Privacy Policy — How 18bdt Protects Your Personal Data

Data We Collect — Categories, Sources, and Purpose

When you interact with the 18bdt platform, we collect personal information that is necessary to create and maintain your account, verify your identity, process financial transactions, and deliver a safe and personalised gaming experience. We collect only the data we genuinely need. We do not collect sensitive data categories — such as biometric data, racial or ethnic origin, or political opinions — and we do not collect data from minors under the age of 18.

Personal data collected by 18bdt falls into the following categories:

1.1 Registration and Identity Data

• Full legal name — collected at registration to ensure accounts are held in the account holder's own name and to comply with KYC requirements.
• Date of birth — collected to verify that you meet the 18+ minimum age requirement.
• Email address — used for account access, transactional notifications, and support communications.
• Mobile phone number — used for account security (OTP), MFS payment verification (bKash, Nagad, Rocket, Upay), and support contact.
• Residential address — collected during KYC verification to confirm identity and prevent fraud.
• Government-issued photo ID — National Identity Card (NID), passport, or equivalent; collected during KYC to verify age and identity.

1.2 Financial and Payment Data

• MFS account numbers (bKash, Nagad, Rocket, Upay) — used to process deposits and withdrawals.
• Bank account details — collected where bank transfer is the selected payment method.
• Transaction history — a record of all deposits, withdrawals, and bonus credits on your 18bdt account, retained for financial audit and responsible gaming monitoring purposes.

18bdt does not store full payment card numbers. All payment data transmitted through MFS gateways is encrypted end-to-end by the payment provider. 18bdt receives only a transaction reference and confirmation status.

1.3 Technical and Device Data

• IP address — logged at login and during active sessions for security monitoring and geographic access verification.
• Device type, operating system, and browser — collected to ensure platform compatibility and detect anomalous access patterns.
• Device fingerprint — a non-personally-identifying digital signature of your device, used solely to enforce the one-account-per-player policy and detect fraud.
• Session timestamps and activity logs — records of login times, game sessions, and platform interactions, used for security auditing and responsible gaming monitoring.

1.4 Communications Data

• Support correspondence — the content of live chat conversations, emails, and other communications you send to 18bdt's support team, retained to resolve disputes and improve service quality.
• Responsible gaming interactions — records of any self-exclusion requests, deposit limit settings, or time-out activations, retained to ensure compliance with the restrictions you have set.

How We Use Your Data — Legal Bases and Purposes

18bdt processes your personal data only where a valid legal basis exists for doing so. We rely on the following legal bases for processing personal data collected from our Bangladeshi players:

Marketing Communications

18bdt will only send you promotional communications — including bonus offers, seasonal promotions (Eid, BPL, IPL, Pohela Boishakh), and new game announcements — where you have given your explicit consent to receive such communications during registration or through your account preferences settings. You may withdraw this consent at any time by updating your notification preferences in your account dashboard or by contacting [email protected]. Withdrawal of marketing consent does not affect the lawfulness of any processing carried out prior to withdrawal, and does not affect the delivery of transactional notifications that are necessary for the operation of your account.

Cookies & Tracking — What We Use and Why

18bdt uses cookies and similar browser storage technologies to operate the platform, maintain your session, and understand how players use the site in aggregate. This section explains every category of cookie used on 18bdt, why it is used, and how long it persists.

Cookie Categories

What 18bdt Does NOT Use

• 18bdt does not deploy third-party advertising cookies or pixels (e.g., Meta Pixel, Google Ads remarketing tags).
• 18bdt does not use cross-site tracking technologies that follow you across other websites after you leave the 18bdt platform.
• 18bdt does not share cookie-derived data with data brokers, ad networks, or social media platforms.

You can manage cookie preferences at the browser level using your browser's built-in settings. Note that disabling essential cookies will prevent you from logging in to your 18bdt account. If you have questions about specific cookies used on the platform, contact [email protected].

Data Sharing & Disclosure — Who Receives Your Data and When

18bdt does not sell your personal data. We share personal data with third parties only in the specific, limited circumstances described in this section. Every third party that receives data from 18bdt is contractually bound to process that data only for the stated purpose and in accordance with applicable data protection standards.

Categories of Third-Party Recipients

• Payment Processors (MFS Providers) — bKash, Nagad, Rocket, and Upay receive the minimum data necessary to process deposit and withdrawal transactions. This typically includes your registered mobile number and the transaction amount in BDT. Payment providers operate under their own privacy policies and are independently regulated.
• Bank Partners — Dutch-Bangla Bank, City Bank, BRAC Bank, and other partner banks receive account holder name and bank account details solely for the purpose of processing bank transfer transactions.
• Game Technology Providers — Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a pseudonymous player session identifier to deliver game sessions. These providers do not receive your full name, NID number, or MFS account details.
• Identity Verification Services — Third-party KYC verification partners receive the identity documents you submit during the KYC process solely for the purpose of identity and age verification. These partners are contractually prohibited from using your documents for any other purpose.
• Fraud Prevention and Security Services — Anonymised or pseudonymised device and behavioural data may be shared with fraud detection service providers to identify and prevent multi-account abuse, collusion, and financial fraud.
• Legal and Regulatory Authorities — 18bdt will disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by applicable law, court order, or regulatory directive. We will notify you of such disclosures where we are legally permitted to do so.

