Privacy Policy — 678bd5

For the purposes of this Privacy Policy, the data controller responsible for your personal information is 678bd5, operating the online casino and sports betting platform accessible at 678bd5.net (the "Platform"). As data controller, 678bd5 determines the purposes and means of processing personal data collected through the Platform.

678bd5 operates as an offshore-licensed gambling platform. While our primary audience is players based in Bangladesh — including major cities such as Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar — we collect and process personal data in accordance with internationally recognised data protection principles.

If you have any questions, concerns, or requests regarding the processing of your personal data, you can contact our dedicated privacy support team using the contact details provided in the Contact Us About Privacy section of this policy. We aim to acknowledge all privacy-related enquiries within 2 business days.

678bd5 uses the personal data collected from you for the following purposes. We process your data only where we have a valid legal basis to do so, as described in the Legal Basis section below.

Account Creation and Management

We use your identity and contact data to create and maintain your 678bd5 account, verify your eligibility to use the Platform, communicate important account updates, and enforce our one-account-per-player policy. This processing is necessary to deliver the service you have signed up for.

Payment Processing

Financial data is used to process deposits and withdrawals via supported Bangladeshi payment methods including bKash, Nagad, Rocket, Upay, and partner banks. We verify that payment accounts are registered in your own name to prevent third-party payment fraud and to comply with anti-money laundering (AML) obligations.

Identity Verification (KYC)

Verification document data is used to confirm your identity and age as part of our Know Your Customer process. KYC is mandatory before a Player may withdraw funds, and may be requested at any point during the account lifecycle where unusual activity is detected or where deposit thresholds are reached.

Platform Security and Fraud Prevention

Technical and usage data — including IP addresses, device fingerprints, and session behaviour — is used to identify and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorised access to player accounts. This processing is carried out in the legitimate interests of 678bd5 and its player community.

Responsible Gaming Monitoring

Usage and account data is analysed to identify patterns that may indicate problem gambling behaviour, such as rapid loss chasing, extended unbroken sessions, or significant deposit escalations. Where such patterns are identified, 678bd5 may proactively contact the player with responsible gaming information or apply protective account restrictions in accordance with our Responsible Gaming policy.

Marketing Communications

Where you have opted in to receive promotional communications, we may use your contact data (email and/or mobile number) to send you information about bonuses, seasonal promotions (such as Eid offers, IPL and BPL betting promotions, and Pohela Boishakh specials), new game releases, and platform updates. You may withdraw your consent to marketing communications at any time by contacting [email protected] or using the unsubscribe link in any marketing email.

Legal and Regulatory Compliance

678bd5 retains certain categories of personal data — including transaction records, KYC documents, and communications logs — to meet our obligations under applicable anti-money laundering regulations, offshore licensing conditions, and financial record-keeping requirements. This processing is necessary for compliance with legal obligations to which 678bd5 is subject.

678bd5 does not sell or rent your personal data to any third party. We share personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

Payment Service Providers

To process deposits and withdrawals, we share relevant financial and identity data with our payment partners, including mobile financial services providers (bKash, Nagad, Rocket, Upay) and card networks (Visa, Mastercard). These providers act as data processors under contractual agreements that bind them to handle your data securely and only for the specified payment purpose.

Identity Verification Partners

To fulfil our KYC obligations, we may share identity documents and personal data with third-party identity verification services. These services verify the authenticity of documents and cross-reference submitted data against available databases. Identity verification partners are contractually prohibited from using your data for any purpose other than completing the verification request submitted by 678bd5.

Game Providers

When you play games on the 678bd5 platform, certain technical and account data (such as your account ID, session token, and stake amounts) is shared with the relevant game provider — for example Pragmatic Play, Evolution Gaming, Jili, Spribe, or Ezugi — to enable game delivery, round verification, and dispute resolution. Game providers receive only the minimum data necessary for these purposes.

Regulatory and Law Enforcement Authorities

678bd5 may be required by law, court order, or regulatory authority to disclose personal data. We will comply with such requirements and will notify affected players where permitted to do so. In cases involving suspected money laundering, fraud, or underage gambling, 678bd5 will cooperate fully with relevant authorities without prior notice to the player involved.

