Your Privacy Is Our Commitment

23bd is an English-language online gaming platform operated for the Bangladesh market. The platform is accessible at https://23bd.io and offers cricket betting, live casino, slots, and table games to registered players in Bangladesh. All financial transactions are conducted in Bangladeshi Taka (৳ BDT).

In the context of this Privacy Policy, references to "23bd", "we", "us", or "our" refer to the operator of the 23bd platform. References to "you", "your", or "player" refer to any individual who accesses, registers on, or otherwise interacts with the 23bd platform.

For all privacy-related enquiries, you may contact us at: [email protected] (plain text — not a clickable link). Our support team is available 24 hours a day, 7 days a week, and privacy requests are handled as a priority.

This Privacy Policy applies to all personal data collected by 23bd through the following channels:

• The 23bd website at https://23bd.io and all subpages therein.
• Account registration and KYC (Know Your Customer) verification processes.
• Deposit and withdrawal transactions processed via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank, Islami Bank, Sonali Bank, and City Bank.
• Live chat, email, and other communications directed to the 23bd support team.
• Participation in games, sports betting markets, tournaments, and promotional activities on the platform.
• Voluntary participation in surveys, feedback forms, or other research activities hosted by 23bd.

This policy does not apply to third-party websites, platforms, or services that may be referenced on 23bd but are independently operated. 23bd has no control over the privacy practices of third-party operators and is not responsible for their data handling.

23bd collects personal data in the following categories. We collect only what is necessary for the stated operational purpose:

23bd does not collect biometric data, precise geolocation data, or sensitive personal data beyond what is identified in the table above. Passwords are stored exclusively as salted cryptographic hashes — plain-text passwords are never stored or transmitted internally.

23bd uses the personal data described in Section 3 for the following specific purposes:

• Account Management: Creating, operating, and maintaining your player account, including processing login authentication, managing account settings, and maintaining your account balance record.
• Transaction Processing: Facilitating deposits and withdrawals in BDT via your registered payment method, verifying payment ownership during KYC, and maintaining accurate financial records.
• Identity Verification: Confirming your identity and age (21+) as required by our Terms & Conditions, including processing KYC documentation submitted to satisfy verification requests.
• Platform Security: Detecting and preventing fraud, money laundering, multiple account registration, bonus abuse, and other forms of Prohibited Conduct as defined in the 23bd Terms & Conditions. Technical data including IP addresses and device fingerprints are used for this purpose.
• Customer Support: Responding to your enquiries, resolving disputes, investigating complaints, and providing assistance via live chat and email. Communication records are retained to support continuity and quality assurance.
• Responsible Gaming: Operating the deposit limit, session alert, time-out, and self-exclusion tools you activate within your account settings. Responsible gaming data is also used to monitor for indicators of problem gambling behaviour and, where warranted, proactively reach out to offer support.
• Legal Compliance: Meeting obligations under applicable law, including responding to requests from law enforcement or regulatory authorities and maintaining financial records for the legally required retention period.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players interact with the 23bd platform and to improve game selection, user experience, and support quality. This analysis does not involve re-identification of individual users.
• Marketing Communications: Sending promotional emails, bonus offers, and platform announcements to players who have not opted out of marketing. See Section 13 for opt-out instructions.

23bd does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

23bd processes personal data under the following legal bases, which govern each category of processing activity:

• Contractual Necessity: Processing required to fulfil our obligations under the 23bd Terms & Conditions, including account management, transaction processing, and KYC verification. Without this processing, 23bd cannot operate your account.
• Legal Obligation: Processing required to comply with applicable law, including anti-money laundering (AML) obligations, age verification requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing for fraud detection, platform security, abuse prevention, and aggregated analytics where those interests are not overridden by your data protection rights. 23bd conducts a legitimate interests assessment before relying on this basis.
• Consent: Processing for marketing communications and optional platform features where we have obtained your explicit consent at the point of data collection. You may withdraw consent at any time by contacting [email protected].

23bd uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file stored on your device when you visit a website. 23bd uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They maintain your login session, remember your account preferences, and ensure that security features operate correctly. These cookies cannot be disabled without impairing core platform functionality.
• Analytics Cookies: These cookies collect anonymised data about how players navigate the 23bd platform — pages visited, time spent, errors encountered — to help us improve user experience. The data collected is aggregated and not linked to individual player identities.
• Security Cookies: These cookies support fraud detection and account protection by recording session identifiers, device fingerprints, and login timestamps used to flag suspicious access patterns.
• Preference Cookies: These cookies remember your platform settings, such as display preferences and responsible gaming tool configurations, so they persist across sessions.

