Your Privacy Matters at 67bf — Here Is Exactly How We Protect It

1.1   67bf operates an online casino and sports betting platform accessible at https://67bf.io, serving players primarily located in Bangladesh. We are committed to protecting your personal privacy and ensuring that your personal data is handled lawfully, fairly, and transparently at all times.

1.2   This Privacy Policy explains in plain English what personal data 67bf collects when you register an account, make deposits, place wagers, participate in promotions, or contact our support team. It also explains why we collect that data, the legal basis on which we process it, who we may share it with, how long we retain it, and the rights you hold over your own information.

1.3   This policy applies to all personal data processed in connection with the 67bf platform — including data collected through the website interface, through our live chat and email support channels, through payment processing integrations, and through cookies and analytics tools described in Section 7.

1.4   This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference into the overall agreement between you and 67bf.

1.5   We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address registered on your account and display a prominent update notice on the platform. See Section 13 for full details on how policy changes are communicated.

2.1   The categories of personal data 67bf collects from players are set out in the table below. We collect only the data that is necessary for the specific purposes described in Section 4 — we do not collect data speculatively or in excess of what our legitimate operations require.

2.2   We do not collect sensitive personal data beyond what is strictly required for identity verification (NID/passport). We do not collect biometric data, political opinions, religious beliefs, or medical records. If a player voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request, that information is treated with the highest level of confidentiality and used solely to action the relevant player protection measure.

3.1   Directly from you: The majority of personal data 67bf holds about you is provided directly by you during the registration process, when completing KYC verification, when making deposit or withdrawal requests, when contacting our support team, or when voluntarily activating responsible gaming tools in your account dashboard.

3.2   Automatically during platform use: When you visit the 67bf platform, our servers automatically log technical data including your IP address, device identifiers, browser type, and session activity. This data is collected passively and is used for security monitoring, fraud prevention, and platform performance optimisation. See Section 7 for full details on cookies and tracking technologies.

3.3   From payment service providers: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or a linked Bangladeshi bank account, the relevant payment service provider confirms the transaction status and the name registered to the sending/receiving account. This confirmation is used solely to verify that the payment method belongs to the account holder and to prevent third-party financial transactions.

3.4   From game studio providers: Certified game studio partners (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) transmit aggregated game-round data (stake, outcome, return-to-player outcome) back to 67bf for wallet crediting and dispute resolution purposes. They do not share personal identity data with 67bf beyond what is needed for player session management.

3.5   From fraud prevention and KYC services: 67bf may use third-party identity verification and fraud screening services to cross-check player-provided identity data against reference databases. These services confirm document authenticity and flag potential identity discrepancies; they do not store your raw document images beyond the verification session.

4.1   67bf processes your personal data for the following specific and legitimate purposes:

• Account creation and management: To register your account, authenticate your logins via OTP, manage your wallet balance, and provide access to all platform features denominated in Bangladeshi Taka.
• Age and identity verification (KYC): To confirm that you are aged 21 or above and that your identity matches the details on file, as required before processing withdrawals and as part of our anti-money-laundering obligations.
• Payment processing: To process BDT deposits via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Bangladeshi bank transfers, and to process withdrawals to your verified payment methods.
• Game service delivery: To transmit your stake and game-session data to the relevant game studio server, receive the outcome, update your wallet balance, and maintain a complete wager history for your records and for dispute resolution.
• Bonus and promotion administration: To credit promotional bonuses, track wagering requirement progress, enforce eligibility rules, and expire bonus balances in accordance with the relevant promotion terms.
• Fraud prevention and security: To detect unauthorised access attempts, identify duplicate accounts, prevent bonus abuse, monitor for match-fixing patterns in sports betting, and flag transactions that may indicate money laundering.
• Responsible gaming compliance: To enforce player-set deposit limits, process self-exclusion requests, suppress marketing communications to excluded players, and monitor for at-risk behavioural patterns that may indicate problem gambling.
• Customer support: To respond to your queries, resolve disputes, and maintain a record of support interactions for quality assurance and training purposes.
• Platform improvement and analytics: To analyse aggregated, anonymised usage patterns in order to improve platform navigation, game lobby design, promotional effectiveness, and technical performance.
• Direct marketing communications: To send promotional emails, SMS messages, and WhatsApp notifications about bonuses, new games, and platform news — only where you have opted in to receive such communications and only while you do not have an active self-exclusion or time-out in place.
• Legal and regulatory compliance: To maintain transaction records and identity documents as required by applicable law and to respond to lawful requests from competent authorities.

