Privacy Policy – How 22db Protects Your Data

1 Introduction

This Privacy Policy ("Policy") describes how 22db ("22db", "we", "us", "our") collects, processes, stores, shares, and protects the personal data of users ("you", "your") who access or use the 22db online betting and casino platform at 22db.io.

22db is committed to handling your personal data with transparency, integrity, and care. We collect only the data that is necessary to deliver our services, comply with our legal obligations, and provide you with a secure, personalised platform experience. We do not sell your personal data to third parties under any circumstances.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, which together form the complete agreement governing your use of the 22db platform. By registering an account or continuing to use the 22db platform, you acknowledge that you have read and understood this Privacy Policy.

This Policy is written in plain, accessible English. Where any translated version exists for reference purposes, the English text shall take precedence in the event of any discrepancy.

2 Data We Collect

22db collects personal data through several channels: directly from you during registration and platform use, automatically through your device and browser as you navigate the platform, and from trusted third-party partners who assist us in delivering our services. The categories of personal data we collect are outlined below.

2.1 Registration and Identity Data

Full legal name
Date of birth (to verify the 21+ age requirement)
Residential address (including city, district, and postal code)
Email address
Mobile phone number
Username and encrypted password

2.2 Identity Verification (KYC) Data

National Identity Card (NID) number or passport number
Copies of government-issued photo ID documents
Proof of address documents (utility bills, bank statements)
Selfie or live facial verification image (where required)

2.3 Financial and Transaction Data

bKash, Nagad, Rocket, or Upay mobile wallet identifiers
Bank account details (where bank transfers are used)
Deposit and withdrawal history, including amounts in ৳BDT
Transaction timestamps and payment method references

2.4 Betting and Gaming Activity Data

Sports betting history, including markets, stakes, and outcomes
Casino game session data, including game titles, wager amounts, and results
Bonus and promotion redemption history
Account balance history and wagering patterns

2.5 Technical and Usage Data

IP address and approximate geolocation
Device type, operating system, and browser version
Pages visited, time spent on pages, click paths, and session duration
Referral source (e.g., search engine, direct visit)

2.6 Communications Data

Live chat transcripts with our support team
Email correspondence with 22db
Voluntary survey and feedback responses

22db applies the principle of data minimisation — we collect only what is genuinely necessary to deliver our services and meet our legal obligations. We do not collect sensitive categories of data such as health records, religious beliefs, or political opinions.

The following table summarises the primary data categories and their collection sources:

Data Category	Collection Source	Required or Optional
Registration & Identity	Provided directly by you	Required
KYC Verification	Provided directly by you	Required (for withdrawals)
Financial & Transaction	Automatically recorded on platform	Required
Betting & Gaming Activity	Automatically recorded on platform	Required
Technical & Usage	Automatically via cookies & analytics	Required (functional)
Communications	Provided directly by you	Optional

3 How We Use Your Data

22db processes your personal data for clearly defined and legitimate purposes. We do not use your data for any purpose incompatible with the reason it was originally collected. The primary purposes for which we use your personal data are:

Account Management: Creating, maintaining, and securing your 22db account, including authentication and account recovery.
Service Delivery: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank channels; enabling sports betting and casino gaming; crediting winnings to your account.
Identity and Age Verification: Confirming that you meet the 21+ age requirement and verifying your identity as required by responsible gaming and anti-fraud standards.
Fraud Prevention and Security: Monitoring transactions and account activity to detect and prevent fraud, money laundering, collusion, and other prohibited conduct as defined in our Terms & Conditions.
Responsible Gaming Compliance: Operating deposit limits, session timers, cooling-off periods, and self-exclusion tools in accordance with our Responsible Gaming Policy.
Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance via live chat and email.
Platform Improvement: Analysing aggregated usage data to improve the platform's features, performance, and user experience.
Personalisation: Presenting relevant game recommendations, sporting event highlights (BPL, IPL, T20 World Cup), and promotional offers based on your activity history.
Marketing Communications: Sending promotional emails and notifications about bonuses, seasonal offers (Eid, Pohela Boishakh), and platform updates — only where you have given explicit consent or where a legitimate interest applies, with a clear opt-out mechanism provided at all times.
Legal and Regulatory Compliance: Meeting obligations imposed by applicable laws and cooperating with lawful requests from competent authorities.

