Privacy Policy — 678bad Online Casino Bangladesh

1. Data Controller Identity

This Privacy Policy is issued by 678bad ("we", "us", "our"), the operator of the online gambling platform accessible at https://678bad.bio (the "Platform"). For the purposes of this Privacy Policy, 678bad acts as the data controller in respect of all personal data collected from players and visitors located in Bangladesh.

As data controller, 678bad determines the purposes for which and the means by which your personal data is processed. We are committed to processing your personal data in accordance with applicable data protection principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability.

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a suspected data breach, you may contact the 678bad privacy team directly using the following details:

2. Personal Data We Collect

678bad collects personal data from you through a number of channels: directly when you register an account, make a deposit or withdrawal, contact support, or use platform features; automatically when you browse and interact with the Platform; and in some cases from third-party verification partners as part of the KYC process. The categories of personal data we collect are described below.

678bad operates on the principle of data minimisation — we collect only the personal data that is genuinely necessary for the purposes described in this Policy. We do not collect sensitive categories of personal data (such as health data, religious beliefs, or biometric data) unless specifically required by applicable law or with your explicit prior consent.

3. How We Use Your Data

678bad uses the personal data we collect for clearly defined, legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we process your personal data are as follows:

• Account Creation and Management: To register your 678bad player account, verify your identity, maintain your account profile, and facilitate your ongoing use of the Platform including deposits, withdrawals, and game access.
• Payment Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and Bangladeshi bank transfers. Financial data is shared with payment processors only to the extent necessary to complete transactions.
• Identity Verification (KYC): To verify that you are who you claim to be, that you are at least 18 years of age, and that your payment methods are registered in your own name, as required by our anti-money laundering obligations.
• Platform Personalisation: To remember your account preferences, language settings, and gameplay history so that your 678bad experience is consistent and relevant to you.
• Customer Support: To respond to your support queries, complaints, and data subject requests. Support communications are retained to maintain a complete history of your interactions with 678bad.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, unauthorised account access, money laundering, and other security threats. This includes automated monitoring of account activity patterns.
• Responsible Gaming Compliance: To enforce deposit limits, time-out periods, and self-exclusion requests that you have placed on your own account, and to identify account activity patterns that may indicate problem gambling requiring intervention.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS, where you have provided consent to receive such communications. You may withdraw marketing consent at any time by contacting [email protected].
• Platform Analytics and Improvement: To understand how players use the 678bad platform, identify technical issues, improve game performance, and develop new features that better serve the Bangladesh market.
• Legal and Regulatory Compliance: To comply with applicable laws, respond to lawful requests from regulatory authorities, and enforce our Terms & Conditions.

678bad will never use your personal data for purposes of automated decision-making that produces legal or similarly significant effects on you, without first obtaining your explicit consent or establishing another lawful basis for doing so.

4. Legal Basis for Processing

678bad processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual Necessity: Processing that is necessary to perform our contract with you — i.e., to provide you with a functioning 678bad player account, process your transactions, and deliver the gambling services you have registered for.
• Legal Obligation: Processing that is required to comply with applicable legal obligations, including anti-money laundering (AML) requirements, age verification obligations, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing carried out in pursuit of 678bad's legitimate business interests, where those interests are not overridden by your privacy rights. Examples include fraud detection, platform security monitoring, and internal analytics.
• Consent: Processing that is based on your freely given, specific, and informed consent — primarily in the context of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Third Parties

678bad does not sell, rent, or otherwise commercially exploit your personal data. We share personal data with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard receive transactional data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently responsible for data they hold.
• Game Providers: Third-party game studios including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe receive certain technical and session data necessary to deliver their games to you via the 678bad platform. Game providers do not receive your full identity or financial profile.
• Identity Verification Partners: KYC verification partners may receive copies of identity documents and personal details for the purpose of confirming your identity and age. These partners are contractually bound to process your data only for the stated verification purpose.
• IT Infrastructure and Cloud Service Providers: 678bad uses secure cloud infrastructure and hosting services to operate the Platform. These providers process data on our behalf under strict data processing agreements and may not use your data for their own purposes.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, financial regulators, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of 678bad, its players, or third parties.
• Professional Advisers: Lawyers, auditors, and compliance consultants who provide services to 678bad may access personal data on a need-to-know basis, subject to professional confidentiality obligations.

Whenever 678bad shares personal data with a third-party processor, we ensure that appropriate contractual safeguards are in place to protect your data and restrict the processor to using your data only for the agreed purpose. We do not transfer personal data outside of secure, contractually protected arrangements.

6. Cookies & Tracking Technologies

The 678bad platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, to understand how players interact with the site, and to support fraud prevention systems. A cookie is a small text file placed on your device by a website you visit. It is stored in your browser and allows the site to recognise your device on return visits.

The cookies used by 678bad fall into the following categories:

You can manage or delete cookies at any time through your browser settings. Please note that disabling analytical or functional cookies may affect the quality of your experience on the 678bad platform — certain preferences may not be saved between sessions, and some platform features may behave differently. Disabling strictly necessary or security cookies may prevent you from logging in or using core platform functions altogether.

