bdwim Privacy Policy — How We Handle Your Personal Data

Introduction and Scope

This Privacy Policy (the "Policy") sets out the basis on which bdwim (the "Platform", "Operator", "we", "us", or "our") collects, processes, stores, and discloses personal data obtained from users of the bdwim website at https://bdwim.io and all associated products and services, including cricket betting, live casino games, slot games, Star Fishing, Callbreak, and all payment and account management services.

This Policy applies to all individuals who interact with the bdwim platform in any capacity — including registered account holders, visitors who browse the website without registering, and any individual who contacts bdwim via email or other communication channels. It applies regardless of the device or browser used to access the platform .

This Policy should be read alongside the bdwim Terms & Conditions and the Responsible Gaming policy, both of which form part of the overall legal framework governing your relationship with bdwim. In the event of any conflict between this Policy and those documents on matters of data privacy, this Policy shall take precedence.

bdwim is committed to handling all personal data in a manner consistent with recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. We review and update our data practices on a regular basis to reflect evolving standards and legal requirements.

Data Controller Information

For the purposes of this Privacy Policy, bdwim acts as the data controller in respect of personal data collected through the bdwim platform. As data controller, bdwim determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

All enquiries, data access requests, correction requests, deletion requests, and privacy-related complaints should be directed to bdwim's designated data protection contact using the details set out in Section 14 of this Policy. We aim to respond to all privacy-related communications within five business days of receipt.

Where bdwim engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification services, or game content providers), those parties act as data processors under contractual arrangements that require them to handle personal data solely in accordance with bdwim's documented instructions and to maintain appropriate security standards.

Data We Collect

bdwim collects personal data through several channels: directly from you during registration and subsequent account activity, automatically through your use of the platform, and in limited cases from third-party identity verification and payment processing partners. The categories of data we collect are described below.

3.1 Registration and Account Data

When you create a bdwim account, we collect the following information:

• Full legal name as it appears on your official identity document.
• Date of birth (used solely for age verification — you must be 21 or older).
• Residential address in Bangladesh (city, district, full postal address).
• Email address and/or mobile phone number used as your primary contact method.
• Username and encrypted password (passwords are never stored in plain text).
• Preferred language and currency (BDT).

3.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) process, we may request and retain copies of:

• National Identity Card (NID) — front and back.
• Passport biographic data page.
• Proof of address documents (utility bills, bank statements, or government-issued correspondence).
• Selfie photographs taken during identity verification, where required.
• Payment account confirmation screenshots (e.g., bKash, Nagad, Rocket, or Upay account details confirming ownership).

3.3 Financial Transaction Data

We record details of all financial transactions conducted through your bdwim account, including:

• Deposit and withdrawal amounts in BDT.
• Payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard) and associated account identifiers.
• Transaction timestamps and reference numbers.
• Bonus credits applied and wagering activity linked to promotional offers.

3.4 Gaming and Betting Activity Data

We maintain a detailed record of your activity on the bdwim platform, which includes:

• Games played, bet amounts, bet outcomes, and session durations.
• Sports betting markets accessed, selections made, and odds accepted.
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status).

3.5 Technical and Device Data

When you access bdwim, our systems automatically collect certain technical information:

• IP address and approximate geographic location derived from IP.
• Device type, operating system, and browser version.
• Pages visited, time spent on each page, and navigation paths through the platform.
• Referral source (i.e., how you arrived at bdwim.io).
• Cookie identifiers and session tokens (see Section 7 for full details).

3.6 Communications Data

When you contact bdwim's support team by email or through the platform's messaging interface, we retain records of those communications — including your name, contact details, the content of your message, and our response — for quality assurance, dispute resolution, and regulatory audit purposes.

How We Use Your Data

bdwim uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with the reasons for which it was originally collected without first obtaining your explicit consent.

• Account Management: Creating and maintaining your bdwim account, verifying your identity, and enabling you to log in securely to the platform.
• Age Verification: Confirming that you meet the minimum age requirement of 21 years before you are permitted to access real-money gaming features.
• Payment Processing: Facilitating deposits and withdrawals through your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, or Mastercard) and maintaining accurate transaction records in BDT.
• Game Delivery: Enabling access to cricket betting, live casino tables, slot games, Star Fishing, Callbreak, and all other bdwim products.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, bonus abuse, collusion, and other prohibited activities as defined in the bdwim Terms & Conditions.
• Anti-Money Laundering (AML) Compliance: Monitoring transaction patterns and account behaviour to identify activity consistent with money laundering or other financial crimes, as required by applicable legal obligations.
• Responsible Gaming: Monitoring gaming behaviour to identify signs of problem gambling, administering deposit limits, session reminders, cooling-off periods, and self-exclusion requests at your direction or where intervention is warranted.
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining a record of support interactions for quality assurance and audit purposes.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates via email or SMS — but only where you have provided your consent to receive such communications (see Section 11).
• Platform Improvement: Analysing aggregated and anonymised usage data to understand how players navigate bdwim, identify areas for improvement, and optimise the overall user experience.
• Legal Compliance: Meeting our obligations under applicable laws, responding to lawful requests from regulatory or law enforcement authorities, and defending bdwim's legal rights in the event of disputes.

