Your Privacy Matters to bdtil — How We Collect, Use, and Protect Your Personal Data

1 Definitions

In this Privacy Policy, the following terms have the meanings set out below unless the context requires otherwise:

• "bdtil", "we", "us", "our" — refers to the bdtil platform, accessible at https://bdtil.io, and the operating entity responsible for processing personal data as described in this Policy.
• "You", "Player", "User", "Data Subject" — refers to any individual who visits, registers on, or otherwise interacts with the bdtil platform, and whose personal data is processed in connection with that interaction.
• "Personal Data" — means any information relating to an identified or identifiable natural person. This includes, but is not limited to, your name, email address, mobile phone number, date of birth, residential address, payment account details (bKash number, Nagad number, Rocket number, bank account details), IP address, device identifiers, and session data.
• "Processing" — means any operation performed on Personal Data, including collection, recording, storage, organisation, structuring, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "KYC" — Know Your Customer, the identity and eligibility verification process that bdtil applies to player accounts, particularly in connection with withdrawal requests and high-value transactions.
• "Cookies" — small text files placed on your device by the bdtil platform or by authorised third-party service providers for purposes of session management, preference storage, and platform analytics.
• "Platform" — the bdtil website, mobile browser interface, and all associated pages, features, and services available at https://bdtil.io.

2 Scope & Application

This Privacy Policy applies to all Personal Data collected by bdtil in connection with the operation of the bdtil platform and the provision of its services to players located in Bangladesh. It applies regardless of whether you access the platform via a desktop browser, mobile browser, or any future dedicated application.

This Privacy Policy applies to:

• Registered bdtil account holders, including players who have completed full KYC verification and those who have initiated registration but not yet completed it.
• Unregistered visitors to https://bdtil.io, in respect of automatically collected data such as IP address, device type, browser type, and session behaviour (see Clause 3 for details).
• Individuals who contact bdtil via email at [email protected] or through the live chat support function, in respect of data provided during those communications.

This Privacy Policy does not apply to third-party websites, platforms, or services that may be referenced on or linked from the bdtil platform. bdtil is not responsible for the privacy practices of any third-party service, including but not limited to payment processors, game content providers, or telecommunications operators through whom you access the internet.

3 Data We Collect

bdtil collects Personal Data through several channels. The categories of data collected, and the circumstances in which each category is collected, are described below.

3.1 Data You Provide Directly:

• Registration data: Full name, username, email address, date of birth, mobile phone number (used for bKash, Nagad, or Rocket verification), and residential address in Bangladesh.
• KYC verification data: Copies of government-issued identity documents (National Identity Card, passport, or driving licence), proof of residential address (utility bill or bank statement), and selfie photographs where required for identity confirmation.
• Payment data: Mobile wallet numbers (bKash, Nagad, Rocket, Upay), bank account details (Dutch-Bangla Bank, BRAC Bank, Islami Bank, City Bank, Sonali Bank), and card details (Visa, Mastercard) used for deposits and withdrawals. Full card numbers are never stored by bdtil — payment card data is processed and stored by our PCI-compliant payment processing partners.
• Communication data: The content of emails, live chat messages, and any other communications you send to the bdtil support team.
• Responsible gaming data: Deposit limits, loss limits, session time limits, cooling-off periods, and self-exclusion requests submitted by you through the account dashboard or via the support team.

3.2 Data Collected Automatically:

• Technical data: IP address, device type, device operating system, browser type and version, mobile network information, and screen resolution.
• Usage data: Pages visited on the bdtil platform, time spent on each page, games accessed, bets placed (including stake amounts and outcomes), session start and end times, and navigation paths through the platform.
• Cookie data: Data stored via cookies and similar tracking technologies as described in Clause 7 of this Policy.
• Transaction logs: A complete record of all deposits, withdrawals, bets, game rounds, and bonus redemptions associated with your account, maintained for compliance and dispute resolution purposes.

