Privacy Policy — bad333

1 Introduction

This Privacy Policy ("Policy") is issued by bad333 ("we", "us", "our") and applies to all personal data collected from individuals ("you", "your") who visit, register with, or otherwise interact with the bad333 platform at https://bad333.app and any associated services, mobile experiences, or communications.

bad333 is committed to handling your personal information responsibly and in accordance with recognised data protection principles. This Policy explains in clear, plain English what data we collect, why we collect it, how it is used, how long it is kept, who it may be shared with, and what rights you have in relation to it.

This Policy should be read alongside the bad333 Terms & Conditions. By registering an account or continuing to use the bad333 platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with the terms of this Policy, you should not use the bad333 platform.

2 Data We Collect

bad333 collects personal data through a variety of channels, including account registration, ongoing platform use, payment transactions, customer support interactions, and automatic technical means. The categories of personal data we collect include the following:

2.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (to verify that you meet the 18+ age requirement)
• Residential address, including city, district, and postal code
• Email address and mobile phone number
• Username and encrypted password chosen during registration

2.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (National ID card, passport, or driving licence)
• Proof of address documents (utility bill, bank statement, or official government correspondence)
• Proof of payment method ownership (e.g., screenshot of bKash or Nagad account showing your registered mobile number and name)

2.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, and payment methods used
• Mobile financial service account identifiers (bKash number, Nagad number, Rocket number, Upay number)
• Card payment details where applicable — note that bad333 does not store full card numbers; these are handled directly by our PCI-DSS compliant payment processors
• Account balance history and bet/wager records

2.4 Usage & Behavioural Data

• Pages visited, games played, bet amounts, session durations, and navigation patterns within the bad333 platform
• Login timestamps, IP address, and geolocation data (country and city level)
• Device type, operating system, browser type and version, and screen resolution
• Referral source data where you arrived at bad333 via a tracked link

2.5 Communications Data

• Records of all communications between you and the bad333 support team, including live chat transcripts and email correspondence
• Feedback, survey responses, and complaints submitted via any channel
• Records of your marketing communication preferences

3 How We Use Your Data

bad333 uses the personal data it collects strictly for the purposes described in this Policy. The primary purposes for which we process your personal data are as follows:

bad333 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your separate, specific consent or where otherwise required or permitted by applicable law.

4 Legal Basis for Processing

bad333 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity in question:

• Contractual necessity: Processing that is necessary to perform the contract between you and bad333, including operating your account, processing transactions, and providing access to games and betting services.
• Legal obligation: Processing that bad333 is required to carry out in order to comply with applicable legal and regulatory requirements, including KYC identity verification, anti-money laundering record-keeping, and responsible gaming obligations.
• Legitimate interests: Processing carried out for bad333's legitimate business interests, including fraud prevention, platform security, analytics, and improving the player experience, provided those interests are not overridden by your privacy rights.
• Consent: Processing activities that are optional and for which bad333 relies on your explicit opt-in consent, including sending promotional and marketing communications. Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

5 Data Sharing & Disclosure

bad333 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. However, in order to operate the platform effectively and comply with legal obligations, bad333 may share your personal data with the following categories of recipients:

5.1 Payment Processors

bad333 shares necessary financial and identity data with payment processing partners — including bKash, Nagad, Rocket, Upay, SureCash, and international card processors — for the purpose of processing your deposit and withdrawal transactions. These partners are contractually obligated to handle your data securely and only for the payment purpose specified.

5.2 Identity Verification Providers

bad333 may use third-party KYC and identity verification service providers to assist with document verification. These providers process your KYC documents under strict data processing agreements and are not permitted to retain or use your data for any purpose beyond verification.

5.3 Game Technology Providers

Game providers such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe may receive limited technical data (such as a session token and account identifier) necessary to deliver their games within the bad333 platform. These providers do not receive your full identity or payment data.

5.4 Legal & Regulatory Authorities

bad333 may be required by applicable law or a lawful request from a competent authority to disclose your personal data. In such cases, bad333 will comply with the legal requirement and, where permitted to do so, will inform you that such a disclosure has been made.

5.5 Anti-Fraud & AML Compliance

bad333 may share data with fraud prevention organisations and anti-money laundering databases where required to prevent financial crime or where bad333 has a reasonable suspicion that fraudulent or unlawful activity has occurred or may occur.

6 Cookies & Tracking Technologies

bad333 uses cookies, pixel tags, and similar tracking technologies on the platform to deliver a functional, personalised, and secure user experience. A cookie is a small text file stored on your device by your web browser when you visit a website.

6.1 Types of Cookies Used

• Essential cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without breaking the platform.
• Preference cookies: Store your platform settings such as language preference, display options, and game history. Disabling these cookies will reset your preferences on each visit.
• Analytics cookies: Allow bad333 to understand how the platform is used — which pages are most visited, where users encounter difficulties, and how navigation flows are performing. This data is aggregated and, where possible, anonymised.
• Marketing cookies: Used only where you have opted in to receive promotional communications. These cookies help bad333 understand which promotions are most relevant to your gaming preferences.

