1 Who We Are
bs33 is an online betting and casino platform operating at bs33.io, primarily serving players located in Bangladesh. When this Privacy Policy refers to "bs33", "we", "us", or "our", it refers to the operator of the bs33 platform in its capacity as data controller — meaning we determine the purposes and means by which personal data is processed in connection with the platform's services.
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, you may contact us at any time through the channels listed in Section 15. bs33 takes its obligations as a data controller seriously and has appointed internal data handling responsibilities to ensure compliance with applicable privacy obligations.
2 Data We Collect
bs33 collects different categories of personal data depending on your relationship with the platform. The following table provides a full breakdown of data categories and specific data points collected:
| Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, gender, National Identity Card (NID) number, passport number | Registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, district, postal code) | Registration & KYC verification |
| Account Data | Username, hashed password, account balance, transaction history, betting history, bonus history | Account creation & ongoing use |
| Payment Data | bKash / Nagad / Rocket account number (last 4 digits only), bank name, transaction reference numbers, deposit and withdrawal amounts | Payment transactions |
| Technical Data | IP address, device type, browser type and version, operating system, session timestamps, referral source URL | Automatic — platform access |
| Usage Data | Pages visited, games played, time spent, bet types and amounts, search queries within platform | Automatic — platform use |
| Communications Data | Support chat transcripts, emails sent to [email protected], complaint records | When you contact support |
| Verification Documents | Scanned or photographed copies of NID, passport, driver's licence, utility bill, bank statement | KYC verification process |
We only collect data that is necessary, proportionate, and directly relevant to providing and improving the bs33 platform. We do not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, unless it is strictly required by law in the context of a responsible gaming self-exclusion request.
3 How We Collect Your Data
3.1 Data You Provide Directly
The majority of the personal data we hold is provided directly by you when you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or respond to a survey or promotion. You are in control of this data and we only request what is genuinely needed to deliver our services.
3.2 Data Collected Automatically
When you access the bs33 platform — whether via the website or mobile interface — certain technical and usage data is collected automatically through cookies, server logs, and analytics tools. This includes your IP address, device information, browser type, and pages visited. This data helps us maintain platform security, diagnose technical issues, and understand how players interact with our services in aggregate. See Section 8 for full details on our cookie practices.
3.3 Data from Third Parties
bs33 may receive personal data about you from the following third-party sources:
- KYC and identity verification providers — who confirm the authenticity of the documents you submit during the verification process.
- Payment processors — including bKash, Nagad, Rocket, Upay, and partner banks, who share transaction confirmation data to allow us to credit or process your account.
- Fraud and risk detection services — which flag IP addresses, devices, or behavioural patterns associated with known fraud or multi-accounting activity.
- Game providers — such as Pragmatic Play, Evolution Gaming, and Spribe, who may share game session data and RNG audit logs that are linked to your account for dispute resolution purposes.
4 Why We Use Your Data
bs33 uses personal data for the following defined purposes. We do not use your data for any purpose beyond those listed here without first seeking your explicit consent or as required by law:
- Account creation and management: Processing your registration, maintaining your account, and providing access to all platform features including betting, casino games, and payment services.
- Identity and age verification (KYC): Confirming that you are who you claim to be, that you meet the minimum age requirement of 21 years, and that you are not on any exclusion or sanctions list.
- Payment processing: Executing deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, and bank channels, and maintaining records of all financial transactions for audit and dispute resolution.
- Customer support: Responding to your queries, complaints, and support requests via live chat, email, or WhatsApp in a timely and accurate manner.
- Platform security and fraud prevention: Detecting, investigating, and preventing unauthorised access, multi-accounting, bonus abuse, money laundering, match-fixing, and other fraudulent or illegal activity.
- Legal and regulatory compliance: Meeting our obligations under applicable anti-money-laundering laws, counter-terrorism financing requirements, and any legal orders or requests from competent authorities.
