22bd Privacy Policy

Introduction and Scope

This Privacy Policy ("Policy") describes how 22bd ("22bd", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "Player", "User") who access or use the 22bd online betting and gaming platform located at https://22bd.bar (the "Platform").

This Policy applies to all personal data collected through the Platform, including data provided during account registration, identity verification (KYC), payment processing, customer support interactions, and general platform usage. It applies to all players regardless of the device or method used to access the Platform, whether via desktop browser, mobile browser, or any 22bd mobile application.

By registering a 22bd account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and contact support to request account closure.

This Policy should be read alongside 22bd's Terms & Conditions and Responsible Gaming Policy, both of which are published on the Platform and incorporated by reference.

Data Controller Information

22bd acts as the data controller in respect of all personal data collected from players using the Platform. As data controller, 22bd determines the purposes and means by which personal data is processed, and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

All data-related enquiries, access requests, correction requests, and deletion requests should be directed to the 22bd Data Protection team via the contact channels listed in Section 13 of this Policy. 22bd aims to acknowledge all data-related requests within 5 business days and to provide a substantive response within 20 business days of identity verification.

Personal Data We Collect

22bd collects personal data from players through several distinct channels. The categories of data collected and the circumstances under which they are collected are set out in the table below:

3.1 Data You Provide Voluntarily

The majority of personal data 22bd holds about you is data you have provided directly — for example, the name and mobile number entered during registration, or the NID scan submitted during KYC verification. Providing this data is necessary to access the full range of 22bd's services. Where data fields are optional, this will be indicated at the point of collection.

3.2 Data Collected Automatically

When you visit the 22bd Platform, certain technical data is collected automatically by our systems. This includes your IP address, the type of device and browser you are using, and anonymised identifiers that help us recognise returning sessions. This data is used for platform security, fraud prevention, and service optimisation, and is not used to identify you personally without further corroborating data.

3.3 Data From Third Parties

In limited circumstances, 22bd may receive personal data about you from third parties. This includes identity verification data returned by KYC service providers, fraud-risk signals from payment processors, and, where you have opted in to affiliate or referral programmes, basic referral information from affiliate partners. All third-party data sharing is governed by contractual data-processing agreements that require third parties to handle your data in accordance with applicable data protection standards.

How We Use Your Personal Data

22bd uses the personal data it collects for the following purposes:

• Account creation and management: To register your account, verify your identity, manage your profile, and maintain your account in good standing throughout your relationship with 22bd.
• Payment processing: To facilitate deposits via bKash, Nagad, Rocket, Upay, and bank transfer, and to process withdrawal requests to your registered payment account in Bangladeshi Taka (BDT).
• KYC and AML compliance: To verify your identity and age (21+ requirement), to screen against sanctions lists, and to comply with anti-money-laundering (AML) obligations applicable to online gaming platforms.
• Service delivery: To provide access to the sportsbook, live casino, slots, and all other games and features available on the Platform, and to personalise your experience based on your activity history.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, multi-accounting, and other abuse of the Platform.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and maintain records of our communications for quality and training purposes.
• Responsible Gaming: To monitor betting patterns that may indicate problem gambling behaviour, to enforce deposit and loss limits set by the player, and to administer self-exclusion requests.
• Marketing and promotions: To send promotional SMS messages and emails about 22bd bonuses, new games, BPL cricket specials, seasonal promotions, and other offers — to players who have opted in to marketing communications. You can withdraw consent at any time.
• Platform improvement: To analyse aggregated, anonymised usage data in order to improve the performance, features, and user experience of the 22bd Platform.
• Legal compliance: To comply with applicable laws and to respond to lawful requests from governmental or regulatory authorities.

