br33 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Who We Are

br33 operates the online betting and gaming platform accessible at br33.io (the "Platform"). br33 acts as the data controller in respect of the personal information of account holders and visitors who interact with the Platform. In that capacity, br33 is responsible for determining the purposes and means by which personal data is processed.

For the purposes of this Privacy Policy, references to "br33", "we", "us", or "our" refer to the br33 Platform and its operating entity. References to "you" or "your" refer to the individual who has registered or is visiting the Platform.

br33 serves players across Bangladesh, including those located in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. This policy governs all personal data collected from those users in connection with access to and use of the Platform.

2 Information We Collect

2.1 Information You Provide Directly

br33 collects the following categories of personal information that you provide directly when registering or using the Platform:

• Identity Data: Full legal name, date of birth, and gender (for KYC age verification purposes)
• Contact Data: Email address and mobile phone number (used for account communication, OTP verification, and support)
• Identity Document Data: Scanned or photographed copies of your National Identity Card (NID) or passport, submitted during KYC verification
• Address Data: Residential address, submitted as part of proof-of-address verification where required
• Financial Data: Mobile wallet account numbers (bKash, Nagad, Rocket, Upay) and, where applicable, card details (Visa, Mastercard) submitted during deposit or withdrawal processes. Note: br33 does not store full card numbers — payment card data is tokenised and processed by certified payment partners.
• Account Preferences: Responsible gaming limit settings, communication preferences, and self-exclusion elections

2.2 Information Collected Automatically

When you access the Platform, br33 automatically collects certain technical and behavioural data, including:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and connection type
• Usage Data: Pages visited, time spent on each page, features interacted with, bets placed, games played, and session duration
• Transaction Data: Records of all deposits, withdrawals, bets, and game rounds associated with your account
• Log Data: Server-side access logs recording the time and nature of requests made to the Platform

2.3 Information from Third Parties

br33 may receive supplementary information about you from the following third-party sources:

• Payment providers (e.g., bKash, Nagad) confirming transaction status and verifying that the payment account is registered in your name
• Identity verification services used to cross-check NID or passport data during KYC
• Fraud detection and anti-money-laundering screening services
• Analytics and device fingerprinting providers for platform security purposes

3 How We Use Your Information

br33 uses the personal data described in Section 2 for the following purposes:

• Account Registration and Management: Creating, maintaining, and securing your br33 account, including processing your login credentials and profile information
• Identity Verification (KYC): Verifying your age, identity, and payment methods to comply with our responsible gaming obligations and to prevent underage gambling
• Payment Processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard; matching payment accounts to registered account holders
• Service Delivery: Providing access to sports betting, live casino, slot games, and all other products offered on the br33 Platform
• Customer Support: Responding to account queries, resolving disputes, handling responsible gaming requests, and processing complaints
• Fraud Prevention and Security: Detecting and preventing fraudulent activity, money laundering, bonus abuse, multi-accounting, and unauthorised account access
• Responsible Gaming: Monitoring account activity to identify behavioural signs of problem gambling; administering self-exclusion, deposit limits, and other player-protection tools
• Legal Compliance: Meeting record-keeping, anti-money-laundering (AML), and other regulatory obligations applicable to br33's operations
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, design, and content of the Platform
• Marketing Communications: Sending promotional offers, bonus notifications, and campaign updates to account holders who have not opted out (see Section 13 for opt-out instructions)

4 Legal Basis for Processing

br33 processes personal data on the following legal bases, depending on the purpose of processing:

• Contract Performance: Processing your identity, contact, and financial data is necessary to create and maintain your account and to fulfil the betting and gaming services you have requested
• Legal Obligation: Processing for KYC, AML screening, and record-keeping is required to comply with applicable legal and regulatory obligations
• Legitimate Interests: Processing for fraud detection, platform security, responsible gaming monitoring, and aggregated analytics serves the legitimate interests of br33 and its user base — these interests are proportionate and do not override your privacy rights
• Consent: Processing for optional marketing communications is based on your consent, which you may withdraw at any time without affecting the lawfulness of prior processing

5 Cookies & Tracking Technologies

5.1 Types of Cookies Used

The br33 Platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing the Platform's core functionality.
• Functional Cookies: Remember your account preferences such as language setting, preferred payment method, and responsible gaming limit configurations.
• Analytics Cookies: Collect anonymised data about how users navigate the Platform — which pages are visited, how long sessions last, and where users encounter errors. This data is used solely to improve Platform performance and user experience.
• Security Cookies: Support fraud detection and device fingerprinting functions by recording device attributes across sessions. These are used to identify suspicious login patterns and to protect your account from unauthorised access.

