db67 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how db67 ("we", "us", or "the Company") collects, uses, stores, and discloses personal data relating to individuals ("you" or "the Player") who visit, register on, or use the db67 platform at db67.io.

db67 is committed to handling all personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. We recognise that Players entrust us with sensitive financial and personal information when they use our platform, and we take that responsibility seriously.

This Policy applies to all personal data collected through the db67 website, mobile browser interface, customer support channels, and any other touchpoint associated with the db67 brand. It should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference.

By registering an account on db67 or by continuing to use the platform, you confirm that you have read this Policy and understand how your personal data will be processed. If you do not agree with any aspect of this Policy, you should discontinue use of the platform and contact support to close your account.

Data Controller

For the purposes of this Privacy Policy, the data controller responsible for your personal data is db67, the operator of the db67.io platform. All requests relating to your personal data, including subject access requests, rectification requests, and erasure requests, should be directed to the db67 data protection contact:

• Email: [email protected]
• Subject line: Data Privacy Request — [Your Registered Username]
• Response time: Within 10 business days of receipt (BST, UTC+6)

Where db67 engages third-party service providers to process data on its behalf (for example, payment processors or identity verification providers), those providers act as data processors operating under contractual obligations to db67 and do not process your data for their own independent purposes.

Data We Collect

db67 collects several categories of personal data in order to operate the platform, verify Player identities, process transactions, and meet its legal obligations. The categories of data we collect are set out in the table below.

db67 does not collect special categories of sensitive personal data (such as racial origin, religious beliefs, health information, or biometric data) except where strictly required by applicable identity verification law, in which case such data is handled with enhanced safeguards and is not used for any purpose other than mandatory verification.

How We Collect Data

db67 collects personal data through the following means:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or participate in a promotion, you directly provide personal data to db67.
• Automated technical collection: When you access the db67 platform, our servers and analytics tools automatically collect technical and usage data such as your IP address, browser fingerprint, session timestamps, and navigation activity.
• Payment providers: When you initiate a deposit or withdrawal through bKash, Nagad, Rocket, Upay, or another supported payment method, the payment provider shares with db67 the transaction confirmation data necessary to credit or debit your account balance.
• Identity verification providers: Where db67 uses a third-party KYC or age verification service to validate identity documents, that service shares verification results and, where applicable, extracted identity data with db67.
• Cookies and tracking technologies: db67 uses cookies and similar technologies to maintain session state, remember preferences, analyse usage patterns, and support fraud prevention. See Section 9 for full details.
• Publicly available sources: In limited circumstances related to fraud prevention or AML compliance, db67 may consult publicly available records or third-party fraud databases to supplement information already held on an account.

Purpose and Legal Basis for Processing

db67 processes personal data only where there is a clear, documented purpose and a legitimate legal basis for doing so. The table below summarises our primary processing activities.

Data Sharing

db67 does not sell, rent, or trade your personal data to any third party. We share personal data only in the following strictly controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, and other supported payment providers receive the minimum transaction data necessary to process deposits and withdrawals on your behalf.
• Identity verification providers: Third-party KYC and AML screening services receive identity document data as required to complete age and identity verification mandated by our compliance obligations.
• Fraud prevention and security services: We may share IP addresses, device fingerprints, and account activity indicators with fraud detection providers to protect the integrity of the platform and prevent financial crime.
• Game content providers: Game providers such as Evolution Gaming, Pragmatic Play, Ezugi, Spribe, and Microgaming may receive your Player ID and session token in order to deliver their games within the db67 platform. These providers do not receive your full identity or payment data.
• Legal and regulatory authorities: db67 may disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law, court order, or legal process.
• Corporate transactions: In the event of a merger, acquisition, or sale of business assets, your personal data may be transferred as part of the transaction. Any successor entity would be required to honour the commitments made in this Policy.

All third-party processors engaged by db67 are contractually required to process data only on our documented instructions, to apply appropriate technical and organisational security measures, and to delete or return data once the processing relationship ends.

International Data Transfers

The db67 platform serves Players based in Bangladesh, and our primary data processing infrastructure is designed to keep data within secure, well-governed environments. However, some of our third-party service providers (including cloud infrastructure, game providers, and fraud prevention tools) may be located outside Bangladesh, which means that your personal data may be transferred to and processed in jurisdictions with different data protection frameworks.

Where such international transfers occur, db67 takes steps to ensure that your data receives an equivalent level of protection, including by entering into contractual agreements with service providers that impose data protection obligations consistent with this Policy. If you wish to obtain further information about the safeguards we apply to international transfers, please contact [email protected].

Data Retention

db67 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer periods as are required or permitted by applicable law. Our standard retention periods are as follows:

When data reaches the end of its applicable retention period, it is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Anonymised and aggregated analytics data may be retained indefinitely as it no longer constitutes personal data.

Cookies and Tracking Technologies

db67 uses cookies and similar tracking technologies (such as pixel tags and local storage objects) to support platform functionality, maintain security, and analyse usage patterns. The types of cookies we use are described below:

• Strictly Necessary Cookies: These are essential for the operation of the db67 platform. They maintain your logged-in session state, remember your preferences within a session, and support security functions including CSRF protection. These cookies cannot be disabled without impairing core platform functionality.
• Performance and Analytics Cookies: These cookies collect information about how Players use the db67 platform — which pages are visited most frequently, where errors occur, and how navigation flows are completed. The data collected is aggregated and anonymous. db67 uses this information solely to improve platform performance and user experience.
• Functional Cookies: These cookies remember choices you have made on the platform — such as language preferences and responsible gaming tool configurations — so that you do not have to re-enter them on each visit.
• Fraud Prevention Cookies: These cookies support our ability to detect and prevent fraudulent account activity, multi-accounting, and bot traffic. They collect device and browser fingerprint data for security purposes only.

db67 does not use third-party advertising cookies or behavioural tracking cookies for the purpose of serving targeted advertisements on external websites.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing the db67 platform. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

Your Data Rights

As a data subject whose personal data is processed by db67, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact [email protected] with the subject line "Data Privacy Request — [Your Username]".