- Responsible gaming: Monitoring gambling patterns to identify signs of problem gambling and to enforce deposit limits, self-exclusion requests, and cooling-off periods as described on our Responsible Gaming page.
- Platform improvement: Analysing aggregate usage data to improve our website performance, game selection, payment options, and overall user experience for Bangladeshi players.
- Direct communications: Sending you transactional notifications (account statements, withdrawal confirmations, security alerts) and, where you have consented, promotional communications about bonuses and new games.
5 Legal Basis for Processing
bs33 processes your personal data on the following legal grounds:
5.1 Contractual Necessity
Processing your identity data, contact data, account data, and payment data is necessary to fulfil the contract between you and bs33 — specifically, to provide you with access to betting and casino services, to process deposits and withdrawals, and to manage your account. Without this processing, we cannot deliver the services you signed up for.
5.2 Legal Obligation
Certain processing activities — particularly KYC verification, retention of transaction records, and reporting obligations — are required by applicable anti-money-laundering, counter-terrorism-financing, and financial services laws. We cannot waive these requirements even if you object.
5.3 Legitimate Interests
bs33 processes technical data, usage data, and communications data on the basis of our legitimate interests in: maintaining the security and integrity of the platform; preventing fraud and abuse; improving the platform's functionality; and resolving disputes. We have assessed that these interests are not overridden by your fundamental rights and freedoms, given the privacy-protective measures we have in place.
5.4 Consent
Where we send you promotional or marketing communications about bs33 bonuses, new games, or seasonal offers, we do so on the basis of your consent, which you provide during registration or at any time through your account settings. You may withdraw your marketing consent at any time by contacting [email protected] or adjusting your notification preferences in your account dashboard. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
6 Data Sharing & Disclosure
bs33 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your data only in the following limited and controlled circumstances:
6.1 Service Providers
We share data with carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include KYC verification providers, payment gateway operators (bKash, Nagad, bank partners), IT infrastructure and cloud hosting providers, fraud detection and risk management services, and customer support platform providers. All service providers are contractually prohibited from using your data for any purpose other than delivering the specific service for which they were engaged.
6.2 Game Providers
When you play a casino or slot game supplied by a third-party provider such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, a unique session identifier (not your name or full contact details) is shared with the game provider's systems to initiate and record the game session. Game providers are subject to their own privacy policies and are independently audited for fair play and data security compliance.
6.3 Legal Authorities
bs33 will disclose personal data to government authorities, law enforcement agencies, or courts where we are legally required to do so by a valid court order, subpoena, or applicable law. We will notify you of such a disclosure request wherever permitted by law. We will not disclose more data than is strictly required to comply with the legal obligation in question.
6.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of the bs33 business, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice via your registered email address before any such transfer takes effect and will ensure the receiving entity is bound by privacy obligations at least equivalent to those in this policy.
7 Payment Data & Financial Privacy
All financial transactions on the bs33 platform are processed through encrypted payment channels. bs33 applies the following specific protections to payment-related personal data:
- Full bKash and Nagad mobile wallet numbers are never stored in plain text on bs33 servers. Only masked identifiers (last four digits) and transaction reference numbers are retained.
- Bank account numbers submitted during withdrawal processing are encrypted at rest using AES-256 encryption and are accessible only by the payments operations team under strict access controls.
- Payment transaction records are retained for a minimum of five years in accordance with financial record-keeping obligations. These records are used exclusively for dispute resolution, audit, and legal compliance purposes.
- bs33 does not process card-not-present transactions in a way that stores full Primary Account Numbers (PAN). Where Visa or Mastercard transactions are available, they are processed directly through PCI-DSS-compliant payment gateways with no full card data touching bs33 servers.
If you believe that a payment transaction on your bs33 account was processed incorrectly or without your authorisation, contact our support team immediately via live chat for fastest resolution, or by email at [email protected]. We aim to investigate and respond to all payment disputes within 48 hours.
