bm33 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

Introduction

bm33 ("the Company", "we", "us", "our") operates the online betting and casino platform accessible at bm33.io ("the Platform"). As part of providing this service, we collect and process personal data relating to registered players, prospective players, and visitors to the Platform. We understand that your personal information is sensitive and important to you, and we are fully committed to handling it responsibly, transparently, and securely.

This Privacy Policy ("Policy") sets out in detail the categories of personal data we collect, the purposes for which that data is used, the legal basis on which we rely for processing, the circumstances under which data may be shared with third parties, the security measures we employ to protect your information, how long we retain your data, and the rights available to you in relation to your personal data.

This Policy forms part of the overall agreement between you and bm33, alongside the Terms & Conditions and the Responsible Gaming Policy. In the event of any conflict between this Policy and any other bm33 document, this Policy governs data protection matters exclusively.

We may update this Policy from time to time to reflect changes in our data practices, technological developments, or applicable legal requirements. The version number and effective date displayed at the top of this document and in the sidebar will reflect the most current published version. Material changes will be communicated to registered players via the contact details held on their account.

Data We Collect

bm33 collects only the personal data that is necessary and proportionate to the legitimate purposes described in this Policy. The categories of personal data we may collect and hold about you are set out in the table below.

We do not collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where the processing of such data is strictly required to meet a legal obligation (for example, identifying a player who has self-excluded on health grounds). Where such data is collected, we will obtain your explicit consent in advance.

How We Collect Data

bm33 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide directly when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting our support team, or updating your account profile.
• Automated technical collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser information, and session activity logs. This data is collected via server logs, cookies, and similar tracking technologies described in Section 7.
• Payment processors: Transactional data received from mobile financial service providers (bKash, Nagad, Rocket, Upay) when you initiate a deposit or withdrawal on the Platform. bm33 does not have direct access to your full mobile banking credentials — only the transaction confirmation details necessary to credit or debit your bm33 account balance.
• Third-party game providers: Gameplay data, including session records, bet amounts, game outcomes, and RTP statistics, received from licensed game providers (Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Ezugi, Spribe) whose games are integrated into the bm33 Platform.
• Identity verification services: Where bm33 uses a third-party KYC or identity verification provider to assist in verifying the authenticity of documents you submit, that provider may share the results of the verification check with bm33.
• Publicly available sources: In limited circumstances, bm33 may supplement the information held in your account with data obtained from publicly available sources — for example, to verify an address or confirm the authenticity of an identification document.

How We Use Your Data

bm33 uses your personal data only for the specific, legitimate purposes listed below. We do not use your data in ways that are incompatible with the purpose for which it was originally collected without first obtaining your consent.

• Account creation and management: To register your bm33 account, verify your identity, manage your profile, process login authentication, and maintain accurate account records.
• Service delivery: To facilitate sports betting, live casino games, slot games, crash games, and card games on the Platform; to process deposits and withdrawals; to calculate and credit winnings; to apply bonuses and VIP rewards.
• KYC and fraud prevention: To verify that you meet the minimum age requirement of 21 years, confirm your identity, prevent fraud, detect and investigate suspicious account activity, and comply with anti-money laundering (AML) obligations.
• Responsible gaming: To monitor gameplay patterns for signs of problem gambling behaviour, apply responsible gaming limits and self-exclusion restrictions, and fulfil our duty of care obligations to players.
• Customer support: To respond to your queries, complaints, and support requests; to maintain records of our communications with you for quality assurance and dispute resolution purposes.
• Platform improvement: To analyse aggregated, anonymised usage data to understand how players interact with the Platform, identify technical issues, and improve the user experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given explicit consent to receive such communications. You may withdraw this consent at any time by updating your notification preferences in your account settings.
• Legal and regulatory compliance: To meet our obligations under applicable law, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions.

Legal Basis for Processing

bm33 processes your personal data only where there is a lawful basis for doing so. The legal bases on which we rely are as follows:

• Contractual necessity: The majority of data processing by bm33 is necessary for the performance of the contract between you and bm33 — specifically, to operate your account, process transactions, settle bets, and provide the full range of platform services you have registered to use.
• Legal obligation: Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and the retention of financial records — are required to comply with applicable legal and regulatory obligations. bm33 is legally required to conduct these activities regardless of your personal preferences.
• Legitimate interests: bm33 relies on legitimate interests as the basis for processing data used in fraud detection, platform security, gameplay analytics, and improving the overall quality of our services. In each case, we have assessed that our legitimate interests are not overridden by your rights and interests.
• Consent: Where bm33 sends you direct marketing communications, or where we collect any special-category data, we rely on your freely given, specific, informed, and unambiguous consent. You have the right to withdraw this consent at any time without detriment to your account or the services you receive.

