bp44 Privacy Policy — Your Data, Your Rights

bp44 is Bangladesh's premier online casino and sports betting platform, accessible at bp44.io. We are committed to protecting the privacy and personal data of every player who uses our services. This Privacy Policy has been prepared to give you clear, honest, and complete information about how bp44 handles your data.

This Policy applies to all personal data collected through the bp44 website and any associated mobile or web applications, whether you are a registered player, a visitor browsing the site, or an individual who contacts our support team. It covers data collected online as well as data provided to us through other channels such as email communication.

This Privacy Policy should be read alongside bp44's Terms & Conditions and Responsible Gaming Policy, all of which together form the complete framework governing your relationship with bp44. Where any provision of this Policy conflicts with the Terms & Conditions, the Terms & Conditions shall take precedence in matters relating to account conduct, and this Policy shall take precedence in all matters relating to personal data processing.

For the purposes of this Privacy Policy, bp44 acts as the data controller in respect of all personal data collected from players and site visitors. As data controller, bp44 is responsible for determining the purposes and means by which your personal data is processed.

All data-related queries, access requests, deletion requests, and complaints should be directed to the bp44 data protection contact using the details set out in Section 15 of this Policy. bp44 will acknowledge all formal data-related requests within five business days and aim to resolve them within 30 days of receipt, or within such shorter period as may be required by applicable law.

bp44 collects personal data across several categories, depending on the nature of your interaction with the platform. The table below summarises the types of data collected and the context in which they are gathered:

bp44 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly required for identity verification purposes.

bp44 collects personal data through the following primary channels:

• Direct Provision: Information you provide voluntarily when you register an account, complete identity verification, make a deposit or withdrawal, contact support, or participate in a promotion.
• Automated Collection: Technical and usage data gathered automatically when you access the bp44 website or applications, including via cookies, server logs, and analytics tools. See Section 7 for full details on cookies.
• Payment Providers: Transaction confirmation data received from supported payment services including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank, used to verify and reconcile deposits and withdrawals.
• Identity Verification Partners: Where bp44 uses a third-party KYC (Know Your Customer) service to assist with document verification, data may be cross-referenced against official records to confirm your identity and age.
• Third-Party Game Providers: Aggregated game performance and session data from Game Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, used for platform optimisation and responsible gaming monitoring.
• Publicly Available Sources: In limited circumstances relating to fraud prevention or AML compliance, bp44 may reference publicly available information to supplement identity verification.

bp44 processes your personal data only where a clear, legitimate purpose exists and a valid legal basis applies. The table below outlines the key processing activities, their purposes, and the corresponding legal basis:

Where bp44 relies on legitimate interest as the legal basis for processing, we have assessed that our interests are not overridden by your rights and freedoms as a data subject, and that the processing is the least intrusive method available to achieve the stated purpose.

bp44 shares personal data with third parties only where strictly necessary for one of the following purposes, and only to the minimum extent required:

• Payment Processors: Transaction data is shared with your chosen payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, or BRAC Bank) solely for the purpose of processing your deposit or withdrawal instruction.
• Identity Verification (KYC) Services: Identity and document data may be shared with accredited KYC verification partners to confirm your identity, age, and eligibility to play.
• Game Providers: Limited technical and session data is shared with licensed Game Providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) to enable game delivery, resolve disputes, and maintain game integrity.
• Fraud Prevention and AML Services: Financial and identity data may be shared with specialist fraud prevention or anti-money-laundering screening services where required to fulfil bp44's compliance obligations.
• Legal and Regulatory Authorities: bp44 may disclose personal data to competent authorities, law enforcement agencies, or courts where required to do so by applicable law, regulation, or a valid legal order. bp44 will notify affected players of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of bp44's business operations, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and its impact on the processing of their data.

All third-party processors who receive bp44 player data are required to process that data only in accordance with bp44's written instructions and to maintain appropriate security standards no less stringent than those applied by bp44 itself.

bp44 uses cookies and similar tracking technologies to ensure the platform functions correctly, to measure site performance, and to deliver a personalised experience to players. The following categories of cookies are used on the bp44 platform:

• Strictly Necessary Cookies: Essential for the operation of the bp44 platform, including maintaining your login session, remembering your account preferences, and enabling secure payment flows. These cookies cannot be disabled without disrupting core platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how visitors interact with the bp44 website — including pages visited, session duration, and error events — to help bp44 improve platform performance and usability.
• Functional Cookies: Used to remember your preferences such as language settings, game history, and responsible gaming limits, so that your experience is consistent across sessions.
• Targeting and Personalisation Cookies: Used to tailor the content, promotions, and game recommendations presented to you based on your activity on the bp44 platform. These cookies are only set with your explicit consent.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to log in or use key platform features. bp44 does not use third-party advertising network cookies to track your activity across external websites.

bp44 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum period of five years following account closure, to satisfy AML record-keeping requirements.
• Financial Transaction Data: Retained for a minimum of five years following the date of each transaction, in compliance with financial record-keeping obligations.
• Communication and Support Data: Retained for three years from the date of the relevant communication, unless the communication relates to an ongoing dispute or legal matter, in which case it is retained until final resolution.
• Technical and Usage Data: Retained for up to 24 months from the date of collection, after which it is either deleted or anonymised so that it can no longer be associated with an individual player.
• Marketing Preference Data: Retained for the duration of your consent, plus 12 months following withdrawal of consent, to maintain a record of your opt-out instruction.