8 Cookies & Tracking Technologies
8.1 What Are Cookies
Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device, remember your preferences, and gather aggregate information about how visitors use the platform. bs33 uses cookies and similar technologies (including local storage and session tokens) as described below.
8.2 Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session authentication, login state, security tokens, CSRF protection | Session / up to 24 hours |
| Functional | Language preference, game layout settings, remember-me tokens | Up to 30 days |
| Analytics | Aggregate page view counts, session durations, feature usage rates — used to improve platform performance | Up to 13 months |
| Fraud Prevention | Device fingerprinting tokens used to detect multi-accounting and bot activity | Up to 12 months |
8.3 Third-Party Cookies
bs33 does not allow third-party advertising networks to place tracking cookies on the platform. Analytics data is processed using privacy-respecting tools configured to anonymise IP addresses. Game providers may set session-scoped cookies within their embedded game windows; these cookies are necessary for game functionality and expire when your game session ends.
8.4 Managing Cookies
You may manage or disable cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in or using core platform features. Disabling functional cookies may cause your preferences not to be saved between sessions. Analytics and fraud-prevention cookies can be disabled without affecting your ability to use the platform, though this may reduce our ability to identify and prevent fraudulent activity on your account.
9 Data Retention
bs33 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and identity data | Duration of account + 5 years after closure | Legal, KYC, and dispute obligations |
| Payment transaction records | 5 years from transaction date | Financial record-keeping requirements |
| KYC verification documents | 5 years after account closure | Anti-money-laundering obligations |
| Betting and game history | 3 years from date of activity | Dispute resolution and audit |
| Support communications | 3 years from last interaction | Service improvement and dispute records |
| Technical / log data | 90 days | Security monitoring and debugging |
| Analytics data | 13 months (aggregate, anonymised) | Platform performance analysis |
After the applicable retention period expires, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data is anonymised rather than deleted, the resulting dataset contains no information that could be linked back to any individual and is retained indefinitely for statistical and business analysis purposes.
10 Data Security
bs33 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes the following controls:
10.1 Technical Safeguards
- Transport Layer Security (TLS 1.2 / 1.3): All data transmitted between your device and the bs33 platform is encrypted in transit. Our SSL certificate is issued by a recognised Certificate Authority and is renewed automatically.
- AES-256 Encryption at Rest: Sensitive data fields — including identity document scans, payment references, and hashed passwords — are encrypted at rest using AES-256. Passwords are hashed using bcrypt with a unique salt per user account and are never stored in plain text.
- Multi-Factor Authentication (MFA): bs33 staff members with access to production systems are required to authenticate with multi-factor credentials. Players are strongly encouraged to enable two-step verification on their accounts.
- Firewall and Intrusion Detection: Our infrastructure is protected by enterprise-grade web application firewalls (WAF), DDoS mitigation services, and real-time intrusion detection systems that monitor for abnormal traffic patterns 24/7.
- Access Controls: Personal data is accessible only to authorised personnel on a strict need-to-know basis. Role-based access controls (RBAC) ensure that no single employee has unrestricted access to all categories of personal data.
10.2 Organisational Safeguards
- All employees and contractors who handle personal data are required to complete data privacy training and are bound by confidentiality obligations.
- Data processing activities are subject to regular internal audits to verify compliance with this Privacy Policy and applicable data protection standards.
- A formal incident response plan is in place to ensure rapid and effective handling of any data security events, including notifying affected players as described in the commitment card above.
11 Your Data Rights
As a player whose personal data is processed by bs33, you hold the following rights. To exercise any of these rights, contact our support team at [email protected] with the subject line "Data Rights Request" and include your registered username and a description of your request. We will respond within 30 days.
11.1 Right of Access
You have the right to request a copy of all personal data that bs33 holds about you. We will provide this in a structured, commonly used, machine-readable format (such as CSV or JSON) free of charge for the first request in any 12-month period. Subsequent requests within the same period may be subject to a reasonable administrative fee.
