9bde Privacy Policy — How We Protect Your Personal Data

1. Introduction and Scope

This Privacy Policy ("Policy") describes how 9bde ("we", "us", "9bde", "the Company") collects, uses, stores, shares, and protects the personal information of individuals ("you", "the User", "the Player") who access or use the 9bde online platform at 9bde.io ("the Platform").

This Policy applies to all personal data collected through: the 9bde website and any mobile-optimised versions thereof; the account registration and KYC verification process; deposits, withdrawals, and all financial transactions conducted on the Platform; customer support interactions by email, live chat, or any other channel; and any marketing or promotional communications sent by 9bde.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the broader agreement between you and 9bde.

This Policy is effective as of 1 January 2026. Any prior versions of this Policy are superseded in their entirety by this document.

2. Data Controller Information

9bde acts as the data controller in respect of the personal data collected through the Platform. As data controller, 9bde determines the purposes and means by which your personal data is processed.

For all data protection enquiries, rights requests, or complaints regarding 9bde's handling of your personal data, please contact our designated Data Protection contact using the details provided in Section 16 of this Policy.

3. Information We Collect

9bde collects personal data through several channels. The categories of data collected and the circumstances in which they are gathered are set out below.

3.1 Registration Data

When you create a 9bde account, we collect the following information:

• Full legal name as it appears on your government-issued identity document
• Date of birth (to verify minimum age of 21 years)
• Residential address including city, district, and postal code
• Email address
• Mobile phone number
• Username chosen by you for the account
• Password (stored in hashed, non-recoverable form — never in plain text)

3.2 Identity Verification (KYC) Data

To comply with our anti-money laundering and player protection obligations, we collect:

• Scanned or photographed copies of government-issued photo ID (National ID card, passport, or driving licence)
• Proof of address documentation dated within the last three months
• Proof of payment method ownership (e.g., bKash or Nagad wallet screenshot, bank statement)
• Selfie or live photo verification where required by our compliance team

3.3 Financial and Transaction Data

We record all financial activity associated with your account, including:

• Deposit amounts, dates, and payment method identifiers (e.g., bKash account number, last four digits of card)
• Withdrawal requests, amounts, and processing details
• Bonus claims, wagering history, and promotion participation
• Account balance history and all credited and debited amounts

9bde does not store full card numbers. Card payment processing is handled by PCI-DSS compliant third-party processors who tokenise card data before transmission.

3.4 Betting and Gaming Activity Data

We record all activity on the Platform related to sports betting, casino games, and slot play, including:

• All bets placed, including market, selection, stake, odds, and outcome
• Casino and slot game sessions including game title, session duration, rounds played, amounts wagered, and results
• Live casino session data including table joined, dealer interactions, and session duration
• Responsible gaming interactions such as limit-setting, self-exclusion requests, and cooling-off activations

3.5 Technical and Device Data

When you access the Platform, our systems automatically collect:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Referring URL and pages viewed within the Platform
• Session timestamps and duration
• Cookie identifiers and similar tracking data (see Section 9)

3.6 Customer Support Data

When you contact 9bde customer support, we retain records of all communications including the content of email exchanges, live chat transcripts, the nature of the enquiry, and the resolution provided. These records are kept to ensure service quality, support dispute resolution, and maintain an accurate history of your account interactions.

4. How We Use Your Information

9bde uses the personal data collected for the following specific purposes:

Purpose	Data Categories Used
Account creation and management	Registration data, device data
Age and identity verification (KYC)	KYC documents, registration data
Processing deposits and withdrawals	Financial data, KYC data
Providing sports betting and casino services	Betting/gaming activity, account data
Fraud prevention and anti-money laundering	All categories, device data, transaction data
Responsible gaming monitoring and intervention	Betting/gaming activity, account data
Customer support and dispute resolution	Support data, account data, transaction data
Marketing and promotional communications (where consented)	Registration data, activity data
Platform security and technical performance	Device data, session data
Legal compliance and regulatory reporting	All categories as required

9bde does not use your personal data for any purpose not listed above without first obtaining your specific consent or establishing a separate legal basis for the new processing activity.

5. Legal Basis for Processing

9bde processes your personal data under the following legal bases depending on the activity:

• Contractual necessity: Processing required to create and manage your account, provide betting and gaming services, process transactions, and manage disputes. Without this processing, 9bde cannot provide the services you have contracted for.
• Legal obligation: Processing required to comply with anti-money laundering obligations, age verification requirements, fraud prevention duties, and any other applicable legal or regulatory requirements.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, analytics to improve services, and internal record keeping, where those interests are not overridden by your fundamental rights.
• Consent: Processing for direct marketing communications, use of non-essential cookies, and any other processing activity for which 9bde has sought and obtained your explicit consent. Consent may be withdrawn at any time without affecting the legality of prior processing.

