Privacy Policy — td333 Data Protection Commitment

1 Introduction

td333 operates Bangladesh's trusted online betting platform at td333.io, providing cricket betting, live casino games, slot titles, crash games, and a range of instant-win products to players across Bangladesh. As a platform that handles real financial transactions and personal account data, td333 takes its data protection responsibilities seriously.

This Privacy Policy sets out in plain, accessible English the information td333 collects from you, the purposes for which it is used, the parties with whom it may be shared, the security measures in place to protect it, and the rights you have in relation to your own data. We have written this document to be as clear and direct as possible so that every td333 player — whether accessing the platform from Dhaka, Chittagong, Sylhet, Khulna, or anywhere else in Bangladesh — understands exactly what happens to their personal information.

Where this Policy refers to "the Platform", it means the td333 website and all sub-pages, features, and services accessible at td333.io. Where it refers to "you" or "the Player", it means any individual who visits, registers on, or uses the Platform in any capacity.

2 Data We Collect

td333 collects personal data in several categories depending on how you interact with the Platform. The table below summarises the types of data collected and the context in which each arises:

td333 does not intentionally collect or store sensitive personal data beyond what is necessary for identity verification and anti-money-laundering (AML) compliance. We do not collect biometric data other than document photographs submitted for KYC purposes, and we do not collect health or religious affiliation data.

3 How We Collect Your Data

td333 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide yourself when completing the registration form, updating your profile, submitting a KYC document, making a deposit or withdrawal request, or contacting the support team.
• Automated technical collection: Data generated automatically when you visit the Platform, including your IP address, browser fingerprint, session timestamps (recorded in Bangladesh Standard Time, UTC+6), and device identifiers. This data is collected via server logs and first-party analytics tools.
• Cookies and similar technologies: Small data files stored on your device that help td333 maintain your session, remember your preferences, and analyse aggregate usage patterns. See Section 7 for full details on cookie usage.
• Third-party payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and card network processors when you complete a deposit or withdrawal. td333 receives transaction reference IDs and status codes, not your full payment account credentials.
• Identity verification providers: Where td333 uses a third-party KYC service to assist with document verification, that service returns a verification result (pass/fail) and a risk score. The underlying document image is handled by the KYC provider under their own data protection policies.
• Game providers: Aggregate game-round data from third-party providers (including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi) is received by td333 for the purposes of account settlement, dispute resolution, and responsible gaming monitoring.

4 How We Use Your Data

td333 processes your personal data only for specified, legitimate purposes. The primary purposes for which your data is used are as follows:

• Account creation and management: Registering your account, verifying your identity and age (21+ requirement), managing your profile, and maintaining your account security.
• Service delivery: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and card networks; settling bets and game outcomes; applying bonuses and promotions; and maintaining your bet and transaction history.
• Customer support: Responding to your queries, complaints, and support requests through live chat and email correspondence. Support interactions are logged to maintain service quality and audit trails.
• Legal and regulatory compliance: Fulfilling our anti-money-laundering (AML) and know-your-customer (KYC) obligations, including transaction monitoring, suspicious activity detection, and the retention of records as required by applicable legal standards.
• Responsible gaming: Monitoring your betting patterns to identify signs of problem gambling behaviour and proactively offering responsible gaming tools such as deposit limits, session controls, and self-exclusion options.
• Platform security: Detecting and preventing fraud, unauthorised account access, multi-accounting, bot activity, and other prohibited behaviours as defined in the Terms & Conditions.
• Platform improvement: Analysing aggregate usage data to improve the performance, layout, and content of the td333 Platform for all Bangladeshi players.
• Marketing communications (where opted in): Sending promotional offers, bonus notifications, and event-based messages (for example, Eid bonuses, BPL promotions, Pohela Boishakh specials) via SMS or email to Players who have explicitly opted in to receive marketing. You may opt out at any time.

5 Legal Basis for Processing

td333 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform the contract between you and td333 — specifically, creating your account, accepting your bets, processing payments, and delivering the Services as described in the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable AML, KYC, data retention, and reporting obligations under applicable law.
• Legitimate interests: Processing carried out in td333's legitimate interests — including fraud prevention, platform security, responsible gaming monitoring, and service improvement — where those interests are not overridden by your rights and interests.
• Consent: Processing of your data for direct marketing purposes, where you have given your explicit, informed consent. You may withdraw this consent at any time by updating your marketing preferences in the account dashboard or by contacting support.

6 Data Sharing & Disclosure

td333 does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes. Your data may be shared with the following categories of recipients solely to the extent necessary to deliver, secure, and legally operate the Services:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa, Mastercard, and their underlying network partners receive the minimum transaction data required to process your deposits and withdrawals.
• Game providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and other certified game studios receive a pseudonymous Player identifier and bet/stake data for the purposes of game-round settlement and dispute resolution.
• Identity verification providers: Third-party KYC services receive identity documents you submit during verification. These providers are contractually bound to handle your documents securely and to use them solely for the KYC purpose.
• IT and infrastructure providers: Hosting, cloud storage, content delivery, and cybersecurity vendors who process data on td333's behalf under strict data processing agreements.
• Legal and regulatory authorities: Law enforcement agencies, financial intelligence units, or regulatory bodies where td333 is required by law, court order, or regulatory instruction to disclose data.
• Professional advisors: Legal counsel, auditors, and accountants bound by professional confidentiality obligations, where necessary for td333's corporate governance and legal compliance.