5.2 Managing Cookies

You may manage non-essential cookies through your browser settings at any time. Disabling analytics cookies will not impair your ability to use the Platform. Disabling strictly necessary cookies may prevent login and transaction functions from operating correctly. br33 does not use third-party advertising or cross-site retargeting cookies.

6 Sharing Your Information

br33 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We share personal data only in the following circumstances, and only to the extent necessary for the stated purpose:

6.1 Payment Processors

br33 shares transaction data — including your registered payment account number and transaction amount — with the relevant payment processor (bKash, Nagad, Rocket, Upay, Visa, or Mastercard) to facilitate deposits and withdrawals. Each payment processor operates under its own privacy policy and data security standards. br33 selects payment partners that meet a high standard of data protection compliance.

6.2 Identity Verification Partners

During KYC verification, identity document data may be transmitted to a certified third-party identity verification service for cross-checking against official records. All such transmissions are encrypted end-to-end and the verification partner is contractually prohibited from using your data for any purpose other than the specific verification task.

6.3 Game Providers

When you participate in a casino game or slot game hosted by a third-party provider (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, or Spribe), your account identifier and game-session data are transmitted to that provider's gaming server for the purpose of running the game. Game providers do not receive your identity document data or financial account details.

6.4 Fraud Prevention and AML Services

br33 may share device data, transaction patterns, and account activity data with specialist fraud detection and anti-money-laundering screening services for the purpose of identifying and preventing financial crime. These services operate under strict data-processing agreements with br33.

6.5 Legal and Regulatory Disclosure

br33 may disclose personal data to regulatory bodies, law enforcement agencies, or financial intelligence units where required by applicable law or where br33 reasonably believes that disclosure is necessary to prevent serious harm, financial crime, or a breach of these Terms. br33 will provide only the minimum data required to comply with any such legal obligation.

7 International Data Transfers

Some of br33's data processors — including game providers and security analytics services — may operate infrastructure located outside Bangladesh. Where personal data is transferred across borders, br33 ensures that appropriate safeguards are in place, including contractual data-processing agreements that require the recipient to maintain a level of data protection equivalent to the standard applied within the br33 Platform.

Specifically, br33 requires all international data processors to: (a) use encrypted channels for all data in transit; (b) restrict access to personal data to authorised personnel only; (c) notify br33 promptly in the event of a data breach involving br33 user data; and (d) delete or return personal data upon termination of the processing relationship.

Game-session data transmitted to certified game providers is processed solely for the purpose of running the game you have selected and is not retained by the provider beyond what is required for game integrity and dispute resolution purposes.

8 Data Retention

br33 retains personal data for as long as is necessary to fulfil the purposes described in this policy, and in any event for the minimum period required to comply with applicable legal and regulatory obligations. The following retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an individual account holder. If you request deletion of your account, br33 will initiate the deletion process subject to the mandatory retention periods listed above. Data that is subject to a live legal hold or active investigation will be retained until the matter is resolved.

9 Security Measures

br33 applies a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, and disclosure. Key security measures include:

• SSL/TLS Encryption in Transit: All communications between your browser or device and the br33 Platform are encrypted using TLS 1.2 or higher. The padlock icon in your browser confirms that your connection is secure.
• AES-256 Encryption at Rest: Personally identifiable information stored in br33 databases is encrypted using AES-256, an industry-standard symmetric encryption algorithm.
• Access Controls: Access to production databases containing personal data is restricted to a small number of authorised personnel. All access events are logged and subject to periodic audit.
• Two-Factor Authentication (Internal): br33 staff accessing internal systems that hold personal data are required to authenticate using multi-factor authentication.
• Payment Card Tokenisation: br33 does not store raw card numbers. Card payments are tokenised by the payment processor at the point of entry, and only the resulting token is retained by br33.
• Penetration Testing: The br33 Platform undergoes periodic security assessments by independent security professionals to identify and remediate vulnerabilities.
• Incident Response: br33 maintains a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, br33 will notify affected account holders promptly with details of the nature of the incident and the steps being taken to address it.