6. Sharing Your Data with Third Parties

9bde shares personal data with third parties only where necessary to operate the Platform, comply with legal obligations, or protect the interests of account holders. All third parties with whom data is shared are required to maintain adequate data security standards and are prohibited from using your data for any purpose beyond the specific services they provide to 9bde.

6.1 Payment Processors

To process deposits and withdrawals, 9bde shares the minimum required personal and financial data with payment service providers including bKash, Nagad, Rocket, Upay, and card processing partners. These providers operate under their own privacy policies and compliance frameworks. 9bde selects payment partners who maintain appropriate data security standards.

6.2 Identity Verification Providers

9bde may use third-party KYC and identity verification service providers to assist with document authentication and fraud detection. These providers receive only the data necessary to complete the verification task and are contractually prohibited from retaining or reusing that data independently.

6.3 Game Technology Providers

To deliver live casino, slot, and virtual game content, session data (not including full personal identity information) is shared with game technology providers including Evolution Gaming, Pragmatic Play, Ezugi, and Spribe. These providers receive anonymised or pseudonymised session identifiers sufficient to deliver the game experience without receiving your full personal profile.

6.4 Compliance and Law Enforcement

9bde may disclose personal data to relevant authorities, financial intelligence units, or law enforcement bodies where required to do so by applicable law, court order, or regulatory obligation. In such cases, 9bde will disclose only the minimum data required to satisfy the legal request and will notify the account holder where legally permitted to do so.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of 9bde's assets, personal data held by 9bde may be transferred to the acquiring entity as part of that transaction. Affected account holders will be notified by email prior to any such transfer, and the receiving entity will be required to honour the terms of this Privacy Policy in respect of data collected prior to the transfer.

7. Data Retention

9bde retains personal data for the periods set out below. Once the applicable retention period has expired, data is securely deleted or irreversibly anonymised.

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years post-closure	Legal obligation, dispute resolution
KYC identity documents	Duration of account + 5 years post-closure	Anti-money laundering compliance
Financial transaction records	7 years from transaction date	Financial regulatory compliance
Betting and gaming activity logs	Duration of account + 3 years post-closure	Dispute resolution, responsible gaming audit
Customer support communications	3 years from date of interaction	Service quality, dispute evidence
Technical/device/session logs	13 months from collection	Security, fraud detection
Marketing consent records	Until consent is withdrawn + 3 years	Proof of consent for compliance
Self-exclusion records	Minimum 7 years from exclusion date	Responsible gaming obligation

8. Data Security

9bde implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure.

8.1 Technical Measures

• SSL/TLS Encryption: All data in transit between your device and the 9bde Platform is encrypted using TLS 1.2 or higher.
• Password Hashing: Account passwords are stored using a strong one-way cryptographic hash function and are never accessible in plain text by any 9bde employee.
• Two-Factor Authentication: 9bde offers SMS OTP two-factor authentication for all account holders. We strongly recommend enabling 2FA to protect your account.
• Database Access Controls: Access to production databases containing personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls.
• Intrusion Detection: Automated intrusion detection systems monitor for unusual access patterns or suspicious activity on our infrastructure.

8.2 Organisational Measures

• All staff with access to personal data receive regular data protection training
• Contracts with all third-party processors include data protection obligations equivalent to those in this Policy
• Regular internal security reviews and vulnerability assessments are conducted
• A documented incident response procedure is in place for potential data breaches

8.3 Data Breach Response

In the event of a data breach that poses a risk to your rights and freedoms, 9bde will notify affected account holders without undue delay after becoming aware of the breach, and in any case within 72 hours of confirmation. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the incident.

9. Cookies and Tracking Technologies

9bde uses cookies and similar tracking technologies on the Platform. A cookie is a small data file placed on your device by a website. Cookies serve several functions on the 9bde Platform.

9.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as account login sessions, security controls, and fraud prevention. These cookies cannot be disabled as the Platform cannot operate without them.
• Functional Cookies: These cookies remember your preferences such as language settings, last visited game category, and session timeout preferences. They improve your experience but are not essential to Platform operation.
• Analytics Cookies: These cookies help 9bde understand how players use the Platform — which features are most popular, where users encounter difficulties, and how navigation flows work. Analytics data is aggregated and does not identify you personally.
• Responsible Gaming Cookies: These cookies support features such as session time tracking, pop-up reminders, and deposit limit enforcement to help you stay in control of your betting activity.

9.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to view, manage, and delete cookies stored by websites. However, please be aware that disabling functional or analytics cookies may affect the quality of your experience on the 9bde Platform. Disabling strictly necessary cookies will prevent the Platform from functioning correctly.

