bt333 Privacy Policy

This Privacy Policy ("Policy") is issued by bt333 ("bt333", "we", "us", "our") and applies to all personal data collected from registered players, prospective registrants, and website visitors who access the bt333 platform at bt333.io, including any associated mobile applications and sub-domains (collectively, "the Platform").

This Policy describes in plain English: what categories of personal data bt333 collects; the purposes and legal bases for which that data is processed; with whom it may be shared; how long it is retained; the security measures we apply to protect it; and the rights you hold as a data subject. It should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

bt333 primarily serves players located in Bangladesh. Our platform operates in English and all data-related communications — including responses to data subject requests — are conducted in English. By registering an account or continuing to use the bt333 Platform after the effective date of this Policy, you confirm that you have read and understood its contents and consent to the data practices described herein.

bt333 collects personal data in three ways: data you provide directly, data generated automatically through your use of the Platform, and data obtained from verified third-party sources as part of our identity verification and fraud prevention processes.

2.1 Data you provide directly

• Registration data: Full name, date of birth, email address, mobile phone number, residential address (city and district within Bangladesh), and a chosen username and password.
• Identity verification documents: National ID card (NID), passport, or driving licence number; a selfie photograph for biometric comparison where required by our KYC provider.
• Payment data: bKash wallet number, Nagad number, Rocket number, Upay number, Visa/Mastercard number (last four digits and expiry only — full card data is processed by PCI-DSS compliant payment processors and is never stored on bt333 servers), and Dutch-Bangla Bank account reference.
• Support communications: Messages, emails, and live chat transcripts exchanged with our support team, including any personal data you choose to include in those communications.
• Responsible gaming submissions: Self-exclusion requests, deposit limit preferences, cooling-off period requests, and any disclosures you make in the context of a responsible gaming conversation.

2.2 Data generated automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage and behavioural data: Pages visited, session duration, games played, bets placed, deposit and withdrawal history, bonus redemption history, and click-path data within the Platform.
• Geolocation data: Approximate location inferred from your IP address, used for fraud prevention and to verify that you are accessing the Platform from a permitted location.
• Cookie and tracking data: Session identifiers, authentication tokens, and platform performance metrics as described in Section 7.

2.3 Data from third-party sources

• Identity verification providers: Confirmation of identity document authenticity and sanction/PEP (Politically Exposed Person) screening results provided by our KYC partner.
• Payment processors: Transaction confirmation data and fraud risk scores provided by bKash, Nagad, Rocket, Upay, and card payment processors.
• Fraud and AML screening: Risk scoring data from anti-money-laundering screening services used to detect suspicious transaction patterns.

bt333 uses the personal data described in Section 2 for the following specific purposes. We process only the minimum data necessary for each purpose and do not repurpose data beyond what is described here without obtaining fresh consent or establishing a new legal basis.

Where we rely on your consent to send personalised promotional communications, you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Every processing activity carried out by bt333 is grounded in one of the following recognised legal bases. We document our legal basis for each processing activity in an internal data processing register that is reviewed annually.

• Contract performance: Processing that is necessary to provide you with the bt333 Service as described in the Terms & Conditions — including account creation, transaction processing, and customer support — is lawful because it is required to perform the contract between you and bt333.
• Legal obligation: Certain processing activities — particularly identity verification, age verification, anti-money-laundering monitoring, and record-keeping — are required by applicable law. We process data for these purposes regardless of consent because we have a legal duty to do so.
• Legitimate interests: bt333 processes limited categories of data on the basis of our legitimate interest in operating a safe, secure, and commercially viable platform. This includes fraud detection, platform security monitoring, and responsible gaming behavioural analysis. We conduct a balancing test before relying on this basis to confirm that our interests are not overridden by your rights.
• Consent: Where processing is not required for contract performance, legal obligation, or legitimate interests — specifically, the sending of personalised marketing and promotional communications — we rely on your freely given, informed, and specific consent. You can withdraw this consent at any time without penalty.

bt333 does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only with third parties who are contractually bound to handle that data in accordance with standards equivalent to those described in this Policy.

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Dutch-Bangla Bank receive the minimum transaction data necessary to process deposits and withdrawals in BDT. These entities operate under their own regulatory obligations and privacy frameworks.
• Identity verification providers: Our KYC partner receives identity document images and registration data solely for the purpose of verifying your identity, confirming your age, and conducting sanction/PEP screening as required by our anti-money-laundering obligations.
• Game studios and content providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified providers receive a pseudonymous player identifier (not your full name or contact details) to operate game sessions and calculate RTP outcomes. No personally identifiable information beyond a session token is shared with game studios.
• Technology infrastructure providers: Cloud hosting, server infrastructure, content delivery, and cybersecurity service providers may process technical data (IP addresses, session logs) in the course of providing infrastructure services to bt333. All such providers are bound by data processing agreements.
• Legal and regulatory authorities: bt333 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by a valid legal order, warrant, or regulatory direction. We will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bt333's business assets, player data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and your rights under this Policy will be preserved.

bt333 is a platform focused on the Bangladesh market and we aim to process and store as much data as possible within or close to the region. However, given the global nature of cloud infrastructure and the international headquarters of certain game studios and technology providers, some personal data may be processed on servers located outside Bangladesh.