5.1   Every processing activity carried out by 67bf rests on one or more of the following legal bases:

• Performance of a contract: Processing your identity data, financial data, and transactional data is necessary to fulfil 67bf's obligations under the Terms & Conditions you agreed to at registration — specifically to operate your account, process your payments, and deliver gaming services.
• Legitimate interests: Processing technical and security data (IP address, device data, session logs) is necessary for 67bf's legitimate interests in preventing fraud, securing the platform, detecting bonus abuse, and improving service quality. These interests do not override your fundamental privacy rights where appropriate safeguards are applied.
• Legal obligation: Processing identity documents and maintaining transaction records is required by applicable anti-money-laundering obligations and age verification requirements. 67bf must retain this data for the legally mandated minimum retention periods described in Section 8.
• Consent: Sending direct marketing communications via email, SMS, or WhatsApp is carried out only on the basis of your explicit opt-in consent, which you may withdraw at any time by updating your communication preferences in your account dashboard or by contacting our support team.
• Vital interests: In circumstances where we identify that a player's gambling behaviour may pose a serious risk to their financial or mental wellbeing, we may process responsible gaming data to activate protective measures — this processing is carried out to protect the vital interests of the player.

6.1   67bf does not sell, rent, or trade your personal data to third-party marketing organisations. We share your data only in the specific, limited circumstances described below:

• Payment service providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank): We share the minimum transaction data required to process your deposit or withdrawal. These providers operate under their own privacy policies and are bound by applicable financial services regulations.
• Game studio technology providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi): We share a session token and anonymised player identifier to enable game-round participation. No identity documents or payment details are shared with game studios.
• KYC and identity verification services: Your NID image, passport image, and date of birth are shared with our third-party KYC verification partner solely for the purpose of confirming document authenticity and validating that you are aged 21 or above. Document images are processed in accordance with the verification provider's data processing agreement with 67bf.
• Fraud prevention and anti-money-laundering services: Transactional patterns and identity data may be shared with specialist fraud screening services to identify suspicious activity. These services act as data processors under contractual obligations with 67bf and cannot use your data for their own purposes.
• Analytics and platform performance services: Anonymised, aggregated technical data (page views, session duration, feature usage) may be processed by analytics service providers. This data cannot be used to identify individual players.
• Legal authorities: 67bf will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, by a lawful court order, or where disclosure is necessary to protect the rights, property, or safety of 67bf, its players, or the public.
• Business successors: In the event of a merger, acquisition, or sale of all or part of 67bf's business assets, player data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. Affected players will be notified in advance of any such transfer.

6.2   All third parties with whom 67bf shares personal data are required to operate under data processing agreements that impose obligations equivalent to those described in this Privacy Policy. 67bf does not permit third-party processors to use your data for any purpose other than the specific service they are engaged to provide.

7.1   The 67bf platform uses cookies and similar tracking technologies (including local storage tokens and session identifiers) to operate core platform functionality, maintain your authenticated session, and collect anonymised analytics data about platform usage.

7.2   The following categories of cookies are used on the 67bf platform:

7.3   67bf does not use third-party advertising cookies, behavioural profiling cookies, or cross-site tracking pixels. We do not participate in ad network data sharing or retargeting schemes.

7.4   You can manage your cookie preferences at any time through your browser settings or through the 67bf account preferences panel. Please note that disabling strictly necessary or security cookies will prevent normal use of the platform.

8.1   67bf retains personal data only for as long as is necessary for the purposes described in Section 4, or for as long as is required by applicable legal and regulatory obligations, whichever is longer. The following retention periods apply:

8.2   When a retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player. Anonymised aggregated data (e.g., platform-wide wagering statistics with no player identifiers) may be retained indefinitely for business analysis purposes.

9.1   67bf implements a layered security architecture to protect your personal data from unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• Encryption in transit: All data exchanged between your browser or device and our servers is encrypted using TLS 1.2 or TLS 1.3 with 256-bit AES cipher suites. Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields including payment method numbers, NID numbers, and KYC document images are encrypted at rest in our database using industry-standard symmetric encryption. Encryption keys are managed in a separate, access-controlled key management system.
• Password security: Account passwords are stored exclusively as salted, one-way cryptographic hashes using a bcrypt-equivalent algorithm. No 67bf employee can retrieve your password in plain text. If you forget your password, a reset link is issued — your original password is not recoverable.
• Two-factor authentication (OTP): All account logins trigger a one-time password sent to your registered Bangladeshi mobile number. This OTP is required to complete authentication and is valid for a limited window of five (5) minutes only.
• Access controls: Access to personal data within 67bf's internal systems is restricted to staff members who require it to perform their job functions. All internal data access is logged and subject to periodic audit. Access permissions are reviewed quarterly and revoked immediately upon staff departure.
• Intrusion detection and monitoring: Our security team operates continuous monitoring for unusual access patterns, brute-force login attempts, and suspicious data exfiltration signals. Automated alerts trigger immediate investigation and, where necessary, temporary account suspension.
• Data breach response: In the event of a personal data breach that poses a risk to affected players, 67bf will notify impacted players as promptly as practicable — within seventy-two (72) hours of becoming aware of the breach — via the email address registered on their account, and will publish a security notice on the platform homepage.

