmation and reference data, not your wallet PIN or bank credentials;
• Third-party game providers: Aggregated game-round data and bet-result data from licensed providers such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, and Microgaming, used for account management and dispute resolution;
• Verification services: Identity verification outcomes from KYC document review processes used to confirm your identity and age.

4.2 db365 does not purchase personal data lists from third parties or obtain personal data from social media platforms without your explicit consent.

5 How We Use Your Personal Data

5.1 db365 uses personal data for the following specific purposes:

• Account management: To create, maintain, and administer your db365 account, including processing login requests, account settings changes, and account closure requests;
• Identity & age verification: To confirm that you are 21 years of age or older, as required under our player protection obligations, and to verify that you are who you say you are;
• Payment processing: To process deposits and withdrawals in Bangladeshi Taka via bKash, Nagad, Rocket, Upay, and other accepted payment methods, and to confirm ownership of the payment instruments used;
• Fraud prevention & security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, multi-accounting, and other prohibited conduct described in the db365 Terms & Conditions;
• Responsible gaming: To monitor betting patterns for indicators of problem gambling, to enforce deposit limits and self-exclusion orders, and to comply with our responsible gaming obligations;
• Customer support: To respond to your enquiries, resolve disputes, and maintain accurate records of communications for quality assurance;
• Legal & regulatory compliance: To meet our obligations under applicable anti-money laundering (AML) requirements, record-keeping obligations, and any lawful request from competent authorities;
• Platform improvement: To analyse usage patterns and technical performance data to improve the db365 website, game offerings, and payment flow;
• Marketing communications: To send you promotional offers, bonus notifications, and news about db365 — but only where you have given your explicit consent to receive such communications (see Clause 14).

5.2 db365 does not use your personal data for any automated decision-making that produces legal effects concerning you, other than fraud-scoring and responsible gaming monitoring algorithms that may trigger account review processes. Where such automated processes flag an account, a human review is conducted before any material action is taken.

6 Lawful Bases for Processing

6.1 db365 processes your personal data on the following lawful bases:

• Contractual necessity: Processing required to perform the contract between db365 and you — including operating your account, processing payments, verifying your identity, and resolving disputes;
• Legal obligation: Processing required to comply with applicable laws, including AML requirements, age verification obligations, and record-keeping mandates;
• Legitimate interest: Processing carried out on the basis of db365's legitimate business interests — including fraud detection, platform security, technical analytics, and customer service improvement — where those interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing activities that rely on your freely given, specific, informed, and unambiguous consent — in particular, the sending of marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Sharing Your Personal Data

7.1 db365 does not sell, rent, or commercially disclose your personal data to third parties. db365 shares personal data only in the following limited circumstances:

7.1.1 Payment Service Providers

db365 shares the minimum necessary data with bKash, Nagad, Rocket, Upay, and any other accepted payment providers to process deposits and withdrawals. This data is limited to the information required to complete the transaction and confirm ownership of the payment instrument.

7.1.2 Game Technology Providers

Where you play games powered by third-party providers such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, or Microgaming, a pseudonymous player identifier and bet/game session data are shared with those providers to operate the game correctly and generate certified results. Your full name and financial data are not shared with game providers.

7.1.3 Identity Verification Services

Where required for KYC compliance, db365 may share your identity documents and personal details with a trusted identity verification service provider for the sole purpose of confirming your identity and age. Such providers are bound by strict data processing agreements.

7.1.4 Legal & Regulatory Authorities

db365 may disclose personal data to competent legal or regulatory authorities where required to do so by law, court order, or other lawful process. db365 will not disclose more data than is strictly required by the applicable legal obligation.

7.1.5 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of db365's assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to the same protections described in this Policy. db365 will notify registered players of any such transfer where notification is reasonably practicable.

8 International Data Transfers

8.1 The db365 platform serves players in Bangladesh. Some of the third-party service providers used by db365 — including game technology providers and cloud infrastructure partners — may process data outside Bangladesh. Where such transfers occur, db365 ensures that appropriate safeguards are in place to protect your personal data at a standard equivalent to that described in this Policy.

8.2 Safeguards used for international transfers may include contractual data protection clauses, data processing agreements incorporating equivalent privacy standards, or transfers to entities in jurisdictions recognised as providing adequate levels of data protection.

8.3 db365 does not transfer your personal data internationally for the purpose of circumventing any data protection obligation applicable to its operations. If you require further information about international transfer safeguards, please contact db365 support at support@db365.io.

9 Data Retention

9.1 db365 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law or regulatory obligation. The following retention periods apply as a general guide:

9.2 Following expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual. Anonymised and aggregated data (which cannot be used to identify any individual) may be retained indefinitely for statistical and analytical purposes.

10 Cookies & Tracking Technologies

10.1 db365 uses cookies and similar tracking technologies on the db365 website to ensure the platform functions correctly, to protect against fraud, and — where you have given consent — to personalise your experience and analyse platform usage.

10.2 The following categories of cookies are used on the db365 platform:

• Strictly necessary cookies: These are essential for the platform to function. They enable you to log in, maintain your session, and use core features. These cookies cannot be disabled without impairing your use of the site;
• Performance & analytics cookies: These collect anonymised information about how visitors use the db365 website (pages visited, error messages encountered, session duration). This data helps db365 improve the platform. These cookies are only placed where you have given consent;
• Functional cookies: These remember your preferences (language setting, last-viewed games) to provide a more personalised experience. Consent is required for non-essential functional cookies;
• Marketing cookies: These track your activity across sessions to enable db365 to deliver relevant promotional offers and to measure the effectiveness of marketing campaigns. Marketing cookies are only placed where you have given explicit consent.