Legal Basis for Processing

22bd processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and 22bd — including account registration, payment processing, and service delivery — is carried out on the basis that it is required to fulfil our contractual obligations to you.
• Legal obligation: Processing that is required to comply with applicable legal and regulatory obligations — such as KYC identity verification, AML transaction monitoring, and record-keeping requirements — is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics is conducted on the basis of 22bd's legitimate interests in operating a safe, secure, and compliant platform, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications (promotional SMS and email) is conducted on the basis of your explicit opt-in consent at the time of registration or subsequently via account settings. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They serve a variety of functions, from remembering your login session to helping website operators understand how users navigate their platform. 22bd uses cookies and similar tracking technologies (including local storage, session tokens, and pixel tags) on the Platform.

6.2 Categories of Cookies Used by 22bd

• Strictly necessary cookies: These cookies are essential for the Platform to function. They maintain your logged-in session, store your language and region preferences, and enable core features such as the bet slip and cashier. These cookies cannot be disabled without severely impairing your ability to use the Platform.
• Performance and analytics cookies: These cookies collect anonymised information about how players use the Platform — such as which pages are visited most frequently and where errors occur. This data is used exclusively for internal performance improvement and is not shared with advertising networks.
• Functionality cookies: These cookies remember choices you have made — such as preferred display settings or notification preferences — in order to deliver a more personalised experience on your next visit.
• Fraud prevention cookies: These cookies work alongside our fraud detection systems to identify unusual patterns of access that may indicate account compromise or bot activity.

6.3 Managing Cookies

You can control and manage cookies via your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and receive notifications when a new cookie is set. Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Instructions for managing cookies in common browsers are available via the browser's help documentation.

Data Sharing and Third Parties

22bd does not sell your personal data to any third party. We may, however, share your data with the following categories of third-party service providers where it is necessary to operate the Platform and deliver our services:

• KYC and identity verification providers: Third-party services that process your identity documents and perform automated age and identity verification checks on 22bd's behalf.
• Payment processors: Mobile financial service providers (bKash, Nagad, Rocket, Upay) and banking partners that process your BDT deposits and withdrawals. These parties receive only the payment data necessary to complete your transaction.
• Game content providers: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi whose game engines are integrated into the 22bd Platform. These providers may receive anonymised session data in order to deliver game content and calculate RTP.
• Fraud and security services: Third-party fraud detection and cybersecurity platforms that receive technical data (IP address, device fingerprint) in order to identify and block fraudulent access attempts.
• Customer support platforms: Cloud-based CRM and live chat software providers that facilitate our support operations. These providers process support communication data on 22bd's behalf under data-processing agreements.
• Legal and regulatory authorities: In cases where 22bd is required by law, court order, or regulatory direction to disclose player data, we will comply with such requests. Where permitted, 22bd will notify the affected player of any such disclosure.

All third-party service providers who process personal data on behalf of 22bd are subject to contractual data-processing agreements that require them to implement appropriate security measures, process data only for the specified purpose, and not further disclose or use personal data for any purpose beyond the scope of their engagement with 22bd.

Data Retention

22bd retains personal data for as long as it is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal and regulatory obligations, whichever is the longer period. The following general retention principles apply:

• Active account data: Personal data associated with an active 22bd account is retained for the duration of the account's active status.
• Closed account data: Following account closure, 22bd retains account and transaction records for a minimum of five years to comply with AML record-keeping obligations and to facilitate the resolution of any post-closure disputes.
• KYC documents: Identity verification documents are retained for the period required by applicable anti-money-laundering regulations, after which they are securely deleted.
• Support communications: Live chat transcripts and email support records are retained for a period of three years following the date of the interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Records of marketing opt-in and opt-out events are retained for the duration of the account and for three years after account closure, in order to demonstrate compliance with consent obligations.
• Technical and analytics data: Anonymised analytics data (from which individual players cannot be identified) may be retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to any identifiable individual.