7 Cookies & Tracking Technologies

td333 uses cookies and similar tracking technologies to operate the Platform effectively. Cookies are small text files stored on your browser or device. They do not contain executable code and cannot carry viruses or install malware.

The following categories of cookies are used on the td333 Platform:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as display settings and remember your logged-in status across browser sessions. Disabling these cookies will require you to log in on every visit.
• Analytics cookies: Collect aggregate, anonymised data about how Players use the Platform — which pages are most visited, how long sessions last, and which features are most used. This data helps td333 improve the player experience. No individual player is identified through analytics data.
• Security cookies: Help td333 detect suspicious login attempts, rate-limit automated traffic, and enforce geographic access controls.

td333 does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings. Note that blocking strictly necessary cookies will prevent you from accessing your account.

8 Data Retention

td333 retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's active lifetime plus a minimum of five years following account closure, to comply with financial recordkeeping requirements.
• Transaction records: All deposit, withdrawal, and bet records are retained for a minimum of five years from the date of the transaction, in compliance with AML recordkeeping obligations.
• KYC and identity documents: Retained for a minimum of five years following the date of submission or the date of account closure, whichever is later.
• Support communications: Chat transcripts and email correspondence are retained for three years from the date of the interaction for quality assurance and dispute resolution purposes.
• Technical and usage logs: Server logs and session activity data are retained for 12 months for security monitoring and fraud detection purposes, after which they are securely deleted or anonymised.
• Marketing data: Where you have opted in to marketing, your preferences and interaction records are retained until you opt out. Upon opt-out, marketing data is deleted within 30 days.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the resulting anonymous dataset no longer constitutes personal data and is not subject to the terms of this Policy.

9 Data Security

td333 employs a comprehensive, layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or mobile device and td333's servers is encrypted using 256-bit SSL/TLS, the same encryption standard used by major Bangladeshi banks including Dutch-Bangla Bank, City Bank, and BRAC Bank.
• Encrypted data storage: Sensitive fields — including payment account identifiers and KYC document references — are encrypted at rest using AES-256 encryption within td333's database infrastructure.
• SMS OTP two-factor authentication: New device logins trigger an SMS one-time password (OTP) to your registered mobile number. Players are strongly encouraged to keep their registered mobile number current.
• Access controls: td333 internal staff access to player data is strictly role-based. Only personnel with a direct operational need are authorised to access specific categories of player data. All internal access is logged and audited.
• Intrusion detection and monitoring: td333's infrastructure is monitored 24/7 by automated intrusion detection systems. Anomalous access patterns trigger immediate alerts for manual review by the security team.
• Penetration testing: td333 conducts regular third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed data security incident, td333 will take immediate containment action and notify affected Players as promptly as practicable, detailing the nature of the incident, data categories affected, and the steps being taken to mitigate harm.

10 Your Rights

As a td333 player, you hold the following rights in relation to your personal data. To exercise any of these rights, contact the td333 support team with the subject line "Data Rights Request":

• Right of access: You may request a copy of the personal data td333 holds about you. td333 will provide this within a reasonable timeframe, subject to identity verification.
• Right to rectification: If any personal data td333 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain profile details directly from your account dashboard without needing to contact support.
• Right to erasure ("right to be forgotten"): You may request that td333 delete your personal data where it is no longer necessary for the purposes for which it was collected. Note that this right is subject to overriding legal retention obligations — in particular, AML recordkeeping requirements mean that transaction and identity data must be retained for the statutory minimum period regardless of a deletion request.
• Right to restrict processing: You may request that td333 restrict its processing of your data in certain circumstances, for example where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over deletion.
• Right to data portability: You may request that td333 provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to object: You may object to td333's processing of your data where that processing is based on legitimate interests. You also have an unconditional right to object to the use of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing that occurred prior to the withdrawal.

td333 will respond to all data rights requests within 30 days. In cases of complexity or high volume, this period may be extended by a further 30 days, in which case td333 will notify you of the extension and the reason for it.

11 Children & Minors

If td333 discovers or is informed that personal data belonging to a person under the age of 21 has been collected — for example, where a minor has provided false date-of-birth information during registration — td333 will immediately suspend the relevant account, delete the personal data of the minor as promptly as legally permissible, void any bets placed, and forfeit any balance accrued.

If you are a parent or guardian and believe that a person under 21 in your care has registered on the td333 Platform, please contact the support team immediately at [email protected] (plain text — not a link) so that the account can be closed and the minor's data can be appropriately handled.

12 Third-Party Links

The td333 Platform may contain references to third-party game providers, payment services, and other external services. While td333 takes care to partner only with reputable, established providers, this Privacy Policy applies solely to data processed by td333 itself. The privacy practices of third-party providers — including Evolution Gaming, Pragmatic Play, bKash, Nagad, and others — are governed by their own respective privacy policies, which td333 does not control.

td333 encourages you to review the privacy policies of any third-party service you interact with in connection with your use of the Platform. td333 accepts no responsibility for the data practices of third parties beyond the contractual obligations those parties owe to td333 as described in Section 6 of this Policy.

13 Policy Updates

td333 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, the "Last Updated" date at the top of this document will be revised, and td333 will notify active Players via in-account messaging or a prominent notice displayed on the Platform.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any change, you should cease using the Platform and contact support to close your account. It is your responsibility to review this Policy periodically to remain informed of how td333 handles your data.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data td333 holds about you, please contact the td333 support team using the details below. All contact details are provided as plain text and are not clickable links.

For matters relating to account security, responsible gaming tools, or self-exclusion, please visit the Responsible Gaming page or the FAQ page for detailed guidance.