Data Sharing & Disclosure

bm33 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your data may be shared with third parties only in the limited circumstances described below.

• Payment service providers: We share the minimum necessary transactional data with bKash, Nagad, Rocket, and Upay to process deposits and withdrawals. Each of these providers operates under its own privacy policy and data protection obligations.
• Game providers: Gameplay session data is shared with licensed game providers (Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Ezugi, Spribe) to the extent required to operate the games integrated into our platform and to resolve disputes relating to specific game sessions.
• Identity verification and KYC providers: Where bm33 uses a third-party service to assist in verifying player identities and documents, the relevant identification data is shared with that provider solely for verification purposes. The provider is contractually prohibited from using this data for any other purpose.
• Fraud prevention and security services: We may share technical and transactional data with specialist fraud prevention and cybersecurity partners to detect and prevent fraudulent activity, account takeovers, and other security threats.
• Legal and regulatory authorities: bm33 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by a lawful order, legal process, or regulatory obligation. We will notify you of such a request where permitted by law.
• Business transfers: In the event that bm33 undergoes a merger, acquisition, or sale of all or part of its assets, player data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the privacy implications before it takes effect.

All third parties with whom bm33 shares personal data are contractually required to process that data only in accordance with bm33's instructions and to implement appropriate technical and organisational security measures to protect it.

Cookies & Tracking Technologies

bm33 uses cookies and similar tracking technologies on the Platform to ensure core functionality, improve performance, and — where you have consented — to personalise your experience and deliver relevant promotions. The categories of cookies used by bm33 are described below.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies, though doing so for strictly necessary cookies will impair the functionality of the bm33 Platform. bm33 does not currently respond to browser "Do Not Track" signals, as there is no universally accepted standard for how such signals should be interpreted.

Data Security

bm33 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Our security infrastructure includes the following protections:

• Encryption in transit: All data transmitted between your device and the bm33 Platform is encrypted using TLS 1.2 or higher. The padlock icon displayed in your browser address bar confirms that your connection to bm33.io is secure.
• Encryption at rest: Personal data stored on bm33 servers — including identity documents, financial records, and account credentials — is encrypted using AES-256 encryption. Passwords are never stored in plain text; they are hashed using a cryptographically secure one-way hashing algorithm.
• Access controls: Access to personal data within bm33's systems is strictly limited on a need-to-know basis. Only authorised personnel with a legitimate operational requirement can access specific categories of player data, and all access events are logged and audited.
• Two-factor authentication: Sensitive account actions — including password resets, withdrawal requests, and account detail changes — require OTP (one-time password) verification sent to your registered mobile number.
• Regular security assessments: bm33 conducts regular vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights or freedoms, bm33 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

Data Retention

bm33 retains personal data only for as long as it is required for the purpose for which it was collected, or for as long as applicable law requires us to keep it. The following retention periods apply as a general guide.

At the end of the applicable retention period, personal data is securely deleted from bm33's active systems or, where deletion is not technically feasible (for example, in the case of encrypted backup archives), the data is anonymised so that it can no longer be associated with any identifiable individual.

Your Rights

As a bm33 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact the bm33 support team with your account username and a description of your request. We will verify your identity before processing the request and will respond within a reasonable timeframe.

• Right of access: You have the right to request a copy of the personal data bm33 holds about you, together with information about how that data is processed. We will provide this in a structured, commonly used, machine-readable format where possible.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain data fields (such as your registered mobile number or email address), you can update these directly in your account settings.
• Right to erasure: You may request that bm33 delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other legal basis for processing. Note that this right is not absolute; where bm33 is required by law to retain your data (for example, for AML compliance), we cannot delete it within the legal retention period.
• Right to restrict processing: You have the right to request that bm33 restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while a complaint is under investigation.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a portable format and to have it transmitted directly to another service provider where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests. You may also object at any time to the processing of your data for direct marketing purposes; bm33 will stop such processing immediately upon receipt of your objection.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Children & Minors

bm33 is an online betting and casino platform intended exclusively for adults. Access to the bm33 Platform is strictly restricted to individuals who are 21 years of age or older. bm33 does not knowingly collect, process, or store personal data relating to any individual under the age of 21.