Data Security

22bd implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include but are not limited to:

• TLS/SSL encryption: All data transmitted between your device and 22bd's servers is encrypted using industry-standard Transport Layer Security (TLS 1.2 or higher), protecting your data in transit from interception.
• Encryption at rest: Sensitive data stored on 22bd's servers — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to player personal data within 22bd's internal systems is restricted on a strict need-to-know basis. Staff who handle personal data undergo regular data protection training and are subject to confidentiality obligations.
• Two-factor authentication (2FA): 22bd offers SMS-based 2FA to all registered players and applies 2FA requirements to all internal staff accounts that have access to player data.
• Intrusion detection and monitoring: 22bd's infrastructure is monitored continuously for anomalous activity. Automated intrusion detection systems alert the security team to potential threats in real time.
• Regular security audits: 22bd conducts periodic security assessments of its platform infrastructure, including vulnerability scanning and penetration testing, to identify and remediate potential weaknesses before they can be exploited.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a material risk to your personal data, 22bd will notify affected players via their registered contact details in a timely manner and will take all reasonable steps to contain and remediate the breach.

Your Rights as a Data Subject

As a player whose personal data is processed by 22bd, you have the following rights in respect of your personal data. To exercise any of these rights, please contact the 22bd Data Protection team using the details in Section 13. We will verify your identity before processing any data request:

• Right of access: You have the right to request a copy of the personal data 22bd holds about you. We will provide this information in a clear, accessible format within 20 business days of identity verification.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Corrections to core account data (such as name or date of birth) may require re-submission of identity documentation.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (for consent-based processing only), or where you object to processing and there are no overriding legitimate grounds. Note that the right to erasure does not apply where 22bd is required to retain data by law (e.g., AML retention obligations).
• Right to restriction of processing: You may request that 22bd restricts the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing pending determination of whether legitimate grounds override your objection.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request a machine-readable copy of your personal data so that it can be transferred to another service provider of your choosing.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for responsible gaming monitoring. 22bd will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent: Where processing is based on your explicit consent (such as marketing communications), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Children and Underage Users

The 22bd Platform is strictly intended for adults aged 21 years and over. 22bd does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process. If 22bd discovers or is notified that a registered account belongs to an individual under 21 years of age, the account will be immediately suspended, any funds held will be frozen pending investigation, and the personal data associated with that account will be processed in accordance with applicable legal requirements.

If you believe that a person under the age of 21 has registered a 22bd account, please contact our support team immediately at [email protected] so that we can take prompt action. We take underage gambling prevention extremely seriously and cooperate fully with all lawful requests relating to the protection of minors.

Changes to This Privacy Policy

22bd reserves the right to update or amend this Privacy Policy at any time. When material changes are made, 22bd will notify registered players via their registered mobile number or email address at least 7 days before the updated Policy takes effect. The effective date at the top of this Policy will be updated whenever a new version is published.

Where a change to this Policy requires your explicit re-consent (for example, a new category of processing based on consent), you will be prompted to review and accept the updated terms before continuing to use the Platform. For changes that do not require re-consent, continued use of the Platform after the effective date of the update constitutes your acceptance of the revised Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how 22bd is protecting your personal data. The most current version of this Policy is always available at https://22bd.bar/privacy-policy.

Contact and Data Requests

For all privacy-related enquiries, data access requests, correction requests, deletion requests, or complaints regarding 22bd's handling of your personal data, please contact the 22bd Data Protection team through the following channels:

• Email: [email protected] — use the subject line "Data Privacy Request — [Your Account Username]"
• Live Chat: Available 24/7 via the live chat feature on the 22bd Platform — for urgent data security concerns
• WhatsApp: +880 1700 000000 — for general privacy enquiries during BST (UTC+6) business hours

22bd will acknowledge all data-related requests within 5 business days of receipt and will provide a substantive response within 20 business days of verifying your identity. In complex cases, this period may be extended by an additional 20 business days, in which case you will be notified of the extension and the reason for it before the initial 20-day period expires.

If you are not satisfied with 22bd's response to your data privacy request or complaint, you have the right to escalate your concern to the appropriate data protection authority in your jurisdiction.