bdromey Privacy Policy
— How We Protect Your Data

1 Data We Collect

bdromey collects personal data from players through several distinct channels: directly during account registration, through your ongoing use of the platform, through KYC verification processes, through payment transactions, and automatically via your device and browser when you access the site. The categories of data we collect are set out below.

Registration and Account Data

When you create a bdromey account, we collect the following information:

• Full legal name
• Date of birth (to verify the 18+ age requirement)
• Bangladeshi mobile phone number
• Email address
• Username and encrypted password
• Residential city or division (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi)

KYC Verification Data

To comply with identity verification requirements and to process withdrawals above defined thresholds, bdromey may request the following additional documentation:

• A scanned or photographed copy of your National Identity Card (NID) or passport
• A selfie or live photo for biometric matching purposes (where required)
• Proof of address (e.g., a utility bill or bank statement dated within the last three months)
• Proof of payment method ownership (e.g., a screenshot of your bKash or Nagad account displaying your registered name and number)

Transaction and Financial Data

When you make deposits or withdrawal requests, we record the following data to process and reconcile transactions:

• Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard)
• Transaction reference numbers and timestamps
• Deposit and withdrawal amounts in Bangladeshi Taka (BDT)
• The last four digits of card numbers where applicable (full card numbers are never stored)

Usage and Behavioural Data

When you interact with the bdromey platform, we automatically collect technical and behavioural data to ensure the service operates correctly, to detect fraud, and to improve the user experience:

• IP address and approximate geographic location (city level)
• Device type, operating system, and browser version
• Session start and end times, pages visited, and features accessed
• Games played, bet amounts, and game session durations
• Login history including timestamps and device identifiers

2 How We Use Your Data

bdromey uses the personal data described above for clearly defined, legitimate purposes. We do not use your data for purposes that are incompatible with the reason it was originally collected. The primary purposes for which we process your personal data are as follows:

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, mobile number, email	Contractual necessity
Age verification (18+ compliance)	Date of birth, KYC documents	Legal obligation
Processing deposits and withdrawals	Transaction data, payment method details	Contractual necessity
Identity verification (KYC)	NID / passport, selfie, proof of address	Legal obligation
Fraud detection and prevention	IP address, device data, login history	Legitimate interest
Customer support communications	Name, email, account history	Contractual necessity
Responsible gaming monitoring	Betting patterns, session data, deposit history	Legal obligation & legitimate interest
Platform improvement and analytics	Aggregated, anonymised usage data	Legitimate interest
Promotional communications (opt-in only)	Email address, name	Consent

Marketing Communications

bdromey will only send you promotional emails, SMS notifications, or in-platform messages about bonuses, special offers, or new games if you have explicitly opted in to receive such communications during registration or through your account settings. You may withdraw your marketing consent at any time by updating your notification preferences in your account settings or by contacting our support team. Withdrawing marketing consent does not affect the lawfulness of processing based on consent before its withdrawal, and it does not affect essential service communications such as transaction confirmations or security alerts.

3 Data Sharing and Third Parties

bdromey does not sell, lease, or trade your personal data to any third party for commercial purposes. However, in order to operate the platform and deliver services to you, we share certain data with a limited set of trusted service providers and partners who process data strictly on our behalf and under our instructions.

Categories of Third-Party Recipients

• Payment processors: bKash, Nagad, Rocket, Upay, and card payment gateways (Visa, Mastercard) receive transaction data necessary to process deposits and withdrawals. These providers operate under their own regulatory frameworks and privacy policies.
• KYC and identity verification services: Specialised third-party KYC providers may process your identity documents and biometric data to verify your identity on our behalf. These providers are contractually bound to process your data only for KYC purposes.
• Game software providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session and betting data to deliver their games. The data shared is limited to what is technically required to run the game session.
• Cloud infrastructure and hosting providers: bdromey uses secure, enterprise-grade cloud hosting services to store platform data. These providers operate under strict data processing agreements and do not have independent access to your personal data.
• Fraud prevention and cybersecurity services: We use specialised security tools that process IP address data and behavioural signals to detect and block fraudulent activity in real time.

Legal Disclosures

bdromey may disclose personal data to government bodies, law enforcement agencies, or regulatory authorities where we are required to do so by applicable law, court order, or lawful regulatory request. In such cases, we disclose only the minimum data required to satisfy the legal obligation. Where permitted by law, we will notify the affected account holder of the disclosure request.

4 Cookies and Tracking Technologies

bdromey uses cookies and similar browser-based storage technologies to ensure the platform functions correctly, to keep you securely logged in during your session, and to gather aggregated, anonymised data about how the platform is used. This section explains the types of cookies we deploy and the purpose of each.

Types of Cookies Used

Cookie Type	Purpose	Duration
Strictly Necessary	Session management, authentication tokens, security (CSRF protection), load balancing	Session / up to 24 hours
Functional	Remembering your language preference, last-visited game category, and responsible gaming settings	Up to 30 days
Analytics	Aggregated page-view counts, feature usage statistics, error reporting — all data is anonymised before processing	Up to 13 months

What We Do Not Use

bdromey does not use third-party advertising cookies, behavioural profiling cookies, social media tracking pixels, or any other technology designed to build a profile of your interests for the purpose of targeted advertising. We do not allow third-party advertising networks to place cookies on the bdromey platform.

