Privacy Policy — How 366bdt Collects, Uses & Protects Your Data

366bdt collects personal information from players through three primary channels: information you provide directly during registration and account use, information generated automatically as you interact with the platform, and information received from third-party payment providers during transaction processing. We collect only the minimum data necessary for each purpose.

Information You Provide Directly:

• Registration data: Full legal name, date of birth, residential address (city and district within Bangladesh), email address, and mobile number as registered with your bKash, Nagad, Rocket, or bank account.
• Identity verification (KYC) documents: Copy of your National Identity Card (NID), passport, or driving licence, submitted when completing the KYC process prior to your first significant withdrawal.
• Payment method details: Mobile financial service account numbers (bKash, Nagad, Rocket, Upay) or Bangladeshi bank account details (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) provided for deposit and withdrawal purposes.
• Support communications: The content of messages, emails, and live-chat conversations you initiate with the 366bdt support team, retained for quality assurance and dispute resolution purposes.
• Self-exclusion and responsible gaming preferences: Any deposit limits, session time limits, or self-exclusion requests you submit through the 366bdt account settings or responsible gaming tools.

Information Collected Automatically:

• Device and technical data: IP address, device type, operating system, browser type and version, and screen resolution collected when you access the 366bdt platform.
• Session and activity data: Login timestamps (recorded in Bangladesh Standard Time, UTC+6), pages visited, games played, bet amounts, game outcomes, session duration, and navigation patterns within the platform.
• Cookie and local storage data: Session identifiers, authentication tokens, and platform preference data stored locally on your device as described in Section 4 of this policy.
• Fraud detection signals: Device fingerprint data, concurrent session indicators, and IP geolocation data used to identify suspicious account activity, multi-accounting attempts, and automated bot behaviour.

Information Received from Third Parties:

• Payment confirmation data: Transaction reference numbers, payment timestamps, and confirmation statuses received from bKash, Nagad, Rocket, Upay, and partner banking institutions upon processing of deposits and withdrawals.
• Identity verification cross-checks: Where required for fraud prevention, limited verification data may be cross-referenced against records held by payment providers to confirm identity consistency.

366bdt does not sell, rent, or commercially distribute your personal data to any third party. We share your information only in the limited circumstances described below, each of which is necessary to deliver the 366bdt service or to comply with applicable obligations.

Payment Processing Partners: To process deposits and withdrawals, 366bdt transmits necessary transaction data (mobile number, amount, transaction reference) to bKash, Nagad, Rocket, Upay, and partner Bangladeshi banks including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. These providers process your data under their own privacy policies and are independently regulated by Bangladesh Bank. 366bdt shares only the minimum data required to execute each transaction.

Game Technology Providers: Games on the 366bdt platform are powered by licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. An anonymised player session identifier is shared with these providers to deliver game functionality, record game results, and return outcomes to your account. These providers do not receive your full name, NID, or payment details.

Anti-Fraud and Identity Services: In cases where 366bdt has a legitimate security interest in verifying identity consistency — for example, when a withdrawal request raises inconsistency flags — limited identity data may be cross-referenced with payment provider confirmation services. This is conducted in accordance with anti-money-laundering best practices.

Legal and Regulatory Disclosure: 366bdt will disclose personal data to relevant Bangladeshi authorities, law enforcement agencies, or courts where required to do so by law, court order, or in response to a valid regulatory request. We will notify affected players of such disclosures where we are legally permitted to do so.

Business Transfers: In the event of a merger, acquisition, or transfer of assets involving 366bdt, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified in advance of any such transfer and will retain their privacy rights under the terms of this policy or any successor policy.

366bdt applies industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. The security infrastructure supporting the platform includes the following controls:

• Transport encryption: All data in transit between your device and 366bdt servers is encrypted using TLS 1.2 or higher, enforced site-wide without exception.
• Data-at-rest encryption: Personal data stored in 366bdt databases — including identity documents, payment details, and account records — is encrypted using AES-256 encryption.
• Access controls: Access to databases containing player personal data is restricted to authorised personnel on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
• Password security: Player passwords are stored as salted cryptographic hashes. 366bdt staff cannot view your plain-text password at any time. If you forget your password, it must be reset — it cannot be retrieved.
• Intrusion detection: 366bdt operates continuous intrusion detection and anomaly monitoring systems to identify and respond to potential security incidents in real time.
• Regular security reviews: The platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.

Data Breach Response: In the event of a data breach that poses a risk to player privacy, 366bdt will notify affected players as promptly as practicable. Notification will be sent to the email address registered on your account and will describe the nature of the breach, the data affected, and the steps 366bdt is taking in response.

Data Storage Location: Player data is stored on servers located in secure data centre facilities. 366bdt takes reasonable steps to ensure that any server infrastructure used to store Bangladeshi player data meets appropriate physical and digital security standards.

Your Responsibilities: While 366bdt maintains robust security on the platform side, players are responsible for maintaining the security of their own devices and 366bdt Login credentials. Use a strong, unique password for your 366bdt account, do not share your credentials with anyone, and log out of the platform when using shared or public devices.

366bdt retains your personal data only for as long as is necessary for the purposes set out in this Privacy Policy or as required by applicable legal, regulatory, and anti-fraud obligations. The following retention schedules apply:

When personal data reaches the end of its retention period, 366bdt will securely delete or anonymise it. Anonymised data — from which it is no longer possible to identify any individual — may be retained indefinitely for aggregate platform analytics purposes.

Account Closure: If you request account closure, 366bdt will deactivate your account promptly. Your personal data will be retained for the periods specified above and will not be used for any active purpose during that retention window beyond legal, compliance, and fraud prevention obligations.