bdlucky Privacy Policy

bdlucky collects personal information from players in Bangladesh through several channels: during account registration, through ongoing use of the platform, via payment processing partners, and through automated technologies such as cookies and server logs. We only collect data that is necessary for the purposes described in this policy. We do not collect data beyond what is reasonably required to operate the platform and fulfil our legal and compliance obligations.

Registration and Account Data: When you create a bdlucky account, we collect the information you provide directly, including your chosen username, mobile phone number or email address, date of birth, and country of residence. If you proceed to full identity verification (KYC), we additionally collect your full legal name, national identification number (National ID or passport), and residential address as it appears on your supporting documents.

Payment and Transaction Data: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, we receive and store the information necessary to process and record the transaction. This includes your registered mobile money number (for bKash, Nagad, Rocket, Upay) or masked card number (for Visa and Mastercard), transaction reference numbers, amounts in BDT (৳), timestamps, and transaction status. We do not store full card numbers or mobile wallet PINs. Full payment credential processing is handled by our certified payment processing partners.

Gaming and Betting Activity Data: We maintain records of all bets placed, games played, outcomes, session durations, and wagering amounts associated with your account. This data is used for account management, dispute resolution, responsible gaming monitoring, and compliance purposes.

Technical and Device Data: When you access bdlucky.app, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device type, referring URL, pages visited within the platform, and session duration. This data helps us maintain platform security, detect unusual access patterns, and improve overall user experience.

Communications Data: If you contact bdlucky's support team by email at [email protected] or through the in-platform support interface, we retain records of your correspondence including the subject matter, message content, timestamps, and any resolution actions taken. This data is used to manage your support request, improve our service quality, and maintain an audit trail of account-related communications.

bdlucky does not sell, rent, or trade your personal data with any third party for commercial marketing purposes. We share personal data only with trusted service providers and partners where it is strictly necessary to deliver our services, meet our legal obligations, or protect the security of the platform.

Payment Processing Partners: To facilitate deposits and withdrawals, bdlucky shares the minimum necessary transaction data with our certified payment processing partners, including the mobile money networks operating bKash, Nagad, Rocket, and Upay, and the card network processors handling Visa and Mastercard transactions issued by Bangladeshi banks. These partners are contractually obligated to process your data solely for the purpose of completing the relevant transaction and are prohibited from using it for any other purpose.

Game Studio Providers: When you play a game supplied by a third-party studio such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, your game session data (including your player ID, wager amounts, and session timestamps) is transmitted to the relevant studio's servers for game delivery and outcome calculation. These studios operate under their own privacy and data security standards, which are a condition of bdlucky's licensing agreements with them. No additional personally identifiable information — such as your full name, address, or payment details — is shared with game studios.

Identity Verification Services: Where automated KYC document verification is used, your submitted identity documents may be processed by a certified third-party identity verification service. This processing is conducted under strict contractual data protection terms and is limited to verifying the authenticity of documents against official records.

Legal and Regulatory Disclosures: bdlucky may disclose your personal data to law enforcement authorities, government agencies, or regulatory bodies where we are required to do so by applicable law, court order, or legal process. We will not disclose data beyond what is strictly required by the specific legal request, and where legally permissible, we will notify the affected account holder of any such disclosure.

Business Transfers: In the event that bdlucky undergoes a merger, acquisition, or transfer of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of the transaction. In such circumstances, bdlucky will take reasonable steps to ensure that the acquiring entity honours the data protection commitments set out in this policy, and will notify affected users of the change via the contact details held on their account.

bdlucky takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. No system can guarantee absolute security, but bdlucky applies industry-standard best practices across every layer of the platform.

Encryption in Transit: All data exchanged between your browser or mobile device and bdlucky.app is encrypted using Transport Layer Security (TLS) with a minimum of 256-bit encryption. This ensures that your login credentials, payment details, and personal information cannot be intercepted during transmission.

Encryption at Rest: Sensitive data stored in bdlucky's databases — including hashed passwords, identity document references, and payment method identifiers — is encrypted at rest using AES-256 encryption. Passwords are never stored in plain text; they are processed through a one-way cryptographic hash function before storage, meaning bdlucky staff cannot retrieve or view your password.

Access Controls: Access to systems containing personal player data is restricted to bdlucky staff who require it to perform their specific job functions. All internal access is governed by role-based access controls, and access events are logged for audit purposes. Staff with access to sensitive data undergo mandatory data handling training.

• Regular security audits and penetration testing are conducted on the bdlucky platform infrastructure.
• Database access from the public internet is blocked at the network level; all database connections are made through private internal networks only.
• Player account activity is monitored in real time for patterns consistent with account compromise or unauthorised access.
• Automated alerts are triggered when anomalous login behaviour is detected, such as logins from unrecognised IP addresses or devices.

Data Breach Response: In the event of a confirmed data breach that poses a material risk to affected players, bdlucky will take immediate steps to contain the breach, notify affected account holders via their registered contact details without undue delay, and implement remediation measures to prevent recurrence. The nature of the breach, the categories of data affected, and the steps taken in response will be communicated clearly to affected players.

Data Storage Location: Player data is stored on servers located in data centres operating under internationally recognised security and compliance standards. Data processing is conducted within secure environments that implement physical access controls, environmental protections, and redundant backup systems to ensure data availability and integrity.

bdlucky retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or for as long as we are required to retain it under applicable legal and compliance obligations. The retention periods below represent the standard approach; specific circumstances may require shorter or longer retention in individual cases.

When a retention period expires, personal data is either securely deleted from active databases or, where technically necessary, anonymised so that it can no longer be linked to an identifiable individual. Anonymised data may be retained beyond the periods above for aggregate analytics and platform improvement purposes without restriction, as it no longer constitutes personal data.

If you request deletion of your account and personal data, bdlucky will process the deletion of data that is not subject to mandatory retention obligations within 30 calendar days of receiving and verifying your request. Data subject to mandatory retention (such as transaction records and KYC documents) will be retained for the applicable period as set out in the table above and then securely deleted at the end of that period.