de33 Privacy Policy

This Privacy Policy ("Policy") describes how de33 ("de33", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to individuals who access or use the de33 online casino and sports betting platform available at https://de33.io ("Platform"). It applies to all registered account holders, visitors to the Platform, and any individual whose personal data de33 processes in connection with the services it provides.

By registering a de33 account, completing identity verification, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy. This Policy is incorporated by reference into the de33 Terms & Conditions. Where terms are defined in the Terms & Conditions, they carry the same meaning in this Policy unless otherwise stated.

de33 acts as the data controller in respect of personal data collected through the Platform. As data controller, de33 is responsible for determining the purposes and means by which personal data is processed. All data-related requests, questions, or complaints should be directed to de33 using the contact details provided in Section 15 of this Policy.

de33 has appointed a designated data protection contact who oversees compliance with this Policy and handles data subject requests. This individual can be reached via the support email address listed in Section 15.

de33 collects personal data from you directly (information you provide during registration, KYC, or when contacting support) and automatically (data generated by your use of the Platform). The categories of personal data de33 collects are detailed in the table below.

de33 does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes, or health data, except where this information is voluntarily disclosed by a player in the context of a responsible gaming request (for example, disclosing a gambling addiction diagnosis to activate self-exclusion).

de33 uses the personal data described in Section 3 for the following purposes:

• Account creation and management: To register your account, verify your identity, maintain account records, and provide you with access to the Platform's services.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, Mastercard, and other supported payment methods.
• KYC and fraud prevention: To verify that you meet the eligibility criteria, detect and prevent fraudulent activity, money laundering, bonus abuse, and other forms of prohibited conduct.
• Customer support: To respond to your queries, process complaints, and provide assistance through live chat and email.
• Responsible gaming: To administer deposit limits, self-exclusion requests, cooling-off periods, and reality checks, and to identify accounts that may exhibit signs of problem gambling behaviour.
• Platform improvement: To analyse aggregated usage data and identify technical issues, improve game performance, optimise the user interface, and develop new features.
• Legal compliance: To comply with applicable anti-money laundering obligations, respond to lawful requests from authorities, and maintain records as required by law.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have provided explicit consent or where we have a legitimate interest to do so. You may opt out at any time by contacting support.

de33 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions and to deliver the services you have requested, including account management, payment processing, and game access.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, know-your-customer requirements, and lawful orders from competent authorities.
• Legitimate interests: Processing necessary for the legitimate interests of de33 or third parties, such as fraud prevention, platform security, responsible gaming monitoring, and internal analytics, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent, such as receiving marketing communications. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

de33 does not sell, rent, or transfer your personal data to third parties for their own commercial purposes. Personal data may be shared in the following limited circumstances:

• Payment processors: Financial data is shared with payment service providers (including bKash, Nagad, Rocket, Upay, and card networks) strictly to process your transactions.
• KYC and identity verification providers: Identity documents and personal identifiers may be shared with accredited third-party KYC verification services for the purpose of confirming your identity and screening against watchlists.
• Fraud and risk management services: Technical and usage data may be shared with fraud prevention platforms to identify and block suspicious activity patterns.
• Game software providers: Limited technical session data may be transmitted to third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) as necessary to deliver and maintain game functionality. These providers act as data processors and are contractually prohibited from using this data for any other purpose.
• Legal and regulatory authorities: de33 will disclose personal data to competent authorities where required to do so by law, court order, or other binding legal instrument.
• Business transfers: In the event of a merger, acquisition, or sale of assets involving de33, personal data may be transferred to the successor entity, subject to equivalent data protection obligations.

de33 uses cookies and similar technologies (including local storage and session tokens) on the Platform. The cookies de33 uses fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, load-balancing cookies, and security cookies. These cannot be disabled without breaking core Platform functionality.
• Performance and analytics cookies: Used to collect anonymised information about how players use the Platform — for example, which pages are visited most frequently and whether any errors occur. This data is aggregated and does not identify individual players.
• Fraud prevention cookies: Used to identify and block automated bots, account takeover attempts, and other malicious activity patterns.