• Right of Access: You have the right to request a copy of the personal data that db67 holds about you, together with information about how and why it is being processed. We will respond to access requests within 10 business days.
• Right to Rectification: If any personal data db67 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details directly through your Account Settings.
• Right to Erasure: You may request that db67 delete personal data that is no longer necessary for the purposes for which it was collected. Please note that this right does not apply where retention is required by applicable law (for example, AML and financial record-keeping obligations).
• Right to Restriction of Processing: In certain circumstances — for example, where you have contested the accuracy of data or where processing is unlawful but you prefer restriction to erasure — you have the right to request that db67 restrict its processing of your data.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive the personal data you provided to db67 in a structured, commonly used, machine-readable format.
• Right to Object: Where db67 processes your data on the basis of legitimate interests, you have the right to object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Children's Privacy

The db67 platform is strictly intended for persons aged 21 years and above. db67 does not knowingly collect, store, or process personal data relating to individuals under the age of 21. Age verification is conducted as part of the KYC process before any withdrawal is approved.

If db67 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all winnings will be voided, and any deposited real-money funds will be returned in accordance with our underage account procedure. All associated personal data will be securely deleted as soon as retention obligations permit.

If you have reason to believe that a person under the age of 21 has registered an account on the db67 platform, please notify us immediately at [email protected] with the subject line "Underage Account Report". We will treat all such reports with strict confidentiality and act promptly.

Security Measures

db67 applies comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security framework includes the following measures:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the db67 platform is encrypted in transit using 256-bit SSL/TLS. This applies to account login, deposits, withdrawals, and all support communications conducted through the db67 interface.
• Encrypted Data Storage: Sensitive personal data — including identity document data, payment wallet numbers, and KYC records — is stored in encrypted form at rest using AES-256 encryption.
• Access Controls: Access to personal data within db67's internal systems is governed by role-based access control. Only personnel with a documented operational need to access specific categories of data are authorised to do so. All internal access is logged and audited.
• Two-Factor Authentication: db67's internal administrative systems require multi-factor authentication for all staff accessing Player data environments.
• Intrusion Detection and Monitoring: db67 employs real-time intrusion detection systems, server-level security monitoring, and automated anomaly detection to identify and respond to potential security incidents without delay.
• Security Incident Response: In the event of a personal data breach that poses a risk to Players, db67 will notify affected Players without undue delay and will take all reasonable steps to contain and remediate the breach. db67 will also fulfil any applicable legal notification obligations.

Notwithstanding these measures, no digital platform can guarantee absolute security against all threats. Players are encouraged to protect their own account security by using a strong, unique password, enabling two-factor authentication where available, and contacting support immediately if they suspect unauthorised access to their account.

Marketing Communications

db67 may send Players promotional communications about bonuses, new games, seasonal offers (such as Eid specials, Pohela Boishakh promotions, or BPL season offers), and platform updates. All promotional communications are subject to the Player's consent, which is collected at the time of registration and can be managed at any time thereafter.

Players who wish to opt out of marketing communications may do so by:

• Updating their communication preferences in Account Settings → Notifications;
• Clicking the unsubscribe link included in any db67 marketing email; or
• Contacting [email protected] with the subject line "Marketing Opt-Out — [Your Username]".

Opting out of marketing communications does not affect the delivery of transactional communications, which include deposit and withdrawal confirmations, account security alerts, KYC verification requests, and responsible gaming notifications. These transactional messages are sent on the basis of contract performance and cannot be disabled while an account remains active.

Third-Party Links

The db67 platform may contain references to third-party service names such as bKash, Nagad, Evolution Gaming, and Pragmatic Play. These are operational partners integrated within the db67 platform rather than separate external destinations that Players are redirected to for independent browsing.

Where any outbound link or redirection to a third-party website does occur (for example, if a game provider operates its own dedicated help page), db67 is not responsible for the privacy practices or content of those third-party destinations. Players should review the privacy policies of any third-party websites they visit independently of the db67 platform. This Policy governs only the data processing activities carried out by db67 in connection with the db67 platform.

Policy Updates

db67 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. Where an update is material — for example, where we add a new category of data collection, a new processing purpose, or a new third-party processor — we will notify registered Players via email and by posting a prominent notice on the db67 platform before the change takes effect.

The "Last Updated" date displayed at the top of this Policy reflects the most recent revision. The current version of this Policy is always the version published at db67.io/privacy-policy. Players who continue to use the db67 platform after the effective date of a revised Policy are deemed to have accepted the updated terms. If you do not accept a material update to this Policy, you should cease using the platform and contact support to request account closure.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which db67 processes your personal data, please contact us using the following details:

• Email: [email protected] — use subject line "Data Privacy Request — [Your Username]"
• Response time: Within 10 business days for formal data rights requests; within 2–6 hours for general privacy queries via email (BST, UTC+6)
• Live Chat: Available 24/7 via your logged-in db67 Account dashboard for immediate privacy-related queries
• Coverage: db67 serves Players across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar

db67 takes all privacy concerns seriously and is committed to responding to every query fully and promptly. Where a concern cannot be resolved through direct contact with our support team, you may escalate the matter in writing to [email protected] with the subject line "Formal Privacy Complaint" and db67 will provide a substantive written response within 10 business days.