bduu Privacy Policy

This Privacy Policy ("Policy") describes how bduu ("bduu", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "your", "the Player") who register an account, visit, browse, or otherwise interact with the bduu online gaming platform available at https://bduu.io and any related mobile applications or communication channels operated under the bduu brand.

By creating an account on bduu or by continuing to use the platform after this Policy has been made available to you, you acknowledge that you have read and understood how your personal data is handled. This Policy is incorporated by reference into the bduu Terms & Conditions, which constitute the full agreement between you and bduu governing your use of the platform.

This Policy applies to all personal data processed by bduu regardless of the channel through which it was collected — whether via the website, mobile browser, customer support interactions, marketing communications, or third-party payment platforms. It does not apply to third-party websites that may be linked to or from the bduu platform; those third parties operate their own independent privacy policies.

For the purposes of applicable data protection law, bduu acts as the data controller in respect of the personal data of its registered players and website visitors. As data controller, bduu determines the purposes for which personal data is processed and the means by which that processing is carried out.

bduu operates as an international online gaming platform serving players including those based in Bangladesh. All formal data protection enquiries, subject access requests, and complaints regarding bduu's data handling practices should be directed to our support team using the contact details set out in Section 16 of this Policy.

bduu collects personal data across several categories depending on your level of engagement with the platform. The following table provides a comprehensive breakdown of the categories of personal data we collect and typical examples within each category.

bduu does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or health data unless specifically required for responsible gaming intervention purposes (for example, where a player self-reports a gambling addiction during a self-exclusion request), and only with the player's explicit consent.

bduu collects personal data through several distinct channels and mechanisms. Understanding how data reaches us helps you make informed choices about the information you share.

• Direct submission: Data you actively provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey or promotion.
• Automated technical collection: Data collected automatically as you use the platform, including IP address, device identifiers, browser characteristics, session logs, and in-platform behaviour patterns tracked via server-side logging and first-party analytics.
• Payment providers: When you use bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard to deposit or withdraw funds, the relevant payment provider shares transaction confirmation and basic identification data with bduu to complete the financial transaction and satisfy anti-money laundering requirements.
• Identity verification partners: Where bduu uses a third-party KYC service to verify the authenticity of identity documents, that service returns a verification result and associated data to bduu to complete the verification process.
• Cookies and tracking technologies: bduu's platform uses first-party cookies and similar tracking technologies for session management, fraud prevention, and platform performance optimisation. See Section 8 for full details.

bduu processes your personal data only where a valid legal basis exists for that processing. The following legal bases apply to bduu's data processing activities:

• Contractual necessity: Processing required to perform the contract between you and bduu — specifically, to operate your account, process deposits and withdrawals, deliver game services, and manage bonuses and promotions.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) checks, Know Your Customer (KYC) requirements, age verification, and fraud prevention obligations.
• Legitimate interests: Processing carried out for bduu's legitimate business interests where those interests are not overridden by your rights — for example, platform security monitoring, fraud detection, responsible gaming interventions, and improving the quality of the platform.
• Consent: Processing carried out based on your freely given, specific, and informed consent — primarily for direct marketing communications and optional analytics. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

Where processing is based on consent, bduu will make the consent mechanism clear at the point of collection and will maintain records of consent. Where processing is based on legitimate interests, bduu has carried out a balancing assessment and is satisfied that the processing is proportionate and does not unduly impact your rights.

bduu uses the personal data it collects for the following specific and clearly defined purposes:

• Creating, managing, and securing your bduu player account, including authentication and session management.
• Verifying your identity, age, and address to comply with KYC requirements and to prevent underage gambling — players must be 21 years of age or older.
• Processing deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, bank transfer, or card).
• Detecting and preventing fraud, money laundering, cheating, bonus abuse, and other forms of prohibited conduct as defined in the bduu Terms & Conditions.
• Personalising your platform experience, including recommending games based on your activity history and delivering relevant promotional offers where you have consented to receive them.
• Administering bonuses, promotions, and the bduu Black Diamond VIP Programme, including tracking qualifying activity and processing loyalty points.
• Communicating with you regarding your account status, transaction confirmations, security alerts, and platform updates via email or SMS.
• Supporting responsible gaming by monitoring for patterns of behaviour that may indicate problem gambling and enabling the delivery of responsible gaming tools including deposit limits, cooling-off periods, and self-exclusion.
• Improving the bduu platform through aggregated, anonymised analysis of usage data, game performance metrics, and customer satisfaction feedback.
• Complying with applicable legal, regulatory, and law enforcement requirements, including responding to valid legal requests for data disclosure.

bduu does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party. Personal data is shared with third parties only in the circumstances listed below, and always under contractual obligations that require those third parties to handle your data securely and in a manner consistent with this Policy.