de33 does not use advertising cookies, cross-site tracking cookies, or cookies from third-party advertising networks. You may manage browser-level cookie preferences through your browser's settings; however, disabling strictly necessary cookies will impair your ability to use the Platform.

de33 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The general retention principles de33 applies are as follows:

• Account and transaction data is retained for a minimum of five (5) years following account closure to comply with anti-money laundering record-keeping requirements.
• KYC documents are retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later.
• Customer support communications are retained for three (3) years from the date of the last interaction.
• Technical and usage data used for fraud prevention and analytics is retained in anonymised or pseudonymised form for up to two (2) years.
• Marketing consent records are retained until you withdraw consent, plus an additional period of one (1) year for compliance audit purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where legal proceedings or regulatory investigations are ongoing, data may be retained beyond the standard period until the matter is resolved.

de33 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• TLS 1.3 encryption on all data in transit between your device and de33's servers.
• AES-256 encryption for personal data at rest in de33's databases.
• Bcrypt hashing with per-account salts for all stored passwords.
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis.
• Comprehensive access logging and audit trails for all access to sensitive data systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Multi-factor authentication requirements for all de33 administrative system access.
• Formal incident response procedures including mandatory breach notification timelines.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights, de33 will notify affected players without undue delay and take all reasonable steps to mitigate the impact.

de33's primary data processing infrastructure is located in server facilities serving the South and Southeast Asian region. In some cases, data may be transferred to or accessed from systems located in other countries, for example when utilising the services of a globally operating KYC provider or game software studio.

Whenever personal data is transferred outside Bangladesh, de33 takes steps to ensure an equivalent level of protection is applied. This includes implementing contractual clauses with data recipients that require them to protect personal data to the same standard described in this Policy, and conducting due-diligence assessments of the data protection practices of all third-party processors before engagement.

As a de33 player, you have the following rights in respect of the personal data de33 holds about you. To exercise any of these rights, contact de33 at [email protected] with the subject line "Data Subject Request" and your account username.

• Right of access: You may request a copy of the personal data de33 holds about you, along with information about how it is used. de33 will provide this within 30 days of receiving a verified request.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data de33 holds. For account details, you may also update many fields directly within your account settings panel.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to de33's legal retention obligations; data that must be kept under anti-money laundering law cannot be deleted before the mandated retention period expires.
• Right to restriction: You may request that de33 restrict processing of your data in certain circumstances, for example while an inaccuracy is being investigated.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format where the processing is based on consent or contract.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. de33 will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

de33 will respond to all data subject requests within 30 calendar days. Where a request is complex or de33 receives a high volume of requests, this period may be extended by up to an additional 60 days, with notification provided to the requester. de33 will not charge a fee for reasonable requests but reserves the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

If you are a parent or guardian and believe that a minor has registered a de33 account or provided personal data to de33 without your knowledge, please contact de33 immediately at [email protected]. de33 will investigate and take appropriate action without delay.

The de33 Platform may contain references to or integrations with third-party services, including game studios and payment providers. These third parties operate under their own privacy policies, and de33 is not responsible for the data practices of third parties. de33 recommends that you review the privacy policies of any third-party service you interact with.

Where third-party game software is embedded within the de33 Platform, de33 contractually restricts those third parties from using any player data beyond what is strictly necessary to deliver game functionality. de33 does not permit game providers to use player data for their own marketing or analytics purposes without separate, explicit player consent.

de33 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, de33 will notify registered players by email or by displaying a prominent notice on the Platform for a minimum of seven (7) days prior to the revised Policy taking effect. The "Last Updated" date at the top of this document will always reflect the date of the most recent revision.

Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you should cease using the Platform and contact de33 to close your account.

For all privacy-related enquiries, data subject requests, or complaints, please contact de33 using the following details:

• Email: [email protected] — use the subject line "Privacy Request" or "Data Complaint" as appropriate.
• Live Chat: Available 24 hours a day, 7 days a week on the Platform. Average response time under 2 minutes.
• Response Time: de33 aims to acknowledge all privacy-related requests within 48 hours and to provide a full response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6).

If you are not satisfied with de33's handling of a data-related complaint after exhausting the internal complaints process, you may seek independent mediation or pursue any other legal remedy available to you under applicable law.