333bad Privacy Policy

1 Data We Collect

333bad collects personal data from players through several channels: directly from you during account registration and subsequent use of the platform; automatically through your device and browser when you access the site; and from third-party payment providers and identity verification services that assist us in delivering a secure, compliant service.

The categories of personal data we collect, and the primary source of each, are set out in the table below:

We do not knowingly collect personal data from individuals under the age of 18. If we discover that personal data has been submitted by a person under 18, that data will be deleted immediately and the associated account will be closed in accordance with our age-verification policy.

2 How We Use Your Data

333bad processes your personal data only for specific, clearly defined purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The legal basis for each processing activity is identified alongside the purpose below.

Account Management and Service Delivery

We use your identity and contact data to create and maintain your player account, authenticate your login sessions, and deliver the gaming and betting services you have requested. This processing is necessary to perform the contract between you and 333bad. Without it, we cannot provide any platform services to you.

Payment Processing and Financial Compliance

Your financial data is used to process deposit and withdrawal transactions via bKash, Nagad, Rocket, Upay, and bank transfer. We also use financial and identity data to conduct anti-money laundering (AML) checks, to comply with Know Your Customer (KYC) obligations, and to detect and prevent fraud. This processing is required both to fulfil our contractual obligations to you and to comply with applicable legal requirements.

Responsible Gaming Monitoring

Your gaming activity data — including session frequency, bet sizes, deposit patterns, and win/loss ratios — is analysed by our responsible gaming systems to identify indicators of potentially problematic gambling behaviour. Where such indicators are detected, we may proactively reach out to you with information about responsible gaming tools or, in serious cases, apply mandatory account restrictions. This processing is carried out in your legitimate interest and in compliance with our responsible gaming obligations.

Platform Security and Fraud Prevention

Technical data including IP addresses, device fingerprints, and login timestamps are used to protect your account from unauthorised access, to detect multi-accounting, to prevent bonus abuse, and to investigate suspicious activity. This processing is carried out in our legitimate interest in maintaining a safe and fair platform for all players.

Customer Support

Communication data from your support interactions is used to resolve your enquiries, improve our support processes, and maintain a record of any disputes or complaints. Support records are retained for a minimum of two years following account closure.

Marketing Communications

If you have opted in to marketing communications, we will use your contact data and marketing preferences to send you information about promotions, bonuses, new games, and special events — including seasonal promotions around Eid, Pohela Boishakh, and BPL cricket tournaments. You may withdraw your marketing consent at any time by updating your notification preferences in your account settings or by contacting our support team.

3 Data Sharing and Disclosure

333bad does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Service Providers: We share financial and identity data with our payment processing partners — including the operators of bKash, Nagad, Rocket, and Upay integrations, and partner banks such as Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank — to process your deposit and withdrawal transactions. These providers are contractually bound to process your data only as instructed by 333bad and to implement appropriate security measures.
• Identity Verification Services: To fulfil our KYC obligations, we may pass identity documents and personal details to third-party verification service providers. These providers operate under strict confidentiality agreements and are prohibited from using your data for any purpose other than identity verification on behalf of 333bad.
• Game Software Providers: When you play games powered by third-party studios — such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi — your game session data (but not financial or contact data) may be processed by those providers' servers. Each provider is contractually obligated to handle session data in accordance with industry data protection standards.
• Analytics and Platform Operations: We use third-party analytics tools to understand how players navigate the platform, identify technical issues, and improve user experience. These tools process technical and behavioural data in anonymised or pseudonymised form and do not receive personally identifiable information.
• Legal and Regulatory Disclosure: We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts if we are required to do so by applicable law, by a valid court order, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of 333bad, our players, or the general public.
• Business Transfers: In the event that 333bad undergoes a merger, acquisition, or sale of substantially all of its assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer by email at least 30 days before it takes effect, and you will retain the right to request deletion of your data prior to the transfer.

4 Cookies and Tracking Technologies

333bad uses cookies and similar tracking technologies (including local storage and session storage objects) to operate core platform functions, remember your preferences, analyse site usage, and personalise your experience. By continuing to use the 333bad platform, you consent to our use of cookies as described in this section.