23bd does not use advertising or third-party behavioural tracking cookies. We do not operate a retargeting program or share browsing data with advertising networks.

You may manage cookie settings through your browser controls. Blocking strictly necessary cookies will impair your ability to log in and use the platform. Blocking analytics or preference cookies will not affect core functionality but may result in a less personalised experience.

23bd does not sell, rent, or trade your personal data to any third party for commercial gain. Personal data is shared only in the following limited, controlled circumstances:

• Payment Processors: To facilitate deposits and withdrawals, 23bd shares transaction-related data — including your registered mobile number and transaction amount — with payment partners including bKash, Nagad, Rocket, Upay, and card processing networks for Visa and Mastercard. These partners process data solely to execute the payment instruction and are bound by their own data protection obligations.
• Identity Verification Providers: To fulfil KYC obligations, 23bd may share identity documentation with third-party identity verification services. These providers process data solely for the purpose of verifying the authenticity of submitted documents and confirming the player's identity and age.
• Banking Partners: For bank transfer withdrawals to Dutch-Bangla Bank, BRAC Bank, Islami Bank, Sonali Bank, and City Bank, 23bd shares the minimum necessary data — account name and account number — to process the transfer instruction.
• Legal and Regulatory Authorities: 23bd may disclose personal data to law enforcement agencies, financial regulators, or other competent authorities where required by applicable law, or in response to a valid legal order or regulatory request. 23bd will not disclose more data than is required to satisfy the specific legal obligation.
• Business Transfers: In the event of a merger, acquisition, or sale of 23bd's operating assets, player data may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and of any changes to data handling practices that result from it.

23bd's primary operational infrastructure is oriented toward serving the Bangladesh market. Where data is processed or stored on servers located outside Bangladesh — for example, where a third-party service provider operates infrastructure in another jurisdiction — 23bd takes reasonable steps to ensure that appropriate data protection standards are maintained for such transfers.

These steps may include contractual data processing agreements with service providers, encryption of data in transit and at rest, and access restrictions that limit the data accessible to any offshore infrastructure to only what is operationally necessary.

All financial transaction data involving Bangladeshi payment partners (bKash, Nagad, Rocket, Upay, and Bangladeshi bank accounts) is processed within the applicable payment network infrastructure of those partners, which operates primarily within Bangladesh.

23bd retains personal data for the periods set out below. Retention periods are determined by the purpose for which data was collected, contractual obligations, and applicable legal requirements:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for aggregate analytics purposes.

23bd implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in operation include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser or device and the 23bd platform is encrypted using 256-bit SSL/TLS protocols. This protects your login credentials, payment details, and personal data in transit from interception.
• Encrypted Password Storage: User passwords are never stored in plain text. 23bd stores passwords exclusively as salted cryptographic hashes using industry-standard hashing algorithms. Even in the unlikely event of a data security incident, stored password hashes cannot be reversed to reveal original passwords.
• Access Controls: Access to personal data within 23bd's internal systems is restricted on a strict need-to-know basis. Staff members are granted access only to the data required to perform their specific function. All internal data access is logged and subject to audit.
• Intrusion Detection: 23bd operates continuous monitoring of platform infrastructure for unusual access patterns, attempted intrusions, and other security anomalies. Automated alerts are reviewed by the security team on a 24/7 basis.
• Secure Payment Tokenisation: 23bd does not store raw payment card numbers. Card transactions are processed through tokenised payment flows where the card details are handled exclusively by the certified card processor and are not accessible to 23bd systems.
• Data Breach Response: In the event of a confirmed personal data breach that is likely to result in risk to affected individuals, 23bd will notify affected players without undue delay and will take immediate steps to contain the breach and mitigate its impact.

While 23bd takes all reasonable and proportionate measures to protect your data, no digital platform can guarantee absolute security against all possible threats. Players are encouraged to use strong, unique passwords for their 23bd account and to contact support immediately if they suspect unauthorised access.

