35bp Privacy Policy — How We Handle Your Personal Data

Introduction & Scope

35bp ("we", "us", "our") operates the online casino and sports betting platform accessible at https://35bp.io, including all associated games, features, promotions, and services offered therein (collectively, "the Platform"). We are committed to protecting the privacy and personal data of all users who interact with the Platform.

This Privacy Policy ("Policy") describes how 35bp collects, uses, stores, discloses, and otherwise processes personal data relating to users ("you", "your") of the Platform. It is intended to be clear, specific, and transparent so that you can make informed decisions about the information you share with us.

This Policy applies to:

• All registered account holders on the 35bp platform.
• Visitors who browse the Platform without a registered account.
• Any individual who contacts 35bp through our support channels.

This Policy does not apply to third-party websites, game providers, or payment processors that may be accessible through links or integrations on our Platform. Those parties operate under their own privacy policies, which we encourage you to review.

Data We Collect

35bp collects personal data in several categories depending on your level of engagement with the Platform. The table below provides a structured overview of the categories of data we may hold about you.

We do not knowingly collect special categories of sensitive personal data (such as health data, biometric data used for identification, or political opinions) except where this is strictly required by applicable law or anti-money laundering regulations.

How We Collect Data

Personal data is collected through the following channels and methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automatic collection: Technical data (IP address, device information, browser fingerprint, session logs) is collected automatically when you visit or interact with the Platform, using server logs and similar technologies.
• Cookies and tracking technologies: We use cookies, pixel tags, and local storage to recognise your device, maintain session state, and understand how the Platform is used. See Section 06 for full details on our cookie practices.
• Payment processors: When you transact via bKash, Nagad, Rocket, Upay, or any other supported payment method, transaction confirmation data is passed to us by the relevant payment processor. We do not store full wallet credentials or card numbers on our servers.
• Identity verification partners: During KYC, we may use third-party identity verification tools that cross-reference the documents you submit against authoritative databases. The results of these checks are shared with us in a data-minimised format.
• Third-party game providers: Game providers integrated into the 35bp platform (such as Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi) may share aggregated session and outcome data with us for the purpose of account management and responsible gaming monitoring.

Purpose & Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. The following table maps our processing purposes to their respective legal bases:

Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw marketing consent, contact us at [email protected].

Sharing Your Data

35bp does not sell your personal data to any third party. We share data only in the limited circumstances described below, and only to the extent necessary for the stated purpose:

• Payment processors: We share the minimum necessary transaction data with bKash, Nagad, Rocket, Upay, Visa, Mastercard, and our banking partners (including Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank) to facilitate deposit and withdrawal processing.
• Game providers: Integrated game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a unique player session token and relevant game settings. They do not receive your full identity or financial data.
• Identity verification services: During KYC, your identity documents are processed by our verification partner's systems. Data is handled under strict confidentiality agreements and is not retained by the verification service beyond the period required to complete the check.
• Law enforcement and regulatory authorities: We will disclose personal data where we are legally required to do so in response to a valid court order, regulatory request, or law enforcement demand. We will notify you of such a disclosure where we are legally permitted to do so.
• Professional advisers: Our legal counsel, auditors, and accountants may access relevant account data where strictly necessary to provide their professional services. All such parties are bound by confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your personal data may be transferred to the successor entity. We will provide advance notice of any such transfer and confirm that the receiving party will honour this Policy.

Cookies & Tracking Technologies

35bp uses cookies and similar tracking technologies to operate the Platform effectively and to understand how players interact with our services. A cookie is a small text file stored on your device by your browser at the request of a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: These are essential to the operation of the Platform. They enable core functions such as user authentication, session management, and security. These cookies cannot be disabled without preventing the Platform from functioning.
• Functional Cookies: These remember your preferences (such as language settings and display options) to personalise your experience. They are not essential but improve usability significantly.
• Analytics Cookies: These collect aggregated, anonymised information about how visitors use the Platform — which pages are most visited, where sessions begin and end, and similar metrics. This data informs our product development decisions. No personally identifying information is captured through analytics cookies.
• Security Cookies: These help us detect and prevent fraudulent activity, unauthorised access attempts, and automated bot traffic. They are a necessary component of our security infrastructure.

35bp does not use third-party advertising cookies or cross-site tracking cookies that build profiles of your behaviour across other websites.

You may configure your browser to block or delete cookies at any time. Please note that blocking strictly necessary cookies will impair your ability to use the Platform. Instructions for managing cookies are available in your browser's help documentation.

Data Retention

35bp retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and to comply with applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with 35bp, and for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Financial transaction data: Retained for a minimum of 5 years from the date of the transaction, as required for financial compliance and audit purposes.
• Gaming activity logs: Retained for a minimum of 3 years from the date of the activity, to support dispute resolution and responsible gaming monitoring.
• Support communications: Retained for 2 years from the date of the interaction, or for as long as required if the communication relates to an open dispute or investigation.
• Technical and device data: Typically anonymised or deleted within 13 months of collection.
• Marketing consent records: Retained for as long as the consent remains active, and for 1 year following withdrawal of consent, as evidence of compliance.