Upon expiry of the applicable retention period, personal data is securely and permanently deleted or anonymised in accordance with bp44's internal data destruction procedures. Anonymised, aggregated data that cannot be linked to any individual may be retained indefinitely for statistical and analytical purposes.

bp44 has implemented a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bp44 servers.
• Encrypted storage for sensitive data fields including payment account identifiers and identity document data.
• Role-based access controls ensuring that bp44 staff can only access personal data to the extent required for their specific job function.
• Multi-factor authentication (MFA) enforced for all internal bp44 staff accounts with access to player data systems.
• Comprehensive audit logging of all access to and modifications of personal data records.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Formal incident response procedures enabling rapid detection, containment, and notification in the event of a data security incident.

While bp44 takes every reasonable precaution to protect your data, no online platform can guarantee absolute security against all possible threats. You play an important role in keeping your account secure by choosing a strong, unique password and never sharing your login credentials or one-time passwords (OTPs) with any third party. bp44 staff will never ask you for your password or full OTP through any channel.

As a bp44 player, you hold a number of rights with respect to the personal data bp44 holds about you. These rights are summarised below. To exercise any of these rights, contact bp44's data protection team using the details in Section 15.

• Right of Access: You have the right to request a copy of the personal data bp44 holds about you, together with information about how it is processed. bp44 will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data bp44 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. This right is subject to bp44's legal retention obligations.
• Right to Restriction: You may request that bp44 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction to deletion.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, processing for that purpose will cease immediately.
• Right to Withdraw Consent: Where bp44 processes your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

All rights requests must be submitted to bp44 in writing to the contact details set out in Section 15. bp44 may request proof of your identity before processing a rights request to ensure that personal data is not disclosed to an unauthorised party. bp44 will not charge a fee for processing rights requests in ordinary circumstances.

bp44 operates a mandatory minimum age policy of 21 years. Our registration process requires players to confirm their age and to submit verifiable identity documentation confirming that they are 21 years of age or older. Where bp44 suspects or discovers that an individual under the age of 21 has registered an account, that account will be immediately closed and all associated personal data deleted, save where retention is required by law.

If you believe that a person under the age of 21 has accessed or registered on the bp44 platform, please contact our support team immediately at the details provided in Section 15 so that we can take prompt action.

bp44 may send you promotional communications, including information about new games, bonus offers, seasonal promotions (such as those tied to Eid, Pohela Boishakh, or the Bangladesh Premier League cricket season), and platform updates, provided that you have given your explicit opt-in consent to receive such communications during or after the account registration process.

You may withdraw your consent to receive marketing communications from bp44 at any time by:

• Updating your communication preferences within your bp44 account settings.
• Clicking the unsubscribe link included in any bp44 marketing email.
• Contacting bp44's support team directly and requesting removal from all marketing lists.

Withdrawal of marketing consent will take effect within five business days. Please note that transactional communications — including deposit confirmations, withdrawal notifications, verification requests, and responsible gaming alerts — are not marketing communications and will continue to be sent regardless of your marketing preferences, as they are required for the operation of your account.

bp44 does not engage in unsolicited SMS marketing or cold-call telephone marketing. Any communication purporting to be from bp44 that does not originate from the bp44.io domain or our registered communication channels should be treated as suspicious and reported to our support team.

The bp44 platform may contain references to or integrations with third-party services, including Game Providers and payment platforms. This Privacy Policy applies solely to the personal data collected and processed by bp44 in connection with your use of the bp44 platform. It does not apply to the privacy practices of any third-party service, website, or application that you may access in connection with bp44.

bp44 is not responsible for the privacy practices, security standards, or data processing activities of any third party, including Game Providers and payment processors. We encourage you to review the privacy policies of any third-party service before submitting personal data to them directly.

bp44 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. The "Last Updated" date at the top of this page will be revised whenever a material change is made to the Policy.

Where a change is material — meaning it significantly affects how we collect, use, or share your personal data, or significantly affects your rights as a data subject — bp44 will notify registered players via their registered email address or through a prominent notice on the bp44 platform before the change takes effect. We encourage you to review this Policy periodically to stay informed about how bp44 protects your data.

Your continued use of the bp44 platform following the effective date of any amendment to this Policy constitutes your acceptance of the updated terms. If you do not agree with any material change, you have the right to request account closure in accordance with the bp44 Terms & Conditions, and to request deletion of your personal data in accordance with Section 10 of this Policy.

If you have any questions, concerns, or formal requests relating to this Privacy Policy or bp44's processing of your personal data, please contact our data protection team. All privacy-related communications must be submitted in English and addressed to:

bp44 Data Protection Team
Email: support at bp44.io
Subject line: Data Privacy Request

Our support team is available 24 hours a day, 7 days a week, including during Bangladesh public holidays such as Eid, Victory Day (16 December), and Independence Day (26 March). We aim to acknowledge all privacy requests within five business days and to resolve them within 30 days of receipt.