9.2   While 67bf takes all reasonable technical and organisational measures to protect your personal data, no internet transmission is completely secure. You are also responsible for keeping your login credentials confidential and for reporting any suspected unauthorised account access to our support team without delay via 24/7 live chat.

10.1   As a player whose personal data is processed by 67bf, you hold the following rights with respect to your personal information. To exercise any of these rights, please contact our support team via live chat or email at the address in Section 14. We will respond to all verified rights requests within thirty (30) calendar days of receipt.

• Right of access: You may request a copy of all personal data 67bf holds about you. We will provide this in a structured, machine-readable format (JSON or CSV) at no charge.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request its correction. Identity corrections may require re-submission of KYC documentation.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data. Note that we cannot fulfil erasure requests where retention is required by law (e.g., KYC and transaction records subject to the five-year AML retention period described in Section 8). In such cases, we will explain precisely which data must be retained and why.
• Right to restriction of processing: You may request that we restrict the processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to data portability: You may request that your personal data (account information, transaction history, wager history) be provided to you in a portable, structured format so that you can transfer it to another service if you choose.
• Right to object: You may object at any time to the processing of your personal data for direct marketing purposes. This includes withdrawing consent to receive promotional emails, SMS messages, and WhatsApp communications. Withdrawal of marketing consent does not affect the lawfulness of prior processing.
• Right to withdraw consent: Where processing is based on your consent (e.g., direct marketing), you may withdraw that consent at any time by updating your account communication preferences or by contacting support. Withdrawal of consent is effective immediately for future communications.

10.2   To protect your privacy and prevent fraudulent requests, 67bf will verify your identity before actioning any rights request. Verification typically requires you to confirm your registered email address and, for access or portability requests, to complete a live chat OTP verification. We will not charge a fee for rights requests unless they are manifestly unfounded or excessive in volume.

11.1   67bf employs mandatory NID-based age verification during the KYC process to confirm that all players are aged 21 or above before any withdrawal is processed. Players who attempt to circumvent age verification will have their accounts permanently closed.

11.2   If you are a parent or guardian and believe that a minor in your care has registered an account on the 67bf platform, please contact our support team immediately via live chat. We will investigate promptly and take all appropriate protective action within twenty-four (24) hours of notification.

11.3   For guidance on parental controls and tools to prevent minors from accessing gambling platforms, please visit our Responsible Gaming page, which provides links to recognised third-party filtering tools available in Bangladesh.

12.1   The 67bf platform may contain references to third-party services such as game studio providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and payment service providers (bKash, Nagad, Rocket, Upay). When you interact directly with these third-party systems — for example, when launching a live dealer game streamed from an Evolution Gaming server, or when completing a bKash mobile payment — you are also subject to the privacy policies of those respective providers.

12.2   67bf has no control over the data practices of third-party providers and accepts no responsibility for their privacy policies or the manner in which they collect or process your personal data. We encourage you to review the privacy policies of any third-party provider with whom you interact in connection with your use of the 67bf platform.

12.3   67bf does not embed third-party social media widgets, advertising trackers, or affiliate tracking pixels on the platform that would allow third parties to collect your personal data without your knowledge. Any analytics integrations used by 67bf are configured to anonymise IP addresses and operate under strict data processing agreements.

13.1   67bf reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or changes to the services we provide. The version number and "Last Updated" date at the top of this document will be revised whenever a change is made.

13.2   When we make material changes — defined as changes that significantly affect how we collect, use, or share your personal data — we will notify you in the following ways:

• An email notification to the address registered on your 67bf account, sent at least seven (7) days before the revised policy takes effect.
• A prominent notice banner displayed on the 67bf platform homepage and account dashboard for a minimum of fourteen (14) days following the update.
• An in-platform notification in your account notification centre, requiring acknowledgement on next login.

13.3   Non-material changes — such as corrections of typographical errors, clarifications that do not alter the substance of our data practices, or updates to contact information — may be made without advance notice. The updated version date will nonetheless be revised to reflect any such changes.

13.4   Your continued use of the 67bf platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept a revised policy, you should discontinue use of the platform and may request account closure by contacting our support team.

14.1   If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data 67bf holds about you, please contact our Data Privacy team using the details below. All privacy-related enquiries are handled in English and will receive a substantive written response within five (5) business days.

14.2   For formal complaints about how 67bf has handled your personal data, please follow the complaints procedure described in our Terms & Conditions. Formal complaints receive a full written response within five (5) business days and are escalated to senior management if not resolved at first contact.