4 How We Use Your Data

bdtil uses your Personal Data only for the purposes described in this Policy. We do not sell your Personal Data to third parties. The principal purposes for which we process your data are as follows:

• Account creation and management: To register your bdtil account, verify your eligibility (including confirming you are 21 years of age or older), maintain your account, and process changes to your account settings.
• Service delivery: To provide you with access to bdtil's sports betting, live casino, slots, and fishing game services; to process your bets and game rounds; and to credit winnings and bonuses to your account balance.
• Payment processing: To process deposits via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard, and to process withdrawal requests to your verified payment method. This includes sharing necessary payment data with our payment processing partners.
• KYC and fraud prevention: To verify your identity, confirm your eligibility, detect and prevent fraud, money laundering, and other financial crimes, and to comply with our anti-money laundering obligations. This may involve sharing your identity data with specialist third-party verification services.
• Customer support: To respond to your enquiries, complaints, and disputes submitted via email ([email protected]) or live chat. Communication data is retained for quality assurance, training, and dispute resolution purposes.
• Responsible gaming: To implement and maintain the responsible gaming limits and restrictions you have set, and to monitor your gaming behaviour for indicators of problem gambling in accordance with our Responsible Gaming Policy.
• Platform improvement: To analyse aggregated usage data in order to improve the design, functionality, and content of the bdtil platform. This analysis uses anonymised or pseudonymised data wherever practicable.
• Promotional communications: To send you information about bdtil promotions, bonuses, and seasonal offers (such as Eid deposit bonuses, Pohela Boishakh free spins, BPL season promotions, and Victory Day offers) where you have opted in to receive such communications. You may opt out at any time by contacting [email protected].
• Legal compliance: To comply with applicable laws, regulations, court orders, and requests from competent authorities, and to enforce bdtil's Terms & Conditions.

5 Legal Basis for Processing

bdtil processes your Personal Data on the following legal bases, depending on the purpose of processing:

• Contractual necessity: Processing that is necessary to perform the contract between you and bdtil — specifically, to deliver the platform services, process your account, handle deposits and withdrawals, and settle bets. Without this processing, bdtil cannot provide its services to you.
• Legal obligation: Processing that is necessary for bdtil to comply with applicable legal obligations, including KYC and anti-money laundering requirements, fraud detection obligations, and data retention requirements imposed by applicable law.
• Legitimate interests: Processing that is necessary for the legitimate interests of bdtil, provided those interests are not overridden by your interests or fundamental rights. This includes fraud prevention, platform security, responsible gaming monitoring, and improvement of bdtil's services through aggregated analytics.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent. This applies to promotional communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Sharing Your Data

bdtil does not sell, rent, or trade your Personal Data to third parties. We share Personal Data with external parties only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Islami Bank, City Bank, Sonali Bank, Visa, and Mastercard receive transaction data necessary to process your deposits and withdrawals. These parties are independent data controllers for the purpose of processing your payment transactions and are bound by their own privacy policies and applicable financial regulations.
• Game content providers: Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe may receive a session token or anonymised player identifier to authenticate your access to their games within the bdtil platform. These providers do not receive your full identity or payment data.
• Identity verification and KYC providers: Specialist third-party identity verification services may receive copies of your identity documents and other KYC data for the purpose of verifying your identity. All such providers operate under strict contractual data protection obligations.
• Fraud prevention and security services: Aggregated or pseudonymised technical and transaction data may be shared with fraud prevention platforms to detect and prevent financial crimes, account takeovers, and platform abuse.
• Legal and regulatory authorities: bdtil may disclose your Personal Data to competent regulatory or law enforcement authorities where required to do so by applicable law, court order, or official request. Where permitted, bdtil will notify you of any such disclosure.
• Professional advisers: bdtil's legal counsel, auditors, and other professional advisers may access Personal Data to the extent necessary for the provision of their services to bdtil, subject to strict confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of bdtil's business, your Personal Data may be transferred to the successor entity. You will be notified of any such transfer and any material change to the terms under which your data is processed.

