db365 Privacy Policy

Introduction

db365 ("db365", "we", "us", "our") is committed to protecting the privacy and personal data of every player who accesses or uses the db365 online casino and sports betting platform at https://db365.bio (the "Platform"). This Privacy Policy ("Policy") sets out in full the categories of personal data that db365 collects, the purposes for which that data is processed, the legal bases relied upon for processing, how long data is retained, with whom it may be shared, and the rights available to players as data subjects.

This Policy applies to all users of the Platform, including visitors who browse without registering, registered players, and any person who communicates with db365 via email or other electronic means. By registering an account on the Platform or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

Personal Data We Collect

db365 collects personal data through a number of channels, including the account registration process, ongoing use of the Platform, payment transactions, customer support interactions, and automatic technical data collection. The table below summarises the principal categories of personal data collected and the specific data points within each category:

db365 does not collect special categories of sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric data, except where identity verification documents incidentally contain such information as part of a government-issued form of identification. In such cases, db365 processes only the data fields necessary for KYC verification purposes.

How We Use Your Personal Data

db365 processes personal data only for specified, explicit, and legitimate purposes. We will not use your data in any manner that is incompatible with the purposes for which it was originally collected, without first obtaining your informed consent. The principal purposes for which db365 uses player data are as follows:

• Account creation and management: processing your registration, verifying your identity in accordance with KYC and anti-money laundering obligations, and maintaining your account in good standing throughout your use of the Platform.
• Payment processing: facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and maintaining accurate records of all financial transactions associated with your account.
• Responsible gaming compliance: monitoring play patterns, administering deposit limits, session time reminders, and self-exclusion tools, and identifying players who may benefit from responsible gaming support.
• Customer support: responding to account queries, processing complaints, investigating disputed transactions, and providing general assistance to players in Dhaka, Chittagong, Sylhet, and across Bangladesh.
• Fraud prevention and security: detecting and preventing fraudulent account activity, money laundering, bonus abuse, and other prohibited conduct that may harm the integrity of the Platform or other players.
• Marketing and promotions: where you have provided consent, sending you personalised promotional offers, bonus notifications, tournament announcements, and platform updates relevant to your interests and activity on db365.

db365 does not use automated decision-making processes (including profiling) that produce legal effects or similarly significant effects on players, without providing the player with the ability to request human review of such a decision. If you believe an automated system has made an error that affects your account status, you may contact our support team at [email protected] to request a manual review.

Legal Basis for Processing

Every data processing activity carried out by db365 relies on one or more of the following recognised legal bases. Processing without a valid legal basis is not permitted under db365's internal data governance standards:

• Contractual necessity: processing that is necessary to perform the contract between db365 and the player, including account creation, payment processing, game delivery, and customer support. Without this processing, db365 could not provide the Platform services.
• Legal obligation: processing that is required for db365 to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) checks, KYC identity verification, age verification (21+), and cooperation with law enforcement requests.
• Legitimate interests: processing that is necessary for db365's legitimate interests in operating a safe and sustainable platform, including fraud detection, security monitoring, platform performance analysis, and responsible gaming compliance, where such interests are not overridden by the player's rights and freedoms.
• Consent: processing that is based on your freely given, specific, informed, and unambiguous consent — primarily the sending of direct marketing communications, personalised bonus offers, and the use of non-essential cookies. You may withdraw consent at any time by contacting [email protected] or updating your account communication preferences.

Sharing Your Personal Data

db365 does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own marketing purposes. db365 may share your personal data with the following categories of recipients only where sharing is necessary, proportionate, and supported by a valid legal basis:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card processors receive the minimum personal and financial data necessary to authenticate and complete each deposit or withdrawal transaction. These providers operate under their own privacy policies and security standards.
• Technology and hosting providers: db365 uses trusted cloud hosting, database management, and security monitoring partners who process data on db365's behalf under strict data processing agreements. These providers may not use player data for their own independent purposes.
• KYC and identity verification partners: db365 uses specialist identity verification service providers to assist with age verification and KYC compliance checks. These providers receive identity documents and data points only to the extent necessary to complete the verification process.
• Regulatory and law enforcement authorities: db365 may be required by law to disclose player information to competent regulatory authorities, financial intelligence units, or law enforcement agencies in connection with an investigation into financial crime, money laundering, or other unlawful activity. db365 will only make such disclosures where legally required to do so.

Payment Data and Financial Information

db365 takes the security of financial data with particular seriousness given the nature of the Platform. When you make a deposit using bKash, Nagad, Rocket, or Upay, the transaction is routed through the respective mobile financial service provider's secure payment gateway. db365 does not store your full mobile wallet PIN, one-time passwords (OTP), or any equivalent authentication credentials. db365 records only the wallet number, transaction reference, amount in Bangladeshi Taka (BDT), and timestamp sufficient to reconcile account balances and process withdrawal requests.

Where Visa or Mastercard is used, card data is handled exclusively by our PCI-DSS compliant payment processor. db365 receives only a tokenised representation of the card sufficient to associate the payment method with the player's account for future withdrawal purposes. Full card numbers, CVV codes, and expiry dates are never stored on db365 systems.

