Your Privacy Matters at 33kd

When you register for an account, use the 33kd platform, or contact our support team, we collect various categories of personal information. The information we collect falls into the following categories:

Identity and Contact Information

• Full legal name as it appears on your government-issued identification document.
• Date of birth, used to verify that you meet the 18+ age requirement.
• Residential address, including city, district, and postal code within Bangladesh or your country of residence.
• Email address used for account communications, security alerts, and support correspondence.
• Mobile phone number, used for account verification, two-factor authentication, and support contact.

Financial Information

• Mobile wallet account numbers (bKash, Nagad, Rocket, Upay) linked to your 33kd account for deposit and withdrawal processing.
• Bank account details where bank transfer payments are used (Dutch-Bangla Bank, City Bank, BRAC Bank, and others).
• Transaction history, including deposit amounts, withdrawal requests, dates, and payment references.

Technical and Usage Data

• IP address and approximate geolocation at the time of login and account activity.
• Device type, operating system, browser version, and screen resolution.
• Pages viewed, features accessed, session duration, and navigation patterns within the platform.
• Game history, bet amounts, wagering activity, and bonus usage records.
• Login timestamps and session activity logs.

Verification Documents

Where required for identity verification or age confirmation, we may collect scanned copies or photographs of government-issued identity documents such as your National Identity Card (NID), passport, or driver's licence. These documents are processed exclusively for compliance purposes and stored securely with access restricted to authorised personnel only.

33kd processes your personal information only for purposes that have a clear, legitimate basis. The following table summarises how we use the data we collect, alongside the legal basis under which each processing activity takes place:

We do not use automated decision-making processes that produce legally significant effects on your account without human oversight. Where algorithmic tools are used to flag accounts for responsible gaming or fraud review, a trained member of our compliance team reviews any resulting action before it is applied to your account.

Marketing communications are only sent to players who have opted in to receive them. You may withdraw consent for marketing communications at any time by updating your notification preferences within your account settings or by contacting support at [email protected].

33kd does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share data only with carefully selected partners and only to the extent necessary to deliver the services described in this policy. The categories of third parties with whom we may share your data are as follows:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other payment partners receive the minimum financial data required to process your transactions. These partners operate under their own privacy policies and are bound by data-processing agreements with 33kd.
• Game Providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised or pseudonymised session data to facilitate fair-play certification, game performance monitoring, and jackpot management. We do not share identifiable personal data with game providers beyond what is technically required for session initialisation.
• Identity Verification Services: Where third-party KYC (Know Your Customer) verification services are used to confirm your identity or age, the minimum required data — typically a name, date of birth, and document image — is transmitted to the verification provider under a strict data-processing agreement.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, financial regulators, or other competent authorities where we are legally required to do so, or where disclosure is necessary to prevent, detect, or investigate fraud, money laundering, or other criminal activity.
• Internal Group Companies: Data may be shared within the 33kd group of companies for internal administrative purposes, compliance monitoring, and centralised support functions. All intra-group data transfers are governed by binding data protection agreements.

All third-party data processors engaged by 33kd are contractually obligated to process personal data only on our documented instructions, to maintain appropriate technical and organisational security measures, and to delete or return data upon termination of the service relationship. We do not permit any of our processors to use your data for their own independent purposes.

33kd uses cookies and similar tracking technologies to operate the platform, maintain your login session, personalise your experience, and gather performance analytics. A cookie is a small text file stored on your device by your browser when you visit a website. We use the following categories of cookies:

33kd does not use third-party advertising or retargeting cookies. We do not serve behavioural advertising based on your off-platform browsing activity. Any analytics data collected through performance cookies is aggregated and anonymised before being used for decision-making.

You can manage or delete cookies at any time through your browser's privacy settings. Please note that disabling essential cookies will impair platform functionality and may prevent you from logging into your account or placing bets.

33kd employs a multi-layered security architecture designed to protect your personal and financial data against unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or app and our servers is encrypted using TLS 1.3, the current industry standard for secure data transmission. Our SSL certificate is maintained and renewed continuously.
• AES-256 Encryption at Rest: Sensitive personal data — including identity documents, payment details, and account credentials — is encrypted at rest using AES-256 encryption, ensuring that data stored on our servers cannot be read even in the unlikely event of a physical infrastructure breach.
• Two-Factor Authentication (2FA): Registered players are encouraged to enable two-factor authentication on their 33kd account. 2FA adds an additional layer of security by requiring a one-time passcode — delivered to your registered mobile number — in addition to your password at login.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. Staff with access to personal data undergo regular data protection training and are bound by confidentiality obligations. Access logs are maintained and reviewed regularly.
• Vulnerability Testing: Our platform undergoes regular penetration testing and security audits conducted by independent security professionals. Critical vulnerabilities are remediated as a priority.
• Incident Response: In the event of a data security incident that affects your personal data, 33kd will notify affected players and relevant authorities within the timeframes required under applicable data protection obligations. Notifications will include the nature of the breach, data categories affected, and steps taken to mitigate harm.

While we take every reasonable precaution to secure your data, no internet-based service can guarantee absolute security. You play an important role in keeping your account secure — use a strong, unique password, enable 2FA, and never share your login credentials with anyone. Contact [email protected] immediately if you believe your account has been compromised.

33kd retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The following retention periods apply as a general guide:

When a retention period expires or when data is no longer necessary, we securely delete or anonymise the data in question. Secure deletion involves overwriting data to prevent recovery. Anonymisation involves irreversibly removing all identifying information so that the remaining data cannot be linked back to any individual.

In certain circumstances — such as where data is subject to a legal hold, ongoing dispute, or active regulatory investigation — data may be retained beyond the standard periods set out above until the matter is resolved.

As a registered player on 33kd, you have the following rights with respect to your personal data. You may exercise any of these rights at any time by contacting our data protection team at [email protected] with the subject line "Privacy Rights Request":

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is used and with whom it has been shared. We will provide this information free of charge within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic contact information directly within your account settings panel.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. This right is subject to exceptions — for example, where we are required to retain data to comply with legal obligations or for the exercise of legal claims. We will explain clearly if any such exception applies.
• Right to Restriction of Processing: You may request that we temporarily suspend processing of your data while an accuracy dispute is resolved, or where processing is unlawful and you prefer restriction over erasure.
• Right to Data Portability: Where we process your data on the basis of your consent or a contract, you have the right to receive a copy of your data in a structured, commonly used, machine-readable format, and to request that it be transmitted directly to another service provider where technically feasible.
• Right to Object: You have the right to object to processing carried out on the basis of our legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where we process your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 33kd handles your personal data, please contact our data protection team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

Data Protection Contact:
Email: [email protected] (subject line: "Privacy Rights Request")
Response time: Within 72 hours for acknowledgement; within 30 calendar days for full response.

If you are not satisfied with our response to your privacy concern, you have the right to escalate the matter through our internal appeals process. Details of the appeals process will be provided to you at the point of our initial response if the matter remains unresolved. For cross-border data protection concerns, you may also seek guidance from the data protection authority relevant to your jurisdiction.

33kd takes all privacy complaints seriously. We investigate every formal complaint thoroughly and aim to reach a fair resolution in the shortest possible timeframe. We do not charge any fees for handling privacy requests or complaints, and we will never penalise you in any way for exercising your data protection rights.

This Privacy Policy was last updated on 1 January 2026. We reserve the right to amend this policy at any time. Material changes will be communicated to registered players via their registered email address with a minimum of 14 days' notice before the changes take effect. The current version of this policy is always available at https://33kd.app/privacy-policy.