7 Cookies & Tracking Technologies

bdtil uses cookies and similar technologies (including web beacons and local storage objects) to operate, secure, and improve the platform. The following categories of cookies are deployed on the bdtil platform:

• Essential cookies: These cookies are strictly necessary for the platform to function. They enable core features such as user authentication, session management, account security, and navigation between pages. The platform cannot function without these cookies; they cannot be disabled.
• Analytics cookies: These cookies collect aggregated, anonymised information about how players use the bdtil platform — including which pages are visited most frequently, how long sessions last, and where players navigate after visiting specific pages. This data is used to improve the platform. Analytics data is not linked to your personal identity.
• Preference cookies: These cookies remember your platform settings and preferences — such as your preferred language, display settings, and previously entered (non-sensitive) form data — so that you do not need to re-enter them on each visit.
• Security cookies: These cookies are used to detect and prevent fraudulent activity, including bot traffic, account takeover attempts, and suspicious login behaviour.

bdtil does not deploy third-party advertising cookies, retargeting cookies, or social media tracking cookies. No cookie data collected by bdtil is sold to or shared with advertising networks or data brokers.

You may control cookie settings through your browser preferences. Please note that disabling essential cookies will prevent the bdtil platform from functioning correctly and will make it impossible to log in or place bets. Disabling analytics and preference cookies will not affect platform functionality but may reduce the personalisation of your experience.

8 Data Security

bdtil implements technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• TLS/SSL encryption: All data transmitted between your device and the bdtil platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. This protects your login credentials, payment data, and personal information from interception during transit.
• Password hashing: Account passwords are stored using strong one-way cryptographic hashing algorithms. bdtil staff cannot retrieve or view your plain-text password under any circumstances.
• Access controls: Access to systems that hold player Personal Data is restricted to bdtil personnel with a demonstrated operational need for that access. Access is governed by role-based permissions, and all access events are logged and audited.
• Network security: The bdtil platform infrastructure is protected by firewalls, intrusion detection systems, and continuous security monitoring to detect and respond to potential threats in real time.
• Payment data security: Full payment card numbers are never stored on bdtil servers. Card transactions are processed by PCI-DSS-compliant payment partners. Mobile wallet transactions are processed through the secure APIs of the respective providers (bKash, Nagad, Rocket, Upay).
• Incident response: bdtil maintains a documented data breach response procedure. In the event of a security incident that is likely to result in a risk to your rights and freedoms, bdtil will notify affected players without undue delay, providing information about the nature of the incident and the steps taken to mitigate it.

9 Data Retention

bdtil retains your Personal Data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required or permitted by applicable law. The following retention periods apply:

• Active account data: Personal Data associated with an active bdtil account is retained for the full duration of the account's activity and for a minimum period of seven (7) years after the account is closed, to satisfy legal, regulatory, and audit obligations.
• KYC documents: Identity documents and KYC verification records are retained for a minimum of seven (7) years from the date of the most recent transaction on the account, in accordance with anti-money laundering best practices.
• Transaction logs: Records of all deposits, withdrawals, bets, and game rounds are retained for a minimum of seven (7) years from the date of the transaction, for compliance, audit, and dispute resolution purposes.
• Communication records: Support emails and live chat transcripts are retained for a period of three (3) years from the date of the communication, for quality assurance and dispute resolution purposes.
• Analytics data: Aggregated, anonymised platform usage data collected via analytics cookies is retained indefinitely, as it cannot be linked back to an identifiable individual.
• Marketing preference data: Records of your marketing opt-in or opt-out status are retained for as long as your account is active, and for three (3) years after account closure, to demonstrate compliance with your preferences.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with bdtil's internal data destruction procedures. Where deletion is not immediately practicable (for example, due to backup storage cycles), the data is isolated and protected from further active processing until it can be permanently deleted.

10 Your Rights Over Your Data

As a Data Subject whose Personal Data is processed by bdtil, you have the following rights in respect of your data. To exercise any of these rights, please contact bdtil's compliance team at [email protected] with the subject line "Data Subject Request". bdtil will acknowledge your request within 48 hours and aim to respond substantively within 30 days.