Business Transfers

In the event that 678bd5 undergoes a merger, acquisition, or sale of all or substantially all of its assets, personal data held about players may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to this Privacy Policy that result from it.

678bd5 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of personal data we hold:

Active Account Data

Personal data associated with an active 678bd5 account — including identity data, contact data, and account preferences — is retained for the duration of the account's active status. This data is necessary to provide the gambling service and manage the ongoing player relationship.

Financial and Transaction Records

All deposit, withdrawal, and wagering transaction records are retained for a minimum of 5 years from the date of the transaction. This retention period reflects standard anti-money laundering record-keeping requirements applicable to offshore gambling operators and financial service providers operating in or serving the Bangladesh market.

KYC and Verification Documents

Identity verification documents — including copies of NID, passport, driving licence, and proof-of-address documents — are retained for a minimum of 5 years from the date of submission or, where applicable, from the date of account closure. Verification documents may be retained for longer if an ongoing investigation or legal proceeding requires it.

Communications and Support Records

Customer support correspondence, live chat transcripts, complaint records, and dispute resolution documentation are retained for 3 years from the date of the communication. These records may be needed to defend against or pursue legal claims, and to demonstrate the quality and fairness of our dispute resolution process.

Responsible Gaming Records

Records relating to self-exclusion requests, deposit limit settings, cooling-off periods, and responsible gaming interventions are retained for 5 years to ensure that exclusion conditions can be enforced even if a player attempts to re-register, and to support any audit or regulatory review of our responsible gaming practices.

Account Closure and Post-Closure Retention

When an account is closed — whether by the player or by 678bd5 — personal data associated with that account is not immediately deleted. A post-closure retention period of 5 years applies to financial and KYC records. Marketing preference data and non-essential usage data are deleted or anonymised within 90 days of account closure. After the applicable retention period has expired, data is either securely deleted from all active systems or irreversibly anonymised so that it can no longer be linked to an individual.

678bd5 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. While no online platform can guarantee absolute security, we continuously invest in security infrastructure to maintain a high standard of data protection.

Encryption

All data transmitted between your device and the 678bd5 platform is encrypted using TLS (Transport Layer Security) protocols. Sensitive data stored in our databases — including passwords, payment references, and KYC documents — is encrypted at rest using industry-standard encryption algorithms. Passwords are stored using one-way hashing and are never stored or transmitted in plain text.

Access Controls

Access to personal data within our organisation is restricted on a strict need-to-know basis. Staff who have access to player data are trained in data protection obligations and are subject to contractual confidentiality requirements. Administrative access to production systems requires multi-factor authentication and is logged for audit purposes.

Infrastructure Security

The 678bd5 platform is hosted on enterprise-grade cloud infrastructure with firewalls, intrusion detection systems, and regular vulnerability assessments. We perform periodic security audits and penetration testing to identify and remediate potential weaknesses before they can be exploited.

Incident Response

678bd5 maintains a documented data breach response procedure. In the event of a security incident that affects your personal data, we will assess the impact, contain the breach, and notify affected players via their registered email address within a reasonable timeframe. The notification will describe the nature of the incident, the data affected, and the steps we are taking to address it.

Your Role in Security

You also play an important role in keeping your account secure. We strongly recommend that you use a strong, unique password for your 678bd5 account, enable any available two-factor authentication options, and never share your login credentials with any other person. If you suspect that your account has been accessed without your authorisation, contact [email protected] immediately.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 678bd5 handles your personal data, we encourage you to contact our dedicated privacy support team. We treat all privacy enquiries seriously and commit to providing a substantive response within 30 calendar days of receiving a valid request.

When contacting us about a privacy matter, please include the following details to help us handle your request efficiently:

• Your registered email address and account username
• A clear description of your request or concern (e.g., "I would like to request a copy of all data held about my account" or "I would like to withdraw my consent for marketing emails")
• For data access or erasure requests: your preferred format for receiving a response (email is standard)
• For complaints: a description of the specific processing activity you are concerned about and why

Use the subject line "Privacy Rights Request" or "Privacy Complaint" as appropriate so our team can route your message to the correct team immediately. All privacy correspondence is handled in strict confidence.

We are committed to resolving all privacy enquiries fairly and transparently. If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to our senior complaints team in writing, and we will provide a final written response within 28 calendar days of escalation.