• Payment service providers: bKash, Nagad, Rocket, Upay, DBBL, City Bank, BRAC Bank, Visa, and Mastercard receive the minimum data necessary to process your financial transactions. Each provider operates under its own privacy policy and applicable financial services regulations.
• KYC and identity verification services: Third-party verification partners receive copies of identity documents solely for the purpose of confirming your identity, age, and address. Verification results are returned to bduu and the documents are not retained by the verification provider beyond the period necessary to complete the check.
• Game software providers: Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised or pseudonymised session identifiers to deliver game content. They do not receive your full identity or payment data.
• Platform infrastructure and security providers: Cloud hosting, server management, and cybersecurity service providers who process data on bduu's behalf under strict data processing agreements.
• Law enforcement and regulatory authorities: bduu will disclose personal data to competent authorities when required to do so by a valid legal order, court process, or applicable law. Where permitted, bduu will notify the affected player of such a disclosure request.
• Business successors: In the event of a merger, acquisition, or transfer of bduu's business assets, personal data held by bduu may be transferred to the acquiring entity, subject to the same privacy protections set out in this Policy. Players will be notified of any such transfer in advance.

The bduu platform uses cookies and similar tracking technologies to provide a functional, secure, and personalised experience. Cookies are small text files stored on your device by your web browser when you visit the platform.

bduu uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function correctly — for example, session authentication tokens, security tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing platform functionality.
• Functional cookies: Enable enhanced personalisation features such as remembering your preferred language, game display settings, and notification preferences between sessions.
• Analytics cookies: First-party cookies used to collect anonymised data on how players interact with the platform — pages visited, time spent per session, and navigation paths. This data is used exclusively to improve platform performance and user experience. bduu does not use third-party advertising analytics platforms.
• Security cookies: Used to detect and prevent fraudulent activity, including recognising unusual login locations, detecting bot activity, and flagging account access from previously unseen devices.

You can control cookie settings via your browser preferences. Please note that disabling strictly necessary cookies will prevent you from logging into or using core features of the bduu platform. Disabling functional or analytics cookies will not prevent you from using the platform but may affect the quality of your experience.

bduu retains personal data only for as long as is necessary to fulfil the purpose for which it was collected or as required by applicable legal or regulatory obligations. The following general retention periods apply:

When personal data is no longer required and no legal obligation mandates its continued retention, bduu will securely delete or anonymise the data using industry-standard methods that prevent recovery or reconstruction.

bduu implements a comprehensive set of technical and organisational security measures to protect the personal data it holds against unauthorised access, accidental loss, destruction, alteration, and disclosure. These measures are reviewed and updated regularly to reflect evolving security standards and threat landscapes.

• All data in transit between your device and the bduu platform is encrypted using 256-bit TLS/SSL protocols.
• All stored personal data is encrypted at rest using AES-256 encryption on secure, access-controlled servers.
• Access to personal data within bduu's systems is restricted to authorised personnel on a strict need-to-know basis, governed by role-based access controls.
• All staff with access to personal data undergo regular data protection and security awareness training.
• bduu operates continuous monitoring of its platform infrastructure to detect and respond to security incidents, including intrusion detection systems and automated anomaly alerts.
• Regular penetration testing and vulnerability assessments are conducted by independent security specialists.
• In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, bduu will notify affected players without undue delay and in accordance with applicable legal requirements.

