Privacy Policy — 16bd

1 Introduction

16bd ("the Company", "we", "us", "our") operates the online casino and sports betting platform accessible at https://16bd.io. We are committed to protecting the privacy and personal data of all users ("you", "the Player") who interact with our platform. This Privacy Policy sets out, in clear and accessible terms, how we collect, use, store, share and protect personal data, and explains the rights available to you in relation to that data.

This Policy should be read alongside our Terms and Conditions and our Responsible Gaming Policy, both of which are published on the platform. Where this Policy uses terms defined in the Terms and Conditions, those definitions apply here also.

We review and update this Policy periodically to reflect changes in our data practices, applicable law or regulatory guidance. The date of the most recent revision is displayed at the top of this document and on the Table of Contents sidebar. Material changes will be communicated to registered Players by platform notification or email before they take effect.

2 Personal Data We Collect

Depending on how you interact with the 16bd platform, we may collect the following categories of personal data:

We do not intentionally collect special categories of sensitive personal data (such as data revealing racial origin, political opinions, health conditions or biometric data for identification purposes) unless you voluntarily provide such information in the context of a support interaction or a responsible gaming referral, in which case it will be handled with the highest level of care and used only for the specific purpose for which it was provided.

3 How We Collect Your Data

We collect personal data through the following channels:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or participating in a promotion.
• Automated technologies: Technical and usage data collected automatically when you browse or use the platform, including through cookies, server logs and similar tracking technologies. See Section 8 for full details.
• Payment processors: Confirmation data received from payment providers such as bKash, Nagad, Rocket and Upay when a transaction is initiated or completed. We receive only the minimum data necessary to reconcile transactions and do not receive your full mobile banking PIN or credentials.
• Game Providers: Aggregated game session and outcome data from third-party Game Providers such as Pragmatic Play, Evolution Gaming and Spribe, used for account management and dispute resolution purposes.
• Identity verification services: Where we use third-party KYC or document verification services to authenticate identity documents, those services may return verification status and data-match scores to us.
• Publicly available sources: In limited circumstances, and only where required for fraud prevention or AML compliance, we may cross-reference data against publicly available information such as sanctions lists or adverse media sources.

4 Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The primary legal bases on which 16bd relies are:

• Contractual necessity: Processing that is necessary to perform our contract with you — i.e., to provide you with a functional account, process your transactions, settle your bets and deliver customer support. Without this processing, we cannot deliver the service.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including AML and counter-terrorist financing (CTF) obligations, KYC requirements, financial record-keeping duties and responses to valid law enforcement requests.
• Legitimate interests: Processing necessary for our legitimate interests, where those interests are not overridden by your privacy rights. This includes fraud detection, security monitoring, platform improvement and responsible gaming monitoring. We conduct a balancing test before relying on this basis and will document that assessment.
• Consent: For non-essential marketing communications and non-essential cookies, where we rely on your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. See Section 13 for marketing opt-out details.

5 How We Use Your Personal Data

16bd uses the personal data we collect for the following purposes:

• To register and maintain your player account and verify your identity and age in compliance with our 21+ policy.
• To process deposits and withdrawals via bKash, Nagad, Rocket, Upay and other supported payment channels.
• To provide access to casino games, sports betting markets, promotions and other platform features.
• To detect, investigate and prevent fraudulent transactions, unauthorised account access, bonus abuse, money laundering and other prohibited conduct described in our Terms and Conditions.
• To comply with AML, CTF and KYC obligations, including verifying the source of funds where required.
• To monitor gaming behaviour for responsible gaming purposes, including identifying patterns that may indicate problem gambling and triggering appropriate interventions.
• To respond to your support requests, complaints and enquiries.
• To send you transactional communications, including deposit and withdrawal confirmations, account security alerts and important policy updates.
• To send you promotional communications about bonuses, offers and events on the platform, where you have provided consent or where we rely on a legitimate interest basis and you have not opted out.
• To analyse aggregated, anonymised usage data to improve the platform, fix bugs and develop new features. No individually identifying data is used in this analysis.
• To produce reports and disclosures required by regulatory authorities or in response to valid legal process.

We will not use your personal data for any purpose that is incompatible with the purposes described above without first informing you and, where necessary, obtaining your consent.