International Data Transfers

Some of 18bdt's technology providers — particularly game studios and fraud prevention services — may process data on servers located outside Bangladesh. In such cases, 18bdt ensures that adequate data protection safeguards are in place through contractual protections prior to any transfer taking place. If you have concerns about international data transfers affecting your account, contact [email protected] for further details.

Data Security — How We Keep Your Information Safe

Protecting the personal data of our players is one of 18bdt's highest operational priorities. We implement a multi-layered security framework that combines technical controls, procedural safeguards, and staff training to minimise the risk of unauthorised access, disclosure, alteration, or loss of personal data.

Technical Security Measures

• 256-bit TLS/SSL encryption on all connections between your browser or app and 18bdt's servers.
• AES-256 encryption at rest for all stored personal data including identity documents and financial records.
• Two-factor authentication (2FA) available for all player accounts, strongly recommended by 18bdt.
• Role-based access controls (RBAC) ensuring that 18bdt staff can only access personal data that is strictly necessary for their job function.
• Automated intrusion detection and prevention systems (IDS/IPS) monitoring for anomalous access patterns 24 hours a day.
• Regular third-party penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Secure, geographically redundant data backups performed on a daily schedule.

Organisational Security Measures

• All 18bdt staff members who handle personal data undergo data protection training as part of onboarding and annual refresher programmes.
• Access to KYC documentation is restricted to the compliance team and is logged for audit purposes.
• 18bdt maintains a documented data breach response procedure. In the event of a breach affecting your personal data, 18bdt will notify affected players without undue delay.

Data Retention — How Long We Keep Your Information

18bdt retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or audit obligations. When the retention period for a data category expires, data is securely deleted or permanently anonymised.

Where you request deletion of your personal data and no overriding legal retention obligation applies, 18bdt will action the deletion request within 30 calendar days of receipt and confirm completion to you at your registered email address.

Your Privacy Rights — Access, Correction, Deletion, and More

As a registered player on the 18bdt platform, you hold a set of rights in relation to your personal data. 18bdt is committed to honouring these rights promptly and transparently. The following rights are available to all 18bdt players regardless of their location within Bangladesh.

Your Rights at a Glance

• Right of Access — You may request a complete copy of all personal data that 18bdt holds about you. Data access requests are fulfilled within 30 calendar days of receipt.
• Right to Rectification — If any personal data held by 18bdt about you is inaccurate or incomplete, you have the right to request its correction. Corrections to core identity data may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten") — You may request the permanent deletion of your personal data where the data is no longer necessary for the purpose it was collected, where you withdraw consent (for consent-based processing), or where the data has been unlawfully processed. Erasure may be limited where a legal retention obligation applies.
• Right to Restriction of Processing — You may request that 18bdt temporarily restricts its processing of your personal data while the accuracy of data or a legitimate interest objection is being resolved.
• Right to Data Portability — You may request that 18bdt provides your personal data in a structured, machine-readable format (CSV or JSON) so that it can be transferred to another service provider.
• Right to Object — You may object to 18bdt's processing of your personal data where that processing is based on legitimate interest. You may also object at any time to the use of your data for direct marketing purposes.
• Right to Withdraw Consent — Where 18bdt processes your data on the basis of your consent (e.g., for promotional communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of prior processing.

How to Exercise Your Rights

To exercise any of the rights described above, contact 18bdt's data protection team at [email protected] with the subject line "Data Rights Request — [Your Full Name]". Include your registered email address and a brief description of the right you wish to exercise and the data it relates to. 18bdt will acknowledge your request within 5 business days (BST) and fulfil it within 30 calendar days. If your request is complex or numerous, 18bdt may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it.

Policy Updates & Contact Information

18bdt reviews this Privacy Policy on a regular basis to ensure it accurately reflects current data practices, applicable legal requirements, and platform developments. The effective date shown at the top of this document indicates when the most recent revision came into force.

Where changes to this Privacy Policy are material — meaning they affect the way in which 18bdt collects, uses, or shares your personal data in a meaningful way — 18bdt will notify all registered players by email at the address registered to their account. Non-material changes (such as clarifications of existing practices, formatting improvements, or minor corrections) may be made without individual notification, though the updated policy will always be published at https://18bdt.vip/privacy-policy with a revised effective date.

Your continued use of the 18bdt platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree to a revised Privacy Policy, you should cease using the platform and contact 18bdt's support team to request account closure and data deletion in accordance with your rights under Section 7.

Contact — Data Protection Enquiries

For all data protection and privacy-related enquiries, including data rights requests, concerns about how your data is being used, or reports of suspected data breaches, please contact the 18bdt data protection team using the following details:

• Email: [email protected] (subject line: "Privacy Enquiry")
• Live Chat: Available 24/7 in English via the 18bdt website
• Response Time: Initial acknowledgement within 5 business days (BST); full resolution within 30 calendar days
• Operating Hours: Support available around the clock including Eid, Victory Day (16 December), Independence Day (26 March), and all Bangladeshi public holidays