As a data subject, you have a number of rights in relation to the personal data that bduu holds about you. bduu is committed to facilitating the exercise of these rights in a timely and transparent manner. The following rights are available to all bduu players:

• Right of access: You have the right to request a copy of all personal data bduu holds about you, along with information about how that data is used. This is commonly known as a Subject Access Request (SAR).
• Right to rectification: If any personal data bduu holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic account details directly through your account settings panel.
• Right to erasure ("right to be forgotten"): You may request that bduu delete your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no other legal basis applies. Note that bduu may be required to retain certain data under AML and regulatory obligations even after account closure.
• Right to restrict processing: You may request that bduu restrict the processing of your personal data in specific circumstances — for example, while a disputed data accuracy issue is being resolved.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to direct marketing, bduu will cease processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request". Please include your registered email address and a clear description of the right you wish to exercise. bduu will respond within 5 business days of receipt of a complete and valid request. In complex cases, the response period may be extended, in which case you will be notified of the extension and its reason.

bduu sends marketing communications — including promotional offers, bonus announcements, VIP programme updates, seasonal campaign notifications (for example, Eid, Pohela Boishakh, BPL season), and platform news — only to players who have explicitly opted in to receive such communications at the time of registration or through their account settings.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in every marketing email sent by bduu.
• Adjusting your communication preferences in the notification settings section of your bduu account panel.
• Contacting [email protected] with a written request to be removed from all marketing communications.

Please allow up to 5 business days for opt-out requests to take effect across all communication channels. Opting out of marketing communications will not affect transactional communications such as account security alerts, deposit confirmations, withdrawal notifications, and KYC status updates — these are sent regardless of marketing preference as they are necessary for the proper administration of your account.

bduu does not engage in unsolicited cold marketing. We do not purchase third-party marketing lists or contact individuals who have not registered a bduu account. All marketing is directed exclusively at existing registered players who have provided valid consent.

The bduu platform is strictly restricted to individuals who are 21 years of age or older. bduu does not knowingly collect, process, or store personal data relating to any individual under the age of 21. Age verification is a mandatory step of the account registration process and is reinforced through the KYC verification procedure.

If bduu becomes aware — through its own verification processes, a third-party report, or any other means — that personal data has been collected from or in connection with an individual under the age of 21, bduu will take all of the following steps without delay:

• Immediately suspend and permanently close the relevant account.
• Reverse any deposits or transactions associated with the account in accordance with applicable payment processing rules.
• Securely and permanently delete all personal data associated with the account from all active systems.
• Document the incident for internal compliance records.

If you are a parent or guardian and believe that your child under the age of 21 has created an account on bduu or submitted personal data through the platform, please contact [email protected] immediately with the subject line "Underage Account Report". bduu takes such reports with the utmost seriousness and will act promptly upon receipt.

bduu operates as an international online gaming platform and, as a result, your personal data may be transferred to, stored on, or processed by systems located in countries outside of Bangladesh. This may occur when bduu uses cloud infrastructure providers, KYC verification services, or game content providers whose servers are located in other jurisdictions.

Where personal data is transferred internationally, bduu takes all reasonable steps to ensure that an adequate level of data protection is maintained, including through the use of contractual safeguards such as standard data protection clauses incorporated into agreements with all relevant third-party processors.

bduu does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards. If you have concerns about a specific international transfer of your personal data, please contact [email protected] for further information.

bduu reserves the right to update, amend, or replace this Privacy Policy at any time in response to changes in applicable law, developments in data protection best practice, changes to the bduu platform, or changes to bduu's data processing activities. The most current version of this Policy will always be published at https://bduu.io/privacy-policy.

Where a proposed change to this Policy is material — meaning it significantly affects your rights or how bduu uses your personal data — bduu will notify registered players in advance via the email address associated with their account or through a prominent notice on the platform. Continued use of the bduu platform following the effective date of a revised Policy constitutes your acknowledgement of the revised terms.

bduu recommends that you review this Privacy Policy periodically to remain informed about how your personal data is being handled. If you disagree with any material change to this Policy, you are entitled to close your account and request the deletion of your personal data in accordance with the procedures set out in Section 11.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which bduu handles your personal data, please contact the bduu data protection team using the details below. All correspondence must be submitted in writing.

bduu takes all privacy complaints seriously and will investigate each complaint thoroughly and impartially. Where a complaint is found to have merit, bduu will take all appropriate remedial steps and inform you of the outcome and any actions taken.

If you are dissatisfied with bduu's response to your complaint, you may have the right to escalate the matter to a relevant data protection supervisory authority in your jurisdiction. bduu will cooperate fully with any such authority in connection with any investigation arising from a player complaint.

This Privacy Policy was last reviewed on 1 January 2026. bduu is committed to maintaining transparent, lawful, and fair data processing practices for all players. Thank you for trusting bduu with your personal information.