As a player on the 23bd platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request — [Your Username]":

• Right of Access: You have the right to request a copy of the personal data that 23bd holds about you. We will provide a structured summary of your data within 5 business days of receiving a verified request.
• Right to Rectification: If any personal data held by 23bd about you is inaccurate or incomplete, you have the right to request that it be corrected. Account profile data (name, email, phone number) can also be updated directly in your account settings.
• Right to Erasure: You have the right to request deletion of your personal data. This right is subject to our legal retention obligations — data we are required to retain under applicable law (see Section 9) cannot be deleted ahead of the applicable retention period. Data that is not subject to a legal retention obligation will be deleted within 10 business days of a verified erasure request.
• Right to Restriction: You have the right to request that 23bd restrict processing of your personal data in specific circumstances — for example, where you contest the accuracy of data held, or where you object to our processing on the basis of legitimate interests.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. You may also object to processing for direct marketing purposes at any time (see Section 13).
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to 23bd in a structured, commonly used, machine-readable format, and to request that this data be transmitted directly to another operator where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent (principally for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

23bd will respond to all verified data rights requests within 5 business days. In complex cases where additional time is required, we will notify you within the initial 5-day period of the expected completion date, which will not exceed 30 calendar days from receipt of the request.

The 23bd platform is strictly for adults aged 21 and above. 23bd does not knowingly collect personal data from any individual under the age of 21. Age verification is conducted as part of the account registration process and, where necessary, through KYC documentation review.

If 23bd becomes aware that personal data has been collected from an individual who is under the age of 21, the relevant account will be immediately suspended, the data will be securely deleted, and any funds associated with the account will be handled in accordance with 23bd's underage access procedures as set out in the Terms & Conditions.

If you are a parent or guardian and you believe that a minor has registered an account on the 23bd platform, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and act on all such reports within 24 hours of receipt.

With your consent, 23bd may send you promotional emails, bonus announcements, tournament notifications, and other marketing communications to the email address registered on your account. Consent for marketing communications is obtained at the point of account registration and is entirely optional — declining marketing communications does not affect your ability to register or use the platform.

You may withdraw consent for marketing communications at any time by:

• Clicking the "Unsubscribe" link included at the bottom of every marketing email sent by 23bd.
• Contacting [email protected] with the subject line "Marketing Opt-Out — [ Your Username]".
• Updating your communication preferences directly within your account settings panel.

Opt-out requests are processed within 2 business days. Following a successful opt-out, you will no longer receive promotional communications from 23bd. Please note that transactional and account-related communications — such as deposit confirmations, withdrawal notifications, security alerts, and KYC status updates — are not marketing communications and will continue to be sent regardless of your marketing preference, as they are necessary for the operation of your account.

23bd does not share your email address or mobile number with any third party for the purpose of sending you marketing communications from another brand or operator.

The 23bd platform may contain references to third-party services, including payment partners and game software providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. While these providers power games or payment flows accessible through 23bd, they operate under their own privacy policies and data handling practices.

23bd is not responsible for the privacy practices or content of third-party services. The inclusion of a third-party provider's games or payment infrastructure on the 23bd platform does not constitute an endorsement of that party's privacy practices. Players who interact with third-party game software or payment services are encouraged to review the privacy documentation of those providers independently.

23bd does not receive or store detailed personal data generated by your interactions within individual game sessions beyond the aggregate transaction record (stake, outcome, game title, timestamp) that appears in your 23bd account history.

23bd reserves the right to update or amend this Privacy Policy at any time. When material changes are made — that is, changes that meaningfully affect how your personal data is collected, used, or shared — 23bd will:

• Update the effective date shown at the top of this document and in the page hero.
• Send an email notification to all registered players at the email address on file, summarising the key changes made.
• Where required by applicable law, obtain fresh consent from affected players before applying the updated policy to their data.

Non-material changes — such as corrections of typographical errors, clarifications of existing practices, or restructuring of the document for readability without substantive change — may be made without prior notice, though the effective date will still be updated.

Continued use of the 23bd platform following notification of a material policy update constitutes acceptance of the revised Privacy Policy. If you do not accept the updated policy, you must discontinue use of the platform and may request account closure by contacting [email protected].

We recommend reviewing this Privacy Policy periodically. The current version is always available at https://23bd.io/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or the way 23bd handles your personal data, please contact our support team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Rights Request — [Your Username]"
• Subject Line for Underage Reports: "Underage Account Report"
• Subject Line for Marketing Opt-Out: "Marketing Opt-Out — [Your Username]"
• Support Hours: 24 hours a day, 7 days a week, including all Bangladesh public holidays
• Response Time: Data rights requests acknowledged within 1 business day; fully resolved within 5 business days (Bangladesh Standard Time, UTC+6)

23bd is committed to resolving all privacy-related concerns promptly and transparently. If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter through applicable legal channels in Bangladesh.