Legal Basis for Processing

bdwim processes your personal data on the basis of one or more of the following legal grounds, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform our obligations under the bdwim Terms & Conditions, including account creation, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including age verification requirements, anti-money laundering regulations, and record-keeping obligations imposed by financial regulators.
• Legitimate Interests: Processing carried out to pursue bdwim's legitimate business interests — such as fraud detection, platform security, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your explicit, freely given, and informed consent — primarily in the context of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where bdwim relies on legitimate interests as the legal basis for any processing activity, we have conducted and documented a legitimate interests assessment to confirm that the processing is necessary, proportionate, and balanced against your privacy rights.

Data Sharing and Disclosure

bdwim does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes under any circumstances. Personal data is shared with third parties only in the limited circumstances described below.

• Payment Processors: Your payment account identifiers and transaction amounts are shared with bKash, Nagad, Rocket, Upay, Visa, and Mastercard solely to the extent necessary to process your deposit and withdrawal requests.
• Identity Verification Partners: In some cases, KYC documents may be processed by a specialist third-party identity verification service acting under a data processing agreement with bdwim. These providers are contractually prohibited from using your data for any purpose other than verifying your identity for bdwim.
• Game Content Providers: Technical session data (such as player session tokens and bet amounts) is passed to game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe solely to facilitate gameplay. These providers do not receive your full personal profile.
• IT and Hosting Infrastructure: bdwim uses secure cloud infrastructure and database hosting services. Personnel operating these services may have incidental access to personal data stored on those systems, subject to strict confidentiality obligations.
• Legal and Regulatory Authorities: bdwim may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, by court order, or where disclosure is necessary to protect the safety of our users or the general public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of bdwim's business, personal data held by bdwim may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

All third-party processors engaged by bdwim are subject to written data processing agreements that require them to implement appropriate technical and organisational security measures and to process personal data only in accordance with bdwim's documented instructions.

Cookies and Tracking Technologies

The bdwim website uses cookies and similar tracking technologies to enable core platform functionality, improve the user experience, and support fraud detection and security monitoring. A cookie is a small text file placed on your device by your browser when you visit a website.

bdwim uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the bdwim platform. These cookies manage your login session, maintain your account authentication state, and enable the secure processing of transactions. They cannot be disabled without impairing core platform functionality.
• Functional Cookies: Remember your preferences — such as your chosen language, display settings, and responsible gaming tool configurations — so that they persist across sessions without requiring re-entry each visit.
• Analytics Cookies: Collect anonymised data about how players navigate the bdwim website — including pages visited, time spent on each page, and features used — to help bdwim understand usage patterns and prioritise platform improvements.
• Security Cookies: Support bdwim's fraud detection systems by maintaining anonymised device fingerprinting data that helps identify unusual login patterns or access from unrecognised devices.

bdwim does not use third-party advertising cookies or behavioural tracking cookies that profile you for the purposes of targeted advertising on external websites. Most browsers allow you to manage or delete cookies through their settings. Note that disabling strictly necessary cookies may prevent you from logging in to your bdwim account or using certain features of the platform.

Data Security

bdwim implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• Encryption in Transit: All data transmitted between your browser and the bdwim platform is encrypted using TLS 1.2 or higher (256-bit SSL), ensuring that it cannot be intercepted in transit.
• Encryption at Rest: Sensitive personal data stored in bdwim's databases — including identity documents and payment account identifiers — is encrypted using AES-256 encryption.
• Password Security: Account passwords are never stored in plain text. They are processed using a one-way cryptographic hashing algorithm with salting to prevent compromise even in the unlikely event of a database breach.
• Access Controls: Access to systems containing personal data is restricted to authorised bdwim personnel whose roles require it. All access is authenticated and logged for audit purposes. Administrative access requires multi-factor authentication.
• Intrusion Detection: bdwim's systems are monitored around the clock for suspicious activity, unauthorised access attempts, and anomalous transaction patterns using automated security tooling and manual review processes.
• Vulnerability Management: bdwim conducts regular security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

While bdwim takes all reasonable precautions to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your bdwim login credentials. If you believe your account has been accessed without your authorisation, contact [email protected] immediately and change your password.

Data Retention

bdwim retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal and regulatory obligations. The specific retention periods applicable to each category of data are summarised in the table in Section 3 of this Policy.