4 Legal Basis for Processing

22db processes your personal data on the following legal bases, depending on the specific processing activity:

Contractual Necessity: Processing required to perform the contract between you and 22db — including account creation, payment processing, and game delivery — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and lawful authority requests.
Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where these interests are not overridden by your privacy rights.
Consent: Processing for non-essential marketing communications and optional analytics cookies, where we have obtained your prior, informed, and freely given consent. You may withdraw consent at any time by contacting our support team.

If you withdraw consent for marketing communications, this will not affect the lawfulness of any processing that occurred before the withdrawal, nor will it affect any processing carried out on a different legal basis (e.g., contractual necessity).

5 Data Sharing

22db does not sell, rent, or trade your personal data. We share your data only with trusted parties where strictly necessary, and only for the purposes described in this Policy. The categories of recipients with whom we may share your data are:

5.1 Identity Verification Providers

Third-party KYC and age verification services that assist us in confirming your identity and age. These providers process your identity documents under strict confidentiality and data security obligations.

5.2 Payment Processors

Payment partners including bKash, Nagad, Rocket, Upay, Visa, Mastercard, and banking partners such as Dutch-Bangla Bank, BRAC Bank, and City Bank. Financial data is shared only to the extent necessary to process your transactions securely.

5.3 Game Content Providers

Licensed game studios and live casino operators including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive session-level data necessary to deliver their games within the 22db platform environment.

5.4 Technology and Infrastructure Partners

Cloud hosting, cybersecurity, analytics, and platform infrastructure providers who process data on our behalf under binding data processing agreements that prohibit them from using your data for their own purposes.

5.5 Legal and Regulatory Authorities

Where required by law, court order, or lawful authority request, 22db may disclose personal data to regulatory bodies, law enforcement agencies, or fraud prevention organisations. We will only disclose the minimum data necessary to comply with such requirements.

All third-party service providers engaged by 22db are contractually required to process your data only for the specific purpose for which it was shared, to maintain appropriate security standards, and to prohibit onward transfer without our written authorisation.

6 Data Retention

22db retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention principles we apply are:

Active Account Data: Retained throughout the duration of your active account relationship with 22db.
Closed Account Data: Upon account closure, core account and transaction data is retained for a minimum period of five (5) years to comply with anti-money laundering record-keeping requirements.
KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure or the last transaction, whichever is later.
Betting and Gaming Records: Transaction and game history records are retained for five (5) years from the date of the relevant activity.
Support Communications: Live chat and email correspondence is retained for three (3) years from the date of the interaction, or longer if related to an open dispute.
Marketing Consent Records: Records of your marketing preferences and consent history are retained for the duration of your account plus two (2) years to demonstrate compliance.

When personal data is no longer required and the applicable retention period has expired, 22db will securely delete or anonymise that data in a manner that prevents reconstruction or re-identification.

7 Data Security

22db implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

SSL/TLS Encryption: All data transmitted between your browser or device and the 22db platform is encrypted using industry-standard SSL/TLS protocols with 256-bit encryption.
Encrypted Data Storage: Sensitive data fields including passwords, payment identifiers, and identity document references are stored in encrypted form using modern cryptographic standards. Passwords are hashed and salted — they are never stored in plain text.
Access Controls: Access to personal data within 22db's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
Fraud Monitoring: Automated systems continuously monitor account activity for signs of unauthorised access, suspicious login attempts, and unusual transaction patterns.
Penetration Testing: The 22db platform undergoes regular security assessments and vulnerability testing to identify and remediate potential weaknesses before they can be exploited.
Incident Response: 22db maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected users within the timeframe required by applicable law.

While 22db employs robust security measures, no online platform can guarantee absolute security. You also play an important role — please use a strong, unique password for your 22db account and never share your login credentials with anyone.