Where personal data is transferred to a third country, bt333 takes the following safeguards to ensure that your data receives an equivalent level of protection:

• We enter into data processing agreements with all international service providers that include standard contractual clauses governing data protection obligations.
• We assess the data protection laws of recipient countries before engaging service providers located in those jurisdictions.
• We apply end-to-end encryption to any data transmitted internationally so that it cannot be read in transit by infrastructure providers.

If you would like more information about the specific safeguards applied to any international transfer of your personal data, you may request this by contacting [email protected].

bt333 uses cookies and similar client-side storage technologies (collectively "cookies") to operate the Platform effectively and securely. The following categories of cookies are in use on bt333.io:

bt333 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You may configure your browser to block or delete cookies at any time; however, blocking strictly necessary cookies will prevent you from logging into your account and using the Platform.

bt333 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal or regulatory obligations. The following retention schedule applies to the principal categories of data we hold:

At the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. bt333 reviews its retention schedules annually to ensure they remain proportionate and compliant with current legal requirements.

bt333 takes the security of your personal data seriously and applies a layered set of technical and organisational measures to protect data against unauthorised access, loss, destruction, or alteration. Our principal security controls include:

• Transport security: All data in transit between your device and bt333 servers is protected by TLS 1.2 / 1.3 with 256-bit AES encryption. bt333.io enforces HTTPS on all pages and uses HSTS (HTTP Strict Transport Security) headers to prevent downgrade attacks.
• Data at rest encryption: Personal data stored in our databases is encrypted at rest using AES-256. Encryption keys are managed through a dedicated key management service with access controls and rotation schedules.
• Access controls: Access to systems processing personal data is restricted to authorised bt333 personnel on a role-based, need-to-know basis. All internal access is logged and reviewed periodically by our security team.
• Two-factor authentication: All bt333 staff with access to systems processing player data are required to use multi-factor authentication. We strongly recommend (though do not currently mandate) that players also enable 2FA on their bt333 accounts.
• Penetration testing and vulnerability management: bt333 conducts regular vulnerability assessments and periodic penetration testing of its platform and infrastructure. Critical vulnerabilities are remediated according to a defined SLA.
• Incident response: bt333 maintains a documented data breach response procedure. In the event of a breach that poses a material risk to player data, we will notify affected players as soon as reasonably practicable and take immediate steps to contain and remediate the incident.

As a data subject, you hold the following rights in relation to the personal data bt333 holds about you. You may exercise any of these rights at any time by contacting [email protected] with your registered username and a description of your request. bt333 will respond within 30 days of receipt and will not charge a fee for standard requests.

Where bt333 is unable to fully comply with a data rights request — for example, because legal retention obligations prevent deletion — we will explain the reason clearly in our response and inform you of any partial steps we can take. We will never ignore or dismiss a data rights request without explanation.

bt333 is an adult platform. Registration is strictly prohibited for individuals under the age of 21. We do not knowingly collect personal data from anyone under the age of 21.

As part of our registration process, bt333 requires date-of-birth verification and reserves the right to request identity documents confirming age at any point. Where we identify or reasonably suspect that an account is held by a person under 21, we will immediately suspend the account, investigate, and — if the suspicion is confirmed — permanently close the account and return any deposited balance to the originating payment method after completing standard verification steps.

If a parent or guardian believes their child has registered on bt333 without authorisation, they should contact [email protected] immediately with relevant details. bt333 will treat such reports as a priority, investigate within 24 hours, and delete any personal data collected from the minor upon confirmed identification.

The bt333 Platform may contain references to third-party game studios, payment processors, and service providers. While bt333 takes reasonable care in selecting reputable partners, we do not control the privacy practices of third-party websites or services that operate independently of our Platform. This Privacy Policy applies solely to personal data processed by bt333 in connection with your use of bt333.io.

If you navigate away from bt333.io to a third-party website — for example, to access a payment provider's portal or a game studio's support page — you do so subject to that third party's own privacy policy and terms of use. bt333 accepts no responsibility for the data practices of third-party operators. We encourage you to review the relevant privacy policy of any third-party service before submitting personal data to it.

bt333 reserves the right to update or amend this Privacy Policy at any time. Amendments may be required to reflect changes in our data processing practices, changes in applicable law, new service features, or feedback from players and regulators.

When we make material changes to this Policy — that is, changes that meaningfully affect how we collect, use, or share your personal data — we will notify registered players by email to their registered address and by displaying a prominent notice on the bt333.io platform for a period of at least 14 days prior to the amended Policy taking effect. Minor clarifications or editorial corrections that do not affect the substance of the Policy may be made without advance notice.

The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the bt333 Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree to a material amendment, you have the right to close your account prior to the amendment taking effect by contacting [email protected].

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern about how bt333 has handled your personal data, please contact our support team using the details below. We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a substantive response within 30 days.

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the bt333.io platform — identify your enquiry as a "Privacy & Data" matter so it is routed to the correct team.
• Response language: All privacy enquiries are handled in English.
• Response time: Acknowledgement within 2 business days (BST, UTC+6); substantive response within 30 calendar days.

bt333 takes privacy complaints seriously. If you submit a complaint and are not satisfied with our response, or if you have not received a response within 30 days, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction or to seek independent legal advice.