10 Your Rights & Choices

As a br33 account holder, you have the following rights in respect of your personal data:

• Right of Access: You may request a copy of the personal data br33 holds about you. br33 will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data held by br33 is inaccurate or incomplete, you may request that it be corrected. For most data fields, you can update your information directly from your account settings page.
• Right to Erasure: You may request deletion of your personal data. br33 will honour erasure requests subject to mandatory legal retention periods (see Section 8). Data that is required for AML, fraud prevention, or regulatory compliance cannot be deleted prior to the end of the applicable retention period.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of the data or object to processing — you may request that br33 restrict processing of your personal data while the matter is being reviewed.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format where the processing is based on consent or contract performance.
• Right to Object: You may object to processing based on legitimate interests at any time. br33 will cease such processing unless br33 can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without penalty. Withdrawal of consent does not affect the lawfulness of processing that took place prior to withdrawal.

To exercise any of the above rights, contact the br33 support team via live chat or at [email protected] (plain text — not a clickable link). br33 may require you to verify your identity before acting on a data rights request, to ensure that personal data is not disclosed or deleted in response to a request made by an unauthorised third party.

11 Children & Underage Users

The br33 Platform is strictly intended for persons who are 21 years of age or older. br33 does not knowingly collect personal data from individuals under the age of 21. If br33 discovers that personal data has been collected from a person under 21, that account will be immediately closed, all data associated with the account will be deleted (subject to any applicable legal retention obligations), and any deposits will be returned to the original payment source.

If you believe that a person under the age of 21 has registered a br33 account or has otherwise submitted personal data to the Platform, please notify the br33 support team immediately via live chat so that appropriate action can be taken.

12 Third-Party Links & Services

The br33 Platform may, from time to time, display informational references to third-party services such as payment providers (bKash, Nagad, Rocket) or game providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, Spribe). This Privacy Policy applies solely to personal data collected and processed by br33 in connection with the br33 Platform.

br33 is not responsible for the privacy practices of any third-party service. We recommend that you review the privacy policy of each third-party service — particularly your mobile wallet provider — to understand how they handle your personal data in connection with transactions you initiate on the br33 Platform.

13 Marketing Communications

br33 may send you promotional offers, bonus notifications, seasonal campaign announcements, and product updates by email or SMS. These communications will only be sent if you have not opted out of marketing at the time of registration or subsequently through your account settings.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in the br33 account settings page
• Contacting the br33 support team via live chat and requesting removal from all marketing lists
• Replying to any br33 email with the word "UNSUBSCRIBE" in the subject line

Opting out of marketing communications will not affect br33's ability to send you transactional communications that are directly related to your account — such as deposit confirmations, withdrawal status updates, KYC verification requests, and account security alerts. Transactional communications are a necessary part of managing your br33 account and cannot be opted out of while your account remains active.

14 Changes to This Policy

br33 reserves the right to update or amend this Privacy Policy at any time. When a material change is made — for example, a change to the categories of personal data we collect, a new data-sharing arrangement, or a change in the legal basis for processing — br33 will notify registered account holders via email or in-platform notification at least 7 days before the change takes effect, where practicable.

The "Last Updated" date displayed at the top of this page will always reflect the date on which the most recent version of this Privacy Policy became effective. Your continued use of the br33 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any amendment to this policy, you should cease using the Platform and may request closure of your account by contacting the support team.

Minor, non-material changes — such as typographical corrections, clarifications of existing practices that do not alter their substance, or formatting adjustments — may be made at any time without advance notice, although the "Last Updated" date will still be revised to reflect the change.

15 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which br33 handles your personal data, please contact the br33 Data Protection team using the details below:

• Live Chat: Available 24/7 directly on the br33 Platform — average response time under 3 minutes
• Email: [email protected] (plain text — not a clickable link)
• Response Time: Written requests submitted by email will receive a substantive response within 5 business days

br33 takes all privacy complaints seriously and will investigate each complaint in a fair, timely, and transparent manner. Where a complaint is upheld, br33 will take all reasonable steps to remedy the issue, including correcting inaccurate data, ceasing unlawful processing, or providing additional transparency about data practices.

If you are not satisfied with br33's response to your privacy complaint, you may have the right to escalate your complaint to an appropriate data protection authority or consumer protection body in your jurisdiction.