11.2 Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay. For account-level corrections (such as updating your mobile number or address), you may also make changes directly through your account settings where available.
11.3 Right to Erasure
You may request that bs33 delete your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn your consent (for consent-based processing only), or where you object to processing and there are no overriding legitimate grounds. Please note that we cannot delete data that we are legally required to retain — such as KYC records and financial transaction history — during the mandatory retention periods described in Section 9.
11.4 Right to Restriction
You may request that we temporarily restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested, or while an objection to processing is being assessed. During a restriction period, we will continue to store your data but will not actively process it for other purposes.
11.5 Right to Data Portability
Where processing is based on your consent or on a contract with you, and processing is carried out by automated means, you have the right to receive your personal data in a portable format and to request that it be transmitted directly to another controller where technically feasible.
11.6 Right to Object
You have the right to object at any time to the processing of your personal data where that processing is based on bs33's legitimate interests. Upon receiving an objection, we will cease the processing activity unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
11.7 Right to Withdraw Consent
Where we rely on your consent as the legal basis for processing — in particular, for sending promotional communications — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing activities carried out prior to the withdrawal. To withdraw marketing consent, contact [email protected] or update your notification preferences in your account settings.
12 Children & Minors
The bs33 platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21. If we discover or are notified that we have inadvertently collected data from a person under 21, we will take immediate steps to delete that data and permanently close the associated account.
As part of our Know Your Customer (KYC) process, every player is required to submit proof of identity and proof of age before their account becomes fully active. This verification step is designed to prevent access by individuals who do not meet the 21+ age threshold. Players who cannot provide satisfactory age verification documents will have their accounts suspended pending resolution.
13 International Data Transfers
bs33 operates its platform primarily to serve players in Bangladesh. However, some of our third-party service providers — including cloud infrastructure providers, KYC verification services, and game platform operators — may process personal data in jurisdictions outside Bangladesh. Where such international transfers occur, bs33 takes the following steps to ensure your data remains protected:
- We only engage service providers who can demonstrate adequate data protection standards, whether through certification, binding contractual clauses, or the provider's jurisdiction having recognised data protection laws.
- All third-party data processors are bound by data processing agreements that impose obligations equivalent to those in this Privacy Policy, including requirements to implement appropriate technical and organisational security measures.
- We conduct periodic reviews of our third-party processors to verify ongoing compliance with these requirements.
If you would like more information about the specific safeguards in place for any particular international transfer of your data, please contact our support team at [email protected].
14 Policy Amendments
bs33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, platform features, or regulatory requirements. When material changes are made, we will:
- Update the "Last updated" date at the top of this policy document.
- Post a prominent notice on the bs33 platform homepage for a minimum of 14 days following the update.
- Send a notification to your registered email address summarising the key changes, where practicable.
Your continued use of the bs33 platform following the publication of any updated Privacy Policy constitutes your acknowledgement and acceptance of the revised terms. If you do not agree with any changes to this policy, you should discontinue use of the platform and contact us to request account closure and data deletion in accordance with your rights under Section 11.
We encourage all players to review this Privacy Policy periodically — particularly after receiving a change notification — to stay fully informed of how bs33 handles your personal data.
15 Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data that bs33 holds about you, please reach out to our support team through any of the following channels:
- Email: [email protected] (plain text — not a clickable link)
- Live Chat: Available 24/7 directly through the bs33 platform interface — the fastest channel for urgent data security concerns
- WhatsApp: Number displayed on the Contact Us page within the platform
- Support Hours: 24 hours a day, 7 days a week — Bangladesh Standard Time (UTC+6)
When submitting a data rights request or a privacy-related query, please include your registered account username and a clear description of your request. This helps us locate your data accurately and respond as efficiently as possible. We aim to acknowledge all privacy-related requests within 48 hours and to provide a full response within 30 days.