6 Data Sharing and Disclosure

16bd does not sell, rent or trade your personal data. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: We share necessary transaction data with bKash, Nagad, Rocket, Upay and other payment service providers to process your deposits and withdrawals. These providers are contractually bound to process data only for payment purposes and to maintain appropriate security standards.
• Game Providers: We share your username and session data with third-party Game Providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi) to the extent required to deliver game functionality, manage game sessions and resolve technical disputes.
• Identity verification and fraud prevention services: We may share identity document data with specialist KYC service providers for verification purposes. Results are returned to us and the underlying documents are not retained by those providers beyond their contractually defined verification window.
• Regulatory and law enforcement authorities: We are required by law to report certain transactions and activities to relevant financial intelligence units, law enforcement agencies or regulatory bodies. Such disclosures are made in strict accordance with applicable legal process and only to the extent required.
• Professional advisers: We may share data with our legal advisers, auditors and accountants where necessary for the purposes of obtaining professional advice, conducting audits or managing legal proceedings. Such parties are bound by professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of all or part of the Company's business, personal data held by the Company may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

All third-party processors with whom we share personal data are required by contract to implement appropriate technical and organisational security measures and to process data only on our instructions and in accordance with applicable data protection law.

7 International Data Transfers

As an online platform that uses internationally distributed technology infrastructure and third-party Game Providers headquartered in various jurisdictions, some of your personal data may be transferred to, stored in, or processed in countries outside Bangladesh. This may include servers located in Singapore, Ireland, the United Kingdom or other jurisdictions where our technology partners operate data centres.

Where personal data is transferred outside Bangladesh, we take steps to ensure that it receives a level of protection equivalent to that required under applicable data protection standards. These steps may include entering into standard contractual clauses with the receiving party, ensuring the recipient operates in a jurisdiction with adequate data protection laws, or applying other appropriate transfer mechanisms.

By registering an account with 16bd, you acknowledge that your data may be transferred in the manner described above. If you have questions about the specific safeguards applied to international transfers of your data, please contact the support team.

8 Cookies and Tracking Technologies

The 16bd platform uses cookies and similar technologies (including local storage objects and session identifiers) to operate core platform functionality, remember your preferences and analyse aggregate usage patterns. The following categories of cookies are used:

• Strictly necessary cookies: These are essential to the operation of the platform and cannot be disabled. They include session authentication cookies, security tokens, load-balancing cookies and cookies that remember your login state. No personal data is stored in these cookies beyond what is required for the session.
• Functional cookies: These remember your preferences — such as your preferred language, display settings and any responsible gaming session-time preferences you have configured. Disabling these cookies may result in reduced platform functionality.
• Analytics cookies: We use internal analytics tools to collect aggregated, anonymised data about how players navigate the platform, which features are most used, and where technical issues occur. This data is used exclusively for platform improvement and is not shared with third-party advertising networks.

We do not use third-party advertising cookies, retargeting pixels or cross-site tracking technologies. You can manage or delete cookies through your browser's settings at any time. Please note that disabling strictly necessary cookies will prevent the platform from functioning correctly.

9 Data Security

16bd implements a layered approach to data security designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Our security measures include:

• TLS 1.2/1.3 encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including payment account references and identity document scans.
• Role-based access controls ensuring that staff members can access personal data only where it is necessary for their specific job function.
• Multi-factor authentication requirements for internal administrative systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Continuous monitoring of platform traffic for anomalies indicative of intrusion attempts, credential stuffing or fraudulent access.
• Documented incident response procedures to ensure rapid detection, containment and notification in the event of a data breach.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, 16bd will notify affected Players without undue delay and will take all practicable steps to mitigate harm. We will also notify the relevant regulatory authority as required by applicable law.

While we maintain robust security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

10 Data Retention

16bd retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy and to comply with our legal and regulatory obligations. The following indicative retention periods apply:

• Account and identity data: Retained for a minimum of five (5) years from the date of account closure. This retention period is required to satisfy AML record-keeping obligations and to enable resolution of any post-closure disputes or regulatory enquiries.
• Transaction and betting records: Retained for a minimum of five (5) years from the date of each transaction, in line with financial record-keeping requirements.
• KYC documentation (identity documents, selfies, proof of address): Retained for the duration of the account and for a minimum of five (5) years after account closure. Documents may be retained longer where an account is subject to ongoing investigation or regulatory review.
• Support and communications data: Retained for three (3) years from the date of the interaction, or longer where the communication relates to an unresolved complaint or ongoing legal matter.
• Technical and usage data (logs, IP addresses): Retained for up to twelve (12) months from collection, after which logs are anonymised or deleted unless they relate to a specific security incident under active investigation.
• Marketing consent records: Retained for as long as you remain a registered Player and for three (3) years after account closure, to enable us to demonstrate that marketing was sent on a valid consent basis.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the resulting anonymised dataset is no longer personal data and may be retained and used for analytical purposes indefinitely.