We use the following categories of cookies:

Most web browsers allow you to control cookies through their settings. You can configure your browser to block all cookies, to block only third-party cookies, or to delete cookies when you close your browser session. Please note that disabling strictly necessary cookies will impair or entirely prevent your ability to use the 333bad platform. Instructions for managing cookies in the most common browsers are available through each browser's built-in help documentation.

5 Data Retention

333bad retains your personal data only for as long as it is necessary to fulfil the purposes described in this Privacy Policy or to comply with our legal and regulatory obligations. The retention periods we apply to different categories of data are as follows:

• Account and identity data: Retained for the duration of your active account plus a minimum of five years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of seven years following each transaction, in compliance with financial record-keeping obligations.
• Gaming activity logs: Retained for three years following account closure. Aggregated, anonymised analytics derived from gaming data may be retained indefinitely.
• Customer support correspondence: Retained for two years following the closure of each support ticket or, if a dispute is involved, two years following the final resolution of that dispute.
• Marketing preference records: Retained for the duration of your account and deleted within 30 days of a withdrawal of marketing consent.
• Technical and server logs: Retained for 12 months, after which they are automatically purged from our systems.

At the end of each applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to you as an individual. We do not retain data "just in case" — every data point we hold serves a documented operational or legal purpose.

6 Data Security Measures

333bad takes the security of your personal data seriously and implements a layered set of technical and organisational controls to protect against unauthorised access, disclosure, alteration, or destruction. The key security measures in place include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or mobile device and our servers is encrypted in transit using TLS 1.3, preventing interception by third parties.
• At-Rest Encryption: Databases containing personal data are encrypted at rest using AES-256, ensuring that data is unreadable if physical storage media is ever compromised.
• Access Controls: Personal data is accessible only to 333bad staff whose role requires it. Access is granted on a strict need-to-know basis and is subject to multi-factor authentication (MFA) for all internal systems.
• Intrusion Detection: Our infrastructure is monitored 24 hours a day, 7 days a week by automated intrusion detection systems. Any anomalous access patterns trigger immediate alerts to our security team.
• Penetration Testing: 333bad commissions independent third-party penetration tests on a regular basis to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: In the event of a confirmed data breach that poses a risk to your rights and freedoms, 333bad will notify affected players by email within 72 hours of becoming aware of the incident, describing the nature of the breach, the data involved, and the steps we are taking to address it.

While we implement robust security measures, no online system can guarantee absolute security. You also play a role in protecting your account: use a strong, unique password, do not share your login credentials with any other person, and contact our support team immediately if you suspect that your account has been compromised.

7 Your Privacy Rights

As a player on the 333bad platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team via live chat or by emailing [email protected]. We will respond to all verified requests within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data that 333bad holds about you, along with information about how it is being used. We will provide this in a structured, commonly used, machine-readable format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully. This right is subject to our legal obligation to retain certain data for the periods specified in Section 5.
• Right to Restrict Processing: You have the right to request that we suspend the processing of your personal data in certain circumstances — for example, while we investigate a dispute about the accuracy of that data.
• Right to Data Portability: You have the right to receive personal data you have provided to us in a portable format, and to request that we transmit it directly to another service provider where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object to processing carried out on the basis of our legitimate interests, though this right may be overridden where we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8 Updates to This Policy

333bad reviews this Privacy Policy on a regular basis and updates it when our data practices change, when relevant laws or regulations are amended, or when we introduce new services that affect the way we handle personal data. The effective date at the top of this document indicates when the current version entered into force.

When we make material changes to this Privacy Policy — meaning changes that significantly affect your rights or the way we use your personal data — we will notify you by sending an email to your registered address at least 14 days before the changes take effect. We will also display a prominent notice on the platform informing you that the Privacy Policy has been updated. Continued use of the platform after the updated policy takes effect constitutes your acceptance of the revised terms.

Minor updates such as corrections of typographical errors, clarifications of existing language that do not change the substance of the policy, or structural reformatting will not trigger an individual notification but will be reflected in the updated effective date shown at the top of this document.

If you have questions about this Privacy Policy, about the data we hold about you, or about any aspect of our data protection practices, please contact our support team. Our data protection contact is reachable at [email protected], via live chat inside your account dashboard (available 24/7, with a typical response time of under 15 minutes), or by writing to us at our registered correspondence address. We are committed to resolving all privacy-related enquiries promptly and transparently.