6.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please be aware that disabling cookies may affect the functionality of certain features of the bad333 platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's official help documentation.

7 Data Security

bad333 employs a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes the following measures:

• 256-bit SSL/TLS encryption for all data in transit between your device and bad333 servers
• AES-256 encryption for sensitive data stored at rest, including KYC documents and payment information
• Bcrypt password hashing — your bad333 password is never stored in plain text under any circumstances
• Role-based access controls ensuring that only staff members with a legitimate operational need can access specific categories of player data
• Regular independent security audits and penetration testing of the bad333 platform infrastructure
• Automated fraud monitoring systems that flag unusual account activity patterns for human review in real time

While bad333 takes every reasonable precaution to protect your data, no security system is entirely infallible. In the event of a data security incident that presents a material risk to your personal data, bad333 will notify affected players in a timely manner and take all appropriate remedial action.

8 Data Retention

bad333 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account data and KYC documents: Retained for a minimum of five (5) years from the date of account closure, in order to meet anti-money laundering record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for three (3) years from the date of the interaction, unless the communication relates to an unresolved dispute, in which case it is retained until the dispute is fully resolved.
• Marketing preference records: Retained for the duration of your account, or for two (2) years following your opt-out from marketing communications, whichever is later.
• Usage and behavioural analytics data: Retained in anonymised or aggregated form indefinitely for platform improvement purposes; identifiable usage data is retained for no more than two (2) years.

Once the applicable retention period has expired, bad333 will securely delete or permanently anonymise the relevant data as part of its scheduled data lifecycle management processes.

9 Your Data Rights

As a player on the bad333 platform, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected], clearly stating the right you wish to exercise and providing sufficient information to verify your identity.

• Right of access: You have the right to request a copy of the personal data that bad333 holds about you. We will provide this information within a reasonable timeframe, typically within 30 days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented.
• Right to erasure: You may request the deletion of your personal data where it is no longer required for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing. Note that this right is subject to legal retention obligations — we may not be able to delete data that we are required by law to retain.
• Right to restrict processing: You have the right to request that bad333 restrict the processing of your personal data in certain circumstances, for example while a complaint is being investigated.
• Right to data portability: Where processing is based on your consent or on a contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on bad333's legitimate interests. bad333 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based solely on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10 Children's Privacy

The bad333 platform is strictly intended for adults aged 18 years and above. bad333 does not knowingly collect, process, or store personal data relating to individuals under the age of 18. If you are under 18, you must not register an account on bad333, deposit any funds, or participate in any game or betting activity.

If bad333 becomes aware that personal data relating to a minor has been collected — for example, through a registration made using false age information — that data will be deleted promptly and the associated account will be closed immediately, with any balance forfeited in accordance with the Terms & Conditions.

If you are a parent or guardian and believe that your child may have registered an account on bad333, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

11 Marketing Communications

bad333 will only send promotional emails, SMS messages, or in-platform notifications to players who have expressly opted in to receive such communications during registration or through their account settings. Marketing communications may include information about new games, seasonal promotions, bonus offers, and platform updates.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in the notification settings section of your bad333 account
• Clicking the unsubscribe link included in every marketing email sent by bad333
• Contacting the bad333 support team at [email protected] and requesting removal from marketing lists

Please allow up to five (5) business days for your opt-out preference to be fully reflected across all bad333 communication channels. Withdrawing consent to marketing communications will not affect transactional communications that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, and security alerts.

12 Third-Party Links

The bad333 platform may from time to time contain references to third-party services, game providers, or payment platforms. While bad333 takes care to work only with reputable third-party partners, this Privacy Policy applies solely to personal data collected and processed by bad333 directly. bad333 is not responsible for the privacy practices of third-party websites, applications, or services that are independent of the bad333 platform.

We encourage you to review the privacy policies of any third-party services you interact with, particularly payment providers such as bKash, Nagad, Rocket, Upay, and international card networks, as their data handling practices are governed by their own separate policies.

13 Policy Updates

bad333 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, updates to applicable law, or improvements to the platform. When material changes are made — meaning changes that meaningfully affect your rights or the way we handle your data — we will notify registered players by means of an in-account notification, a prominent notice on the platform, or an email to your registered address.

The effective date and version number displayed at the top of this Policy will be updated each time a revision is published. We encourage you to review this Policy periodically to stay informed about how bad333 protects your personal data. Your continued use of the platform following the publication of a revised Policy constitutes your acceptance of those changes.

Previous versions of this Privacy Policy are available to verified account holders upon written request submitted to [email protected].

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which bad333 handles your personal data, please contact our Data Support team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please include "Privacy Request" or "Data Enquiry" in the subject line to ensure your message is directed to the appropriate team
• Response Time: We aim to acknowledge all privacy-related enquiries within two (2) business days and to provide a substantive response within fifteen (15) business days
• Support Hours: 24 hours a day, 7 days a week, including all Bangladesh public holidays