When you close your bdwim account, we are required to retain certain categories of data — particularly financial transaction records and KYC documentation — for a defined period after account closure to satisfy legal obligations relating to anti-money laundering compliance, financial record-keeping, and potential dispute resolution. This retention obligation exists regardless of the reason for account closure.

Personal data that is no longer required for any legitimate purpose and that is not subject to a legal retention obligation is securely deleted from bdwim's active systems and backups within a reasonable period following the expiry of the applicable retention period. Where full deletion is not immediately practicable, the data is anonymised so that it can no longer be attributed to any identifiable individual.

Your Rights as a Data Subject

As a bdwim account holder and data subject, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us at the details provided in Section 14. We will respond to all valid requests within a reasonable timeframe and in no case later than 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data bdwim holds about you, together with an explanation of the purposes for which it is processed and the categories of third parties with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request that bdwim delete the personal data we hold about you where it is no longer necessary for the purpose for which it was collected, where you withdraw consent on which processing is based, or where the data has been unlawfully processed. Note that this right is subject to legal retention obligations that may require bdwim to retain certain data notwithstanding your deletion request.
• Right to Restriction of Processing: You may request that bdwim restrict the processing of your personal data in certain circumstances — for example, while a correction request is being investigated.
• Right to Data Portability: Where processing is based on your consent or on a contractual obligation, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where bdwim relies on legitimate interests as its legal basis. If you object, bdwim will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that took place prior to withdrawal.

bdwim will not charge a fee for handling data subject requests in ordinary circumstances. However, where requests are manifestly unfounded, excessive, or repetitive, bdwim reserves the right to charge a reasonable administrative fee or to decline to respond, with written justification provided to you.

Marketing Communications

bdwim may send you promotional emails, SMS messages, and in-platform notifications about bonuses, new games, seasonal offers, and platform updates. We will only send you direct marketing communications where you have explicitly opted in to receive them — either during the account registration process or through a subsequent preference update in your account settings.

You may withdraw your consent to receive marketing communications from bdwim at any time by:

• Clicking the unsubscribe link included at the bottom of every promotional email we send.
• Updating your communication preferences in your bdwim account settings.
• Sending a written opt-out request to [email protected] with the subject line "Marketing Opt-Out".

Please allow up to five business days for opt-out requests to take effect across all communication channels. Opting out of marketing communications will not affect your ability to receive essential transactional communications relating to your account — such as deposit confirmations, withdrawal notifications, KYC requests, and account security alerts. These operational communications are sent on the basis of contractual necessity and cannot be opted out of while your account remains active.

Children and Minors

bdwim takes the protection of minors extremely seriously. As part of our registration process, we require all new account holders to confirm that they are 21 years of age or older, and we enforce this requirement through mandatory age verification using official identity documents during the KYC process.

If bdwim discovers that personal data has been collected from an individual who was under the age of 21 at the time of collection, we will immediately close the associated account, delete the personal data in question (subject to any applicable legal retention obligations), and take appropriate follow-up action in accordance with our safeguarding obligations.

If you are a parent or guardian and believe that your child may have created a bdwim account or submitted personal data to the platform, please contact us immediately at [email protected] so that we can investigate and take prompt corrective action.

Changes to This Privacy Policy

bdwim reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. When material changes are made to this Policy, we will notify registered account holders by email and/or by displaying a prominent notice on the bdwim platform no less than seven (7) days before the changes take effect.

The "Last Updated" date displayed at the top of this page indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed about how bdwim protects your personal data. The most current version of this Policy is always available at https://bdwim.io/privacy-policy.

Your continued use of the bdwim platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with the changes, you must stop using the bdwim platform and may request account closure in accordance with the bdwim Terms & Conditions.

Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which bdwim handles your personal data, please contact our data protection team using the details below. All enquiries must be submitted in writing. We aim to acknowledge all privacy-related communications within two business days and to provide a substantive response within five business days.

• Email: [email protected]
• Subject Line for Data Requests: "Data Privacy Request — [Your Full Name]"
• Subject Line for Complaints: "Privacy Complaint — [Your Full Name]"
• Response Language: English
• Support Hours: 24 hours a day, 7 days a week

When submitting a data access or erasure request, please include your registered bdwim username, the email address associated with your account, and a clear description of the personal data or processing activity to which your request relates. bdwim may need to verify your identity before processing your request to ensure that personal data is not disclosed to an unauthorised party.

If you are not satisfied with bdwim's response to a privacy complaint after providing us a reasonable opportunity to address your concern, you may have the right to escalate your complaint to the appropriate data protection authority or consumer protection body in your jurisdiction.

For further information about your rights under bdwim's broader legal framework, please review our Terms & Conditions and our Responsible Gaming policy.