• Right of access: You have the right to request a copy of the Personal Data that bdtil holds about you. We will provide this information in a structured, commonly used, machine-readable format.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete Personal Data that bdtil holds about you. Many corrections can be made directly through your account dashboard (name, address, contact details). For corrections to KYC data, please contact the support team.
• Right to erasure: You have the right to request deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent on which processing is based. Please note that bdtil may be required to retain certain data for legal compliance purposes (see Clause 9), which may limit the scope of erasure requests.
• Right to restriction of processing: You have the right to request that bdtil restrict the processing of your Personal Data in certain circumstances — for example, where you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to erasure.
• Right to data portability: Where processing is carried out by automated means and is based on your consent or on contractual necessity, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to request that it be transmitted directly to another data controller where technically feasible.
• Right to object: You have the right to object to processing of your Personal Data carried out on the basis of bdtil's legitimate interests (see Clause 5). You also have an absolute right to object to processing of your data for direct marketing purposes at any time. On receipt of a valid marketing objection, bdtil will cease processing your data for that purpose without delay.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11 Children & Minors

The bdtil platform is strictly for adults aged 21 and above. bdtil does not knowingly collect, process, or store Personal Data belonging to individuals under the age of 21. Registration by persons under 21 is prohibited under bdtil's Terms & Conditions and is inconsistent with responsible gaming obligations applicable to the Bangladesh market.

If bdtil discovers or has reasonable grounds to believe that Personal Data has been submitted by a person under the age of 21, bdtil will:

• Immediately suspend the associated account pending investigation.
• Delete all Personal Data associated with the account as soon as practicable, except where retention is required for legal compliance purposes.
• Return any Real Money Funds to the original payment source after completing appropriate due diligence.
• Void all open bets and forfeit all Bonus Funds associated with the account.

If you are a parent or guardian and believe that your child (under 21) has created a bdtil account or submitted their Personal Data to the bdtil platform, please contact us immediately at [email protected] with the subject line "Minor Account Report". We will treat such reports as a priority and respond within 24 hours.

12 International Data Transfers

The bdtil platform serves players in Bangladesh. In the course of delivering its services, certain Personal Data may be transferred to and processed by service providers and technology partners located outside Bangladesh — for example, game content providers (Evolution Gaming, Pragmatic Play, Spribe, NetEnt, Microgaming, Ezugi) and cloud infrastructure providers whose servers may be located in various jurisdictions internationally.

Where such international transfers occur, bdtil ensures that appropriate safeguards are in place to protect your Personal Data, including:

• Contractual data protection clauses binding the recipient to standards of data protection equivalent to those applied by bdtil under this Privacy Policy.
• Selection of service providers that hold recognised security certifications (such as ISO 27001) and operate under established data protection frameworks.
• Ongoing assessment of the data protection practices of international service providers to ensure continued adequacy.

By using the bdtil platform, you acknowledge and accept that your Personal Data may be transferred to and processed in jurisdictions outside Bangladesh as described above. bdtil is committed to ensuring that all such transfers are conducted with appropriate safeguards and that your data remains protected to the standard described in this Privacy Policy regardless of where it is processed.

13 Amendments to This Privacy Policy

bdtil reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. Where a material change is made to this Policy — meaning a change that substantively affects how your Personal Data is collected, used, or shared — bdtil will provide notice by displaying a prominent notice on the bdtil platform and, where practicable, by sending a notification to the email address registered to your account.

The effective date and version number at the top of this document will be updated on each revision. Your continued use of the bdtil platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not accept the updated Policy, you should cease using the platform and may close your account in accordance with the Terms & Conditions.

Minor amendments — including typographical corrections, clarifications that do not alter the substance of your rights, and updates to reflect changes in payment partners or game providers — may take effect immediately upon publication without specific individual notification.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which bdtil processes your Personal Data, please contact our compliance team using the details below. All privacy-related communications are treated with strict confidentiality and are handled by dedicated compliance personnel.

• Email: [email protected]
• Subject line for data subject requests: "Data Subject Request"
• Subject line for minor account reports: "Minor Account Report"
• Subject line for general privacy enquiries: "Privacy Enquiry"
• Live Chat: Available within your bdtil account dashboard after login.
• Response time: bdtil acknowledges all privacy communications within 48 hours and provides substantive responses within 30 days.
• Support hours: 24/7 — Bangladesh Standard Time (BST, UTC+6).