9bde does not use third-party advertising cookies or allow advertising networks to track your activity on the Platform for the purposes of serving behavioural advertising to you on other websites.

10. Your Rights Over Your Personal Data

Subject to applicable law, you have the following rights in relation to the personal data 9bde holds about you. To exercise any of these rights, please contact us using the details in Section 16.

• Right of Access: You may request a copy of the personal data 9bde holds about you, along with information about how it is used and with whom it is shared. We will respond to access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For registration data, you may update basic details directly from within your account settings.
• Right to Erasure: You may request that 9bde delete your personal data where: the data is no longer required for the purpose it was collected; you withdraw consent and no other legal basis applies; or the data has been processed unlawfully. This right is subject to 9bde's legal retention obligations, which may require certain data to be kept for defined periods.
• Right to Restriction of Processing: You may request that 9bde restrict the processing of your personal data in certain circumstances, such as where the accuracy of the data is contested or where you have objected to processing.
• Right to Data Portability: You may request a copy of personal data you have provided to 9bde in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity.
• Right to Object: You may object to processing based on 9bde's legitimate interests, including profiling. You may also object to processing for direct marketing purposes at any time, which will be honoured without qualification.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

All rights requests will be acknowledged within 5 business days and fulfilled within 30 days. In complex cases, the response period may be extended by a further 30 days, and you will be notified of this extension.

11. Children and Minors

The 9bde Platform is strictly intended for individuals who are 21 years of age or older. 9bde does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If 9bde becomes aware that personal data has been collected from an individual under the age of 21, that account will be suspended immediately, all funds will be frozen pending investigation, and any personal data collected will be deleted from our systems as soon as is reasonably practicable. If you have reason to believe that a minor has registered an account on the 9bde Platform, please contact us immediately at the address provided in Section 16.

12. International Data Transfers

9bde's primary operations and data storage infrastructure are configured to serve the Bangladesh market. Where data is processed by or transferred to third-party service providers located outside Bangladesh — for example, game technology providers or cloud infrastructure partners — 9bde ensures that appropriate safeguards are in place to protect your personal data during any such transfer.

Safeguards for international transfers include: contractual data protection obligations in agreements with all overseas processors; selection of processors who operate under recognised data protection frameworks; and where applicable, standard contractual clauses or equivalent instruments that impose data protection obligations equivalent to those in this Policy.

13. Marketing Communications

9bde may send you marketing communications about promotions, bonuses, new game releases, and other offers related to the 9bde platform where you have given your explicit consent to receive such communications at the time of account registration or subsequently.

You may opt out of receiving marketing communications at any time by:

• Using the unsubscribe link included in every marketing email sent by 9bde
• Updating your communication preferences from within your account settings
• Contacting 9bde customer support directly with an opt-out request

Please allow up to 5 business days for an opt-out request to take effect across all communication channels. Opting out of marketing communications will not affect the receipt of transactional communications related to your account, such as deposit confirmations, withdrawal notifications, and security alerts — these are sent as part of the service and cannot be individually opted out of while your account is active.

14. Responsible Gaming and Data

9bde analyses betting patterns, session durations, deposit frequency, and account activity using automated systems to identify players who may be exhibiting signs of problematic gambling behaviour. Where such indicators are detected, 9bde may proactively contact the account holder with responsible gaming information or apply precautionary account restrictions.

Self-exclusion records are retained for a minimum of 7 years following an exclusion event to ensure that re-registration attempts can be detected and blocked throughout the exclusion period. This processing is carried out in the vital interests of the account holder and in fulfilment of responsible gaming obligations.

15. Changes to This Privacy Policy

9bde reserves the right to update or amend this Privacy Policy at any time. Where a material change is made to the way your personal data is collected, used, or shared, 9bde will notify you by email to the address registered on your account at least 14 days before the change takes effect. Non-material updates (such as clarifications of existing practices or typographical corrections) may be made without advance notice, and the "Effective Date" at the top of this Policy will be updated accordingly.

Your continued use of the 9bde Platform following the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the updated Policy, you must discontinue use of the Platform and may request account closure.

The most current version of this Privacy Policy will always be accessible at 9bde.io/privacy-policy.

16. Contact and Data Rights Requests

For all privacy-related enquiries, data rights requests, or concerns about 9bde's handling of your personal data, please contact us using the following details:

• Email: [email protected]
• Subject line for data rights requests: "Privacy Request – [Your Account Username]"
• Response time: Acknowledgement within 5 business days; full response within 30 days
• Support Hours: 24 hours a day, 7 days a week

To protect the security of your personal data, 9bde may require you to verify your identity before fulfilling any data rights request. Requests made by a third party on your behalf will require written authorisation from you before they can be processed.