At the end of the applicable retention period, personal data is either securely deleted using industry-standard data destruction methods, or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

Data Security

35bp implements a layered set of technical and organisational security measures designed to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, and destruction. Our security infrastructure includes:

• SSL/TLS encryption: All data transmitted between your device and our servers is encrypted using current SSL/TLS protocols. Our platform uses HTTPS throughout, with no unencrypted HTTP fallback for authenticated sessions.
• Encryption at rest: Sensitive personal and financial data stored in our databases is encrypted using strong symmetric encryption. Database access keys are managed using hardware security modules.
• Access controls: Access to systems that process personal data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and receive regular data protection training. Access is controlled via role-based permissions and multi-factor authentication.
• Network security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and distributed denial-of-service (DDoS) mitigation. Regular vulnerability assessments and penetration tests are conducted by independent security specialists.
• Incident response: We maintain a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights or freedoms, we will notify you without undue delay and take all necessary remediation steps.

While we take every reasonable step to protect your data, no internet transmission or electronic storage system is completely immune to risk. You are also responsible for maintaining the security of your own account credentials. Never share your 35bp password or OTP with anyone, including 35bp support staff, who will never ask for these details.

Your Rights

As a user of the 35bp platform, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and we will respond within 30 days:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is processed. We will provide this in a clear, structured format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. We will action verified correction requests promptly.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request that we delete your personal data. This right is subject to exceptions — for example, we are legally required to retain financial and identity records for a minimum period regardless of an erasure request.
• Right to Restriction of Processing: You may ask us to pause processing of your data while a correction or objection request is being resolved.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to us in a machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to Object: You may object to processing based on legitimate interests, including any profiling carried out on that basis. You may also object to marketing communications at any time, with immediate effect.
• Rights Related to Automated Decision-Making: Where any decision significantly affecting you is made solely by automated means (without human review), you have the right to request human review of that decision and to contest its outcome.

Minors & Age Verification

The 35bp platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store personal data belonging to persons under the age of 21.

Age verification is a mandatory step in our registration process. Where we have reasonable grounds to suspect that an account holder may be under 21, we will suspend account activity and request documentary proof of age. If the account holder is confirmed to be under 21, the account will be closed immediately, all gaming activity will be voided, and any deposited funds will be returned to the originating payment method after verification of legitimate origin.

If you are a parent or guardian and you believe your child has created a 35bp account, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

We also strongly recommend that parents and guardians use parental control software to prevent minors from accessing online gambling platforms. Tools such as device-level content filtering and browser-level parental controls provide an additional layer of protection.

International Data Transfers

35bp primarily operates within Bangladesh and processes the majority of personal data on infrastructure located in or serving the Bangladesh region. However, some of our third-party service providers — including game studios, identity verification partners, and technology infrastructure providers — may process data in other jurisdictions.

Where personal data is transferred outside Bangladesh, we take steps to ensure that an appropriate level of protection is maintained, including:

• Using contractual clauses that impose equivalent data protection obligations on the receiving party.
• Selecting service providers that operate under recognised international data protection frameworks.
• Conducting due diligence on the data protection practices of all third-party processors before engagement.

By using the 35bp platform, you acknowledge that your data may be processed by service providers operating in jurisdictions other than Bangladesh, subject to the safeguards described above. If you have concerns about a specific transfer, please contact us at [email protected].

Changes to This Policy

35bp reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of our services. Material changes — that is, changes that significantly affect how we use your personal data or your rights — will be communicated to you via a prominent notice on the Platform and, where reasonably practicable, via a notification to your registered mobile number.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically. Continued use of the Platform after a revised Policy has been posted constitutes your acceptance of the updated terms.

If you disagree with any revised version of this Policy, you may close your account in accordance with the process described in our Terms & Conditions. We will honour any data rights requests made in connection with account closure.

Contact & Complaints

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a complaint about how 35bp handles your personal data, please contact us using the details below:

• Data Protection Contact: [email protected]
• Subject line for data requests: "Data Rights Request — [Your Registered Mobile Number]"
• Response time: We aim to acknowledge all data-related enquiries within 48 hours Bangladesh Standard Time (BST, UTC+6), and to resolve substantive requests within 30 calendar days.

Please note: our support team will never ask for your 35bp account password or OTP via email. Do not include sensitive authentication details in any email correspondence with us.

If you are not satisfied with the way 35bp has handled your personal data or responded to a data rights request, you have the right to escalate your complaint to the relevant data protection authority or competent court in accordance with applicable law.