During the registration process, all applicants are required to confirm that they meet the minimum age requirement of 21 years. Where bm33 has reasonable grounds to suspect that a registered account is held by or being used by a person under the age of 21, we will immediately suspend the account, conduct a mandatory age verification check, and — if the suspicion is confirmed — permanently close the account and return any funds deposited, subject to our Terms & Conditions and applicable legal requirements.

If you are a parent or guardian and you believe that a person under the age of 21 in your care has registered an account with bm33 or has accessed the Platform without your knowledge, please contact our support team immediately at [email protected]. We will investigate and act promptly. We also recommend using parental control software to restrict access to online gambling sites on devices used by young people in your household.

bm33 will never intentionally market its services to individuals under the age of 21, and our marketing materials are designed and targeted exclusively at the adult audience.

Third-Party Services

The bm33 Platform integrates services and content from third-party providers, including licensed game studios, payment processors, and analytics tools. While bm33 takes care to work only with reputable third parties and requires them to maintain appropriate data protection standards, we are not responsible for the privacy practices of those third parties once data is processed within their own systems.

Third-party game providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe — may process technical gameplay data as part of the delivery of their games on the bm33 Platform. Each of these providers operates under its own licensing conditions and data protection framework. bm33 enters into data processing agreements with all such providers to ensure that your personal data is handled appropriately.

Payment service providers — including bKash, Nagad, Rocket, and Upay — operate their own independent privacy policies governing how they handle the transaction data that passes through their systems. bm33 encourages you to review the privacy policies of these payment providers to understand how your mobile financial data is managed on their end.

The bm33 Platform may from time to time contain references or links to informational resources. bm33 is not responsible for the content or privacy practices of any external resource. Accessing any such resource is entirely at your own discretion and risk.

International Data Transfers

bm33 operates as an internationally licensed platform. As a result, the personal data you provide may be transferred to, stored in, or processed in countries outside of Bangladesh. This includes countries where bm33's servers are located and the jurisdictions in which our third-party service providers are based.

Where personal data is transferred internationally, bm33 takes steps to ensure that an adequate level of data protection is maintained. These steps may include relying on adequacy decisions, implementing standard contractual clauses approved for international data transfers, or ensuring that the recipient is bound by binding corporate rules or other legally recognised transfer mechanisms that provide equivalent protections to those applicable in the originating jurisdiction.

By registering an account with bm33 and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to international locations as described in this section, subject always to the protections described throughout this Policy.

If you wish to obtain further information about the specific safeguards in place for any particular international transfer of your personal data, please contact bm33's support team using the contact details provided in Section 15 of this Policy.

Changes to This Policy

bm33 reserves the right to update, amend, or replace this Privacy Policy at any time. Changes may be made to reflect updates to our data processing practices, changes in applicable law or regulatory guidance, new features or services introduced on the Platform, or improvements to the clarity and structure of the Policy itself.

When material changes are made to this Policy — that is, changes that significantly affect how we collect, use, or share your personal data — bm33 will notify registered players via the email address or mobile number associated with their account at least 14 days before the changes take effect. For minor or clarificatory changes, we will update the version number and effective date at the top of the Policy without sending individual notifications.

The most current version of this Privacy Policy is always accessible on the Platform. By continuing to use the bm33 Platform after the effective date of any updated version of this Policy, you confirm your acceptance of the revised terms. If you do not agree with any changes to this Policy, you should discontinue your use of the Platform and may request the closure of your account by contacting our support team.

We recommend that you review this Policy periodically to stay informed about how bm33 protects your personal data. The version number displayed in the sidebar allows you to confirm whether you are reading the most recently published version.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which bm33 handles your personal data, please do not hesitate to contact our dedicated support team. We are committed to addressing all privacy-related enquiries promptly, transparently, and in full.

You may contact bm33 regarding data protection and privacy matters using the following channel:

• Email: [email protected] — please use the subject line "Privacy Enquiry" and include your registered account username so we can locate your records and respond as efficiently as possible.

Our support team is available 24 hours a day, 7 days a week. For privacy and data rights requests specifically, you can expect an acknowledgement within 48 hours of submission and a substantive response within 30 days, in accordance with the timeframes described in Section 10 of this Policy.

bm33 takes all privacy complaints seriously. If after contacting us you feel that your concern has not been adequately addressed, you retain the right to escalate the matter to the appropriate data protection authority in your jurisdiction, or to seek independent legal advice.