678bad does not use third-party advertising cookies or cross-site tracking cookies. We do not participate in real-time bidding, behavioural advertising networks, or any ad-tech systems that track your activity across external websites.

7. Data Retention Periods

678bad retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply to the main categories of personal data we hold:

• Active Account Data: Retained for the full duration of your account registration with 678bad, plus a period of up to 5 years after account closure to comply with anti-money laundering record-keeping requirements.
• KYC and Identity Verification Documents: Retained for a minimum of 5 years from the date of your most recent transaction on the Platform, in line with standard financial crime prevention record-keeping obligations.
• Transaction and Financial Records: Retained for 5 years from the date of each transaction. This applies to deposit records, withdrawal records, and bonus transaction logs.
• Support Communications: Retained for 3 years from the date of the relevant support interaction, or longer where the communication relates to an unresolved dispute or legal matter.
• Technical and Usage Data: Anonymised or aggregated after 12 months. Individual-level IP address logs are retained for a maximum of 12 months for security purposes.
• Marketing Consent Records: Retained for the duration of your consent plus 3 years following withdrawal of consent, as evidence of your marketing preferences.

When personal data is no longer required for any legitimate purpose, 678bad securely deletes or anonymises it. Secure deletion means that the data cannot be recovered or reconstructed after removal. Where full deletion is not immediately technically practicable (for example, where data is stored in backup systems), the data will be isolated from active processing until deletion is completed at the next scheduled backup purge cycle.

8. Data Security Measures

678bad takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our primary security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or mobile device and the 678bad platform is encrypted using 256-bit SSL/TLS protocols. This prevents interception of your data in transit.
• Encrypted Data Storage: Personal data and financial records stored on 678bad servers are encrypted at rest. Encryption keys are managed separately from the encrypted data and rotated on a regular schedule.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. 678bad staff members are granted access only to the categories of data required for their specific role. All access is logged and audited.
• Two-Factor Authentication: Internal systems that hold personal data require multi-factor authentication for staff access. We strongly recommend that players also enable two-factor authentication on their own 678bad accounts.
• Intrusion Detection and Monitoring: The 678bad platform is continuously monitored for suspicious activity, attempted intrusions, and anomalous data access patterns. Automated alerts are in place to flag potential security incidents for immediate investigation.
• Vendor Security Assessments: Third-party processors and technology partners who handle 678bad player data are required to demonstrate adequate security standards before being engaged and are subject to ongoing periodic review.
• Data Breach Response: In the event of a personal data breach, 678bad has an incident response procedure in place. Affected players will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms, together with guidance on protective steps they can take.

Whilst 678bad implements robust security measures, no internet-based platform can guarantee absolute security against all possible threats. You play an important role in keeping your account secure — please use a strong, unique password for your 678bad account, never share your login credentials with anyone, and contact [email protected] immediately if you suspect unauthorised access to your account.

9. Your Privacy Rights

As a 678bad player, you have a number of rights in relation to the personal data we hold about you. These rights are listed below along with guidance on how to exercise them. To submit any privacy rights request, please email [email protected] with "Privacy Request" in the subject line and a clear description of the right you wish to exercise.

• Right of Access: You have the right to request a copy of the personal data that 678bad holds about you, along with information about how it is being used. We will provide this information in a clear, structured format within 30 days of a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it. You can update basic account information directly from your account profile; for more complex corrections, contact the support team.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where you object to processing and there are no overriding legitimate grounds. Note that this right is subject to our legal retention obligations — certain data cannot be deleted until the mandatory retention period has elapsed.
• Right to Restriction of Processing: You may request that we temporarily restrict processing of your personal data while a dispute about its accuracy or the lawfulness of processing is resolved.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to have it transmitted to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. You also have an unconditional right to object to processing for direct marketing purposes — we will immediately cease all marketing communications upon receipt of such an objection.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

678bad will not charge a fee for handling privacy rights requests submitted in good faith. We aim to resolve all requests within 30 days. Where a request is unusually complex or requires extended processing time, we will notify you of the delay and the revised expected resolution date within the initial 30-day window.

10. Updates to This Policy

678bad may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the features and services available on the Platform. When we make material changes to this Policy — changes that substantially affect your rights or how your data is used — we will notify you by email to your registered address and by displaying a prominent notice on the 678bad platform before the changes take effect.

Minor or administrative changes (such as clarifications, corrections to typographical errors, or updates to contact details) may be made without prior notice. The effective date at the top of this page will always reflect when the current version of the Policy came into force.

We encourage you to review this Privacy Policy periodically so you remain informed about how 678bad protects and uses your personal data. If you continue to use the Platform after the effective date of a revised Privacy Policy, you acknowledge that you have read and understood the updated version. If you disagree with any changes to this Policy, you should discontinue your use of the Platform and contact [email protected] to request account closure.

All previous versions of this Privacy Policy are archived and available on request by contacting [email protected]. The archived version in force at the time of any relevant event will apply to disputes or queries relating to that event.