8 Cookies & Tracking Technologies

22db uses cookies and similar tracking technologies to operate the platform effectively, analyse usage patterns, and deliver a personalised experience. The categories of cookies we use are:

Cookie Type	Purpose	Required
Essential Cookies	Maintain your login session, remember your preferences, and enable core platform functionality such as the cashier and game launcher.	Yes — cannot be disabled
Analytics Cookies	Collect anonymised data on page visits, session durations, and navigation paths to help us improve the platform.	Optional — consent required
Personalisation Cookies	Remember your game preferences and recently played titles to surface relevant recommendations.	Optional — consent required
Security Cookies	Detect fraudulent activity, protect against CSRF attacks, and support account security monitoring.	Yes — cannot be disabled

You can manage your non-essential cookie preferences through the cookie settings panel available within your account dashboard. Disabling optional cookies will not prevent you from using the core 22db platform, though some personalisation features may be reduced.

9 Your Privacy Rights

22db respects your right to control how your personal data is used. You may exercise the following rights at any time by contacting our support team via live chat or by emailing [email protected]:

Right of Access

Request a copy of all personal data we hold about you, including account data, transaction history, and communications records.

Right to Rectification

Request correction of any inaccurate or incomplete personal data held in your account profile.

Right to Erasure

Request deletion of your personal data where it is no longer necessary, subject to our legal retention obligations.

Right to Restriction

Request that we limit our processing of your data in certain circumstances, such as while a dispute is under review.

Right to Portability

Request a structured, machine-readable export of the personal data you have provided to 22db directly.

Right to Object

Object to processing of your data carried out on the basis of legitimate interests, including direct marketing communications.

We will respond to all verified data rights requests within thirty (30) calendar days. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reason for the delay.

To protect your data from unauthorised access requests, 22db will verify your identity before processing any data rights request. You may be asked to provide identity confirmation before we proceed.

10 Minors

The 22db platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process personal data belonging to individuals under the age of 21. Age verification is performed during the registration process and may be supplemented by KYC document checks at any time.

If 22db becomes aware that personal data has been collected from an individual who is under 21 years of age, that account will be immediately suspended, all associated data will be deleted, and any winnings generated will be forfeited in accordance with our Terms & Conditions.

If you are a parent or guardian and you believe a minor has created an account on 22db, please contact us immediately at [email protected]. We will investigate and take prompt action to close the account and remove all associated data.

11 International Data Transfers

22db operates primarily to serve players in Bangladesh. However, some of our third-party technology and service partners — including cloud infrastructure providers, game studios, and analytics platforms — may process data from servers located outside Bangladesh. Where such transfers occur, 22db ensures that appropriate safeguards are in place to maintain a level of data protection consistent with the standards described in this Policy.

Safeguards for international transfers may include contractual data processing agreements, standard contractual clauses, and data transfer impact assessments. 22db will not transfer personal data to jurisdictions that do not provide an adequate level of protection for the rights and freedoms of data subjects without implementing the appropriate additional safeguards.

12 Changes to This Policy

22db may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform services. When material changes are made, we will provide advance notice to registered users through a prominent on-platform notification or via email to your registered address.

The updated Policy will display a revised "Last Updated" date at the top of the page. Your continued use of the 22db platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree with a revised Policy, you must cease using the platform and contact our support team to close your account.

We encourage you to review this Policy periodically to stay informed about how 22db protects your personal data.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 22db handles your personal data, please reach out to our support team using the contact details below. All contact information is provided as plain text — please do not submit formal legal correspondence exclusively via live chat.

Email: [email protected]
WhatsApp: +880 1700 220022
Live Chat: Available 24/7 directly within the 22db platform
Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

For data rights requests (access, erasure, rectification, portability), please contact us via email with the subject line "Data Rights Request" and include your registered username and the specific right you wish to exercise. We will verify your identity before processing the request.

22db Privacy Policy — How We Collect, Use, and Protect Your Personal Data

Contents