Cookies and Tracking Technologies

db365 uses cookies and similar tracking technologies to provide a functional, personalised, and secure experience on the Platform. A cookie is a small text file placed on your device by your browser when you visit a website. Cookies do not contain executable code and cannot be used to access other files on your device. db365 uses the following categories of cookies:

• Strictly necessary cookies: required for the Platform to function correctly, including session management, authentication, security tokens, and load balancing. These cookies cannot be disabled without impairing core Platform functionality.
• Performance and analytics cookies: collect anonymised or pseudonymised data about how players interact with the Platform, including which pages are visited most frequently and where players encounter errors. This data is used to improve Platform performance and user experience.
• Functional cookies: remember your preferences such as your language setting, responsible gaming limits already set, and display preferences, so you do not need to re-enter them each time you visit the Platform.
• Marketing cookies: used only where you have given explicit consent, to track your interaction with db365 promotional content and to help us serve you relevant bonus offers and game recommendations based on your play preferences.

You may manage your cookie preferences at any time by adjusting your browser settings to refuse or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to log in to and use the Platform. Marketing and analytics cookies may be declined without affecting your access to core Platform features.

Data Retention

db365 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable law or regulation. The following general retention periods apply, subject to any longer period required by law: Account and identity data is retained for the duration of the account relationship and for a period of five (5) years following account closure, to comply with anti-money laundering record-keeping obligations. Financial transaction records are retained for a minimum of five (5) years from the date of each transaction. Responsible gaming records (deposit limit settings, self-exclusion periods) are retained for the lifetime of the account and for a period of five (5) years after closure.

Where personal data is no longer required for any lawful purpose, db365 will securely destroy or anonymise it in accordance with its internal data deletion procedures. Anonymised or aggregated data that cannot reasonably be used to re-identify an individual may be retained indefinitely for statistical and platform improvement purposes.

Your Privacy Rights

As a player on the db365 Platform, you have the following rights in respect of your personal data. These rights are not absolute and may be subject to limitations where they conflict with db365's legal obligations or the rights of third parties, but db365 will always seek to accommodate your request to the fullest extent lawfully possible:

• Right of access: you may request a copy of all personal data that db365 holds about you, together with information about the purposes for which it is processed and the categories of recipients with whom it has been shared.
• Right to rectification: if you believe that any personal data db365 holds about you is inaccurate or incomplete, you may request that it be corrected or completed without undue delay.
• Right to erasure: in certain circumstances (for example, where data is no longer necessary for the purpose for which it was collected, or where you withdraw consent), you may request that db365 delete your personal data. This right does not apply where db365 is required to retain data for legal compliance purposes.
• Right to restriction: you may request that db365 restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is contested or while an objection to processing is being considered.
• Right to data portability: where processing is carried out by automated means and is based on consent or contractual necessity, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: you may object to the processing of your personal data where db365 relies on legitimate interests as the legal basis, including profiling carried out on that basis. You also have an unconditional right to object to direct marketing processing at any time.

To exercise any of the above rights, please contact the db365 privacy team at [email protected], clearly stating the right you wish to exercise and providing sufficient information to verify your identity. db365 will respond to all valid requests within 30 days of receipt. Where a request is complex or numerous, this period may be extended by a further two months, and you will be notified of any such extension within the initial 30-day period.

Security Measures

db365 has implemented a comprehensive set of technical and organisational security measures designed to protect player data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include 256-bit SSL/TLS encryption for all data transmitted between players' devices and the db365 Platform; encrypted storage of sensitive data fields at rest; multi-factor authentication options for player accounts; regular penetration testing and vulnerability assessments conducted by independent security specialists; and strict internal access controls limiting employee access to personal data on a need-to-know basis.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. db365 cannot guarantee the absolute security of data transmitted over the internet. In the event of a data security incident that is likely to result in a high risk to player rights and freedoms, db365 will notify affected players without undue delay and will take all reasonable steps to mitigate the impact of the incident.

Children's Privacy and Age Restriction

The db365 Platform is strictly intended for use by adults aged 21 years and above. db365 does not knowingly collect personal data from persons under the age of 21. If db365 becomes aware that it has inadvertently collected personal data from an individual under the age of 21, it will immediately delete that data and close the associated account without notice. Any winnings or balances associated with an underage account will be forfeited in accordance with db365's Terms and Conditions.

If you are a parent or guardian and you believe that a person under the age of 21 in your care has registered an account or provided personal data to db365 without your knowledge or consent, please contact us immediately at [email protected]. db365 will investigate and take appropriate action, including the deletion of the minor's data, within 48 hours of receiving such a report.

Changes to This Privacy Policy

db365 may update or amend this Privacy Policy from time to time to reflect changes in applicable law, changes in db365's data processing practices, or the introduction of new Platform features that involve the collection or use of personal data. The date of the most recent revision is displayed at the top of this Policy. When material changes are made, db365 will notify registered players by posting a prominent notice on the Platform and, where practicable, by sending a notification to the email address associated with each player's account.

Your continued use of the Platform after the effective date of any revision to this Policy constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Policy, you must stop using the Platform and may request account closure by contacting [email protected]. db365 recommends that players review this Policy periodically so that they remain informed about how their personal data is being used and protected.

Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or db365's data processing practices, or if you wish to exercise any of your privacy rights as described in Section 9 above, please contact the db365 privacy team using the details below. db365 aims to respond to all privacy-related enquiries within 5 business days and to resolve all data subject rights requests within 30 days of receipt.