10.3 You may manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your db365 account.

11 Your Data Rights

11.1 As a db365 player whose personal data is processed in accordance with this Policy, you hold the following rights in respect of your personal data:

• Right of Access: You have the right to request a copy of the personal data db365 holds about you, together with information about how it is used and on what lawful basis;
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data db365 holds about you. You may update basic account information directly through your account settings panel;
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that this right is subject to overriding legal retention obligations (see Clause 9);
• Right to Restrict Processing: You have the right to request that db365 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested;
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format for transfer to another service, where technically feasible and where processing is based on consent or contractual necessity;
• Right to Object: You have the right to object to processing of your personal data where db365 relies on legitimate interest as the lawful basis, including profiling for marketing purposes. db365 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.2 To exercise any of the rights listed above, please contact db365 by email at support@db365.io with the subject line "Data Rights Request — [Your Full Name]". db365 will acknowledge your request within 5 business days and provide a full response within 14 calendar days. Where a request is particularly complex, db365 may extend this period by a further 14 calendar days, in which case you will be notified of the extension and the reason for it.

11.3 db365 will not charge a fee for handling data rights requests unless a request is manifestly unfounded, excessive, or repetitive. In such cases db365 reserves the right to charge a reasonable administrative fee or to refuse the request, with written reasons provided.

11.4 db365 may need to verify your identity before processing a data rights request. You may be asked to provide a copy of your government-issued ID and confirm account details to ensure that personal data is not disclosed to an unauthorised individual.

12 Data Security

12.1 db365 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• 256-bit SSL/TLS encryption on all connections between your device and the db365 platform;
• Encryption of personal data stored on db365 servers at rest;
• Role-based access controls ensuring that only authorised db365 personnel can access personal data, and only to the extent required for their specific role;
• Regular security audits and penetration testing of the db365 platform infrastructure;
• Secure password hashing — db365 does not store passwords in plain text;
• Two-factor authentication options available to all registered players for account login;
• Monitoring systems designed to detect and alert on unusual account activity, including suspicious login attempts and anomalous transaction patterns.

12.2 Notwithstanding the security measures described above, no system of data transmission or storage can be guaranteed to be 100% secure. db365 therefore cannot warrant the absolute security of personal data. Players are encouraged to use strong, unique passwords for their db365 accounts, to enable two-factor authentication, and to contact db365 support immediately at support@db365.io if they suspect their account has been compromised.

12.3 In the event of a personal data breach that is likely to result in a risk to your rights, db365 will notify affected players without undue delay and will take immediate steps to contain the breach, assess its impact, and implement remedial measures.

13 Children and Minors

13.1 The db365 platform is strictly for adults aged 21 years and above. db365 does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. Age verification is a mandatory step in the db365 account registration process, and players who cannot provide satisfactory proof of age will not be permitted to hold an account.

13.2 If db365 becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, db365 will take immediate steps to delete that data, close the associated account, and refund any deposits made (less any bonuses claimed), in accordance with the db365 Terms & Conditions and applicable law.

13.3 If you believe that a person under the age of 21 has registered a db365 account, please contact db365 support immediately at support@db365.io with the subject line "Minor Account Report". db365 takes such reports seriously and will investigate promptly.

14 Marketing Communications

14.1 db365 may send you promotional communications about bonuses, new games, seasonal offers (including Eid specials, Pohela Boishakh promotions, and BPL / IPL match-day offers), and platform updates. db365 will only send marketing communications where you have given your explicit consent to receive them.

14.2 You may provide or withdraw consent to marketing communications through the following channels:

• During the account registration process, by selecting or deselecting the marketing consent checkbox;
• At any time after registration, through the notification preferences section of your db365 account settings;
• By contacting db365 support at support@db365.io with the subject line "Marketing Opt-Out".

14.3 Withdrawal of marketing consent will take effect within 5 business days of receipt. Please note that withdrawing marketing consent does not affect your ability to use your db365 account or receive transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent on the basis of contractual necessity and will continue to be delivered regardless of your marketing preferences.

14.4 db365 does not send unsolicited marketing communications to individuals who have not consented to receive them, and does not share your contact details with third-party marketers for the purpose of sending you their marketing materials.

15 Changes to This Privacy Policy

15.1 db365 reserves the right to amend, update, or replace this Privacy Policy at any time. Changes may be made to reflect updates in applicable law, changes in db365's data processing activities, or improvements to the platform.

15.2 Where changes to this Policy are material — meaning they significantly affect your rights or the way in which your personal data is used — db365 will notify registered players by email to the address associated with their account and by posting a prominent notice on the db365 website. Non-material updates (such as typographical corrections or minor clarifications) may be made without individual notification.

15.3 The "Last Updated" date at the top of this Policy will always reflect the date on which the most recent version came into effect. db365 recommends that you review this Policy periodically to remain informed of how your personal data is being handled. Continued use of the db365 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

15.4 Previous versions of the db365 Privacy Policy are archived and are available upon written request to support@db365.io.

16 Contact & Complaints

16.1 If you have any questions, concerns, or complaints about how db365 handles your personal data, or if you wish to exercise any of the data rights described in Clause 11, please contact the db365 Data Protection team using the details below:

16.2 db365 is committed to resolving all privacy-related concerns promptly and fairly. If you submit a complaint and are not satisfied with the response provided by db365, you retain the right to escalate the matter to the appropriate data protection authority or regulatory body in your jurisdiction.

16.3 For issues relating to responsible gaming rather than data privacy — such as setting deposit limits, requesting self-exclusion, or seeking help with gambling-related concerns — please refer to the db365 Responsible Gaming page or contact support directly. db365's support team is available around the clock to assist players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all other locations in Bangladesh.