11 Your Data Rights

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data 16bd holds about you:

• Right of access: You may request a copy of the personal data we hold about you, together with information about how it is processed. We will respond to access requests within 30 days of receipt.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may ask us to correct or complete it. You can update certain data directly within your account settings; for other corrections please contact the support team.
• Right to erasure ("right to be forgotten"): You may ask us to delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the processing is unlawful. This right is subject to our legal retention obligations — we cannot delete data we are required by law to retain.
• Right to restrict processing: You may ask us to restrict the processing of your data in certain circumstances, for example while we investigate a rectification request or a complaint about our processing.
• Right to data portability: Where we process your data on the basis of consent or contractual necessity, you may request that we provide it to you in a structured, commonly used and machine-readable format.
• Right to object: You may object at any time to processing based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
• Rights related to automated decision-making: Where we make decisions about you using solely automated means that produce legal or similarly significant effects, you have the right to request human review of that decision. Please contact us if you believe an automated decision has affected you.

To exercise any of the above rights, please contact the 16bd support team (see Section 16). We may need to verify your identity before processing your request. There is no charge for exercising your rights, although we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

12 Children and Minors

The 16bd platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes age verification steps designed to prevent minors from accessing the platform.

If we become aware that personal data has been collected from a person under 21 — whether through our own detection, a report from a third party, or notification by a parent or guardian — we will immediately suspend the relevant account, securely delete the data collected in relation to that account, and return any deposits made via the account's registered payment method.

Parents and guardians are encouraged to use parental control software and to monitor their children's internet usage to prevent access to gambling platforms. If you believe a person under the age of 21 has registered an account on 16bd, please contact our support team immediately so that we can take prompt action.

13 Marketing Communications

With your consent, 16bd may send you promotional communications about bonuses, new games, seasonal offers (for example around Eid, Pohela Boishakh or the BPL cricket season), and other platform news. These communications may be delivered by SMS to your registered mobile number or by email to your registered email address.

You may opt out of marketing communications at any time by:

• Contacting the 16bd support team and requesting removal from marketing lists.
• Updating your communication preferences within your account settings (where available).
• Following the unsubscribe instructions included in any marketing email.

Please note that opting out of marketing communications does not affect our ability to send you essential transactional communications — such as deposit confirmations, withdrawal notifications, security alerts and important policy updates — which are sent on the basis of contractual necessity and cannot be opted out of while your account remains active.

We do not share your contact details with third-party marketing companies. All promotional communications originate from 16bd directly.

14 Third-Party Links and Services

The 16bd platform may display game content or informational links relating to third-party Game Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe and Ezugi. When you play a game provided by one of these studios, your game session data is processed by that studio's certified RNG or live dealer infrastructure. Each Game Provider operates under its own privacy and data processing policies, and 16bd is not responsible for the data practices of Game Providers beyond the contractual obligations we impose on them as described in Section 6.

Similarly, when you initiate a payment via bKash, Nagad, Rocket or another payment service, your interaction with that service is governed by the payment provider's own terms and privacy policies. 16bd receives only the minimum transaction confirmation data needed to credit or debit your account.

This Privacy Policy does not extend to any third-party service, and we encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the 16bd platform.

15 Changes to This Privacy Policy

16bd reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law or regulatory guidance. The revised Policy will be published on the platform with an updated effective date at the top of the document.

Where an amendment is material — meaning it significantly affects your rights or the way in which we process your personal data — we will provide reasonable advance notice by posting a notice on the platform or by sending a notification to your registered contact details before the change takes effect.

Minor amendments, such as typographical corrections, clarifications that do not alter the substance of the Policy, or updates required to reflect changes in applicable law, may take effect immediately upon publication. We recommend that you review this Policy periodically to stay informed of any updates. Your continued use of the platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy.

16 Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or to the personal data 16bd holds about you, please contact us through the following channel:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the platform.
• Response Time: We aim to respond to all privacy-related enquiries within 72 hours and to formal data subject access requests within 30 days of receipt.

When contacting us about a data subject request, please include your registered username and a brief description of your request so that we can verify your identity and process your request efficiently.

This Privacy Policy was last reviewed and updated on 1 January 2026. All prior versions of this Privacy Policy are superseded by this version as of that date.