Managing Cookies

You can control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in and using the platform, as these cookies are essential for session management and security. Disabling functional or analytics cookies will not prevent you from accessing core platform features but may result in a slightly less personalised experience.

5 Data Retention and Storage

bdromey retains your personal data for as long as your account remains active and for such additional periods as are required to meet our legal, regulatory, and contractual obligations. The following retention periods apply:

• Account registration data: Retained for the duration of your active account plus a minimum of five years following account closure, in accordance with applicable financial record-keeping obligations.
• KYC identity documents: Retained for a minimum of five years from the date of submission or from account closure, whichever is later, as required by anti-money laundering regulations.
• Transaction records: Retained for a minimum of seven years from the date of each transaction, in line with standard financial record-keeping requirements.
• Customer support communications: Retained for three years from the date of the last interaction, to facilitate resolution of any future disputes.
• Usage and session data: Retained in identifiable form for up to 13 months. Older data is anonymised and may be retained in aggregated form for analytical purposes indefinitely.

Data Storage Location

All personal data collected from bdromey players is stored on secure servers. Data at rest is encrypted using industry-standard AES-256 encryption. Backups are performed regularly and stored with equivalent security controls. bdromey does not transfer your personal data to countries that do not provide an adequate level of data protection without implementing appropriate safeguards such as contractual data protection clauses.

6 Data Security Measures

bdromey takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. The following measures are in place across the platform at all times.

Technical Safeguards

• TLS/SSL encryption: All data in transit between your device and bdromey's servers is encrypted using Transport Layer Security (TLS 1.2 or higher). Our SSL certificate is maintained and renewed proactively.
• Password hashing: Player passwords are never stored in plain text. They are stored as salted cryptographic hashes using bcrypt, meaning that even in the event of a data breach, passwords cannot be reversed from stored values.
• Two-factor authentication (2FA): SMS-based 2FA is available for all player accounts and is strongly recommended. For accounts holding significant balances, 2FA activation may be required before processing large withdrawals.
• Intrusion detection and monitoring: bdromey's infrastructure is monitored continuously for anomalous access patterns, intrusion attempts, and suspicious activity. Automated alerts trigger immediate review by our security team.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. Only authorised personnel whose role requires access to specific categories of data are granted that access, and all internal access is logged.

Organisational Safeguards

• All staff with access to personal data are trained on data protection principles and security protocols.
• Third-party service providers are vetted for security compliance before being granted access to any player data.
• A formal incident response procedure is in place. In the event of a data breach that affects player personal data, affected players will be notified promptly.

7 Your Privacy Rights

As a bdromey player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact our support team via live chat or by emailing [email protected] (plain text — not a clickable link). We will acknowledge all valid requests within five business days and complete them within 30 calendar days.

Right of Access

You have the right to request a copy of all personal data that bdromey holds about you. Upon receipt of a verified access request, we will provide a structured summary of your data in a readable format, including the categories of data held, the purposes for which it is processed, and the recipients with whom it has been shared.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain data fields — such as your registered name and date of birth — correction requests will require re-submission of supporting KYC documentation to confirm the accurate information.

Right to Erasure

You may request deletion of your personal data where: the data is no longer necessary for the purpose it was collected; you withdraw consent and no other lawful basis applies; or the data has been processed unlawfully. Please note that bdromey cannot delete data that is subject to mandatory legal retention periods (such as KYC records and transaction histories), and deletion requests will be fulfilled subject to these constraints.

Right to Restrict Processing

In certain circumstances — for example, while you contest the accuracy of data we hold — you have the right to request that we restrict how your data is used, without necessarily deleting it.

Right to Object to Marketing

You have an absolute right to object to the processing of your personal data for direct marketing purposes. Upon receipt of a marketing opt-out request, we will cease all marketing communications to you within two business days. This right can also be exercised at any time through your account notification settings without contacting support.

Right to Data Portability

You may request that bdromey provide your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) so that you can transfer it to another service provider if you choose.

8 Policy Updates and Contact

Updates to This Privacy Policy

bdromey reviews and updates this Privacy Policy periodically to reflect changes in our data practices, changes to the services we offer, and developments in applicable law. When we make material changes — meaning changes that affect how we collect, use, or share your personal data in ways that may impact your rights — we will notify registered players via the email address associated with their account or through an in-platform notification displayed at the next login.

Minor updates that do not materially affect your privacy (such as clarifying existing descriptions or correcting typographical errors) may be made without individual notification. The effective date shown at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of bdromey following publication of a revised Policy constitutes acceptance of the updated terms.

Children and Underage Players

bdromey's services are strictly intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that an account has been created by or on behalf of a person under 18, we will immediately suspend the account, delete all associated personal data to the extent permitted by law, and return any deposited funds to the originating payment method. If you believe a minor has accessed or registered on bdromey, please contact our support team immediately so we can act without delay.

Contact for Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the bdromey data team through one of the following channels:

• Live Chat: Available 24/7 directly within the bdromey platform — the fastest way to reach our support team.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in the subject line of your message.

All privacy-related communications are handled by our dedicated compliance team. We treat every data rights request with the same care regardless of the complexity of the request or the volume of data involved. Players in Bangladesh are valued members of the bdromey community, and the protection of your personal data is a fundamental commitment of this platform.