dd678 Privacy Policy — Your Data, Your Rights

This Privacy Policy ("Policy") describes how dd678 ("the Company", "we", "us", "our") collects, processes, stores, and protects personal data belonging to individuals ("you", "the Player", "the User") who access or use the dd678 online betting and gaming platform at dd678.io and any associated mobile interfaces or subdomains (collectively, "the Platform").

dd678 is committed to handling personal data responsibly and transparently. This Policy is intended to give you clear, honest information about our data practices so that you can make informed decisions about your use of the Platform. We encourage you to read this Policy in full before registering an account or providing us with any personal information.

By creating a dd678 account or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood its contents. If you do not agree with any part of this Policy, you should discontinue your use of the Platform and contact our support team to arrange account closure.

This Policy should be read alongside our Terms and Conditions, which together form the complete agreement governing your use of dd678. In the event of a conflict between this Policy and the Terms and Conditions on a privacy-related matter, this Policy shall take precedence.

dd678 collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and in limited circumstances from third-party verification and payment partners. The categories of personal data we may collect include:

• Registration Data: Your full legal name, date of birth, email address, and chosen username provided during account creation.
• Contact Information: Phone number and residential address, which may be required during the identity verification (KYC) process.
• Identity Verification Documents: Copies of government-issued identification such as a National ID Card (NID), passport, or driving licence, and proof-of-address documents submitted for KYC compliance.
• Financial Data: Information relating to the payment methods you use to deposit and withdraw funds on dd678, including mobile banking account references (e.g., bKash, Nagad, Rocket, Upay numbers) and transaction histories. Full payment credentials are handled by our payment partners and are not stored on dd678 servers.
• Transaction Records: Details of all deposits, withdrawals, wagers, game play, and bonuses associated with your account, including timestamps and amounts in Bangladeshi Taka (BDT).
• Device and Technical Data: IP address, browser type, operating system, device identifiers, screen resolution, and time-zone settings collected automatically when you access the Platform.
• Usage Data: Pages visited, features used, game sessions played, session duration, referring URLs, and navigation patterns within the Platform.
• Communications Data: The content and metadata of any messages you send to dd678 customer support via live chat, email, or any other communication channel.
• Responsible Gaming Data: Records of any self-exclusion requests, deposit limits, session limits, or cooling-off periods you have set on your account.

We do not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health data (beyond responsible gaming disclosures made voluntarily by you), or biometric data.

dd678 processes your personal data only for legitimate, specified purposes. The table below summarises our primary processing activities, the data categories involved, and the legal basis for each activity:

dd678 does not use your personal data for automated decision-making that produces significant legal or similarly significant effects without human review. If profiling is used for responsible gaming monitoring purposes, a human review process is available upon request.

dd678 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following limited circumstances, and always subject to strict confidentiality and data protection obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, and our bank transfer partners receive the financial and identity data necessary to process deposit and withdrawal transactions. Each provider operates under its own data protection framework and is contractually bound to use your data only for payment processing purposes.
• Identity Verification Partners: Third-party KYC and anti-money-laundering (AML) service providers may receive identity document data and associated personal information to perform verification checks required by our compliance obligations.
• Game Software Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a limited set of technical session data necessary to deliver their games within the dd678 platform. These providers do not receive your full personal profile.
• Legal and Regulatory Authorities: Where we are legally compelled to do so by court order, regulatory direction, or applicable law, dd678 may disclose personal data to law enforcement agencies, financial intelligence units, or other government bodies.
• Professional Advisers: Our legal counsel, auditors, and financial advisers may access personal data where strictly necessary in the course of providing professional services to dd678, and are bound by professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of dd678's business, personal data may be transferred to the relevant successor entity. You will be notified of any such transfer via the email address registered on your account.

In all cases where data is shared with third-party processors, dd678 maintains data processing agreements that require those parties to implement appropriate security measures and process your data only in accordance with our instructions.

dd678 retains personal data for as long as necessary to fulfil the purposes described in this Policy, including compliance with applicable legal, regulatory, financial reporting, and audit obligations. Our general retention schedule is as follows:

• Active Account Data: Personal data associated with an open, active dd678 account is retained for the full duration of the account relationship.
• Closed Account Data: Following voluntary or involuntary account closure, we retain identity, transaction, and communication records for a minimum period of five (5) years to satisfy financial compliance and anti-money-laundering record-keeping requirements.
• KYC Documents: Identity verification documents are retained for the duration of the account plus five (5) years after closure, in line with standard AML obligations.
• Responsible Gaming Records: Self-exclusion records, deposit limit histories, and related responsible gaming data are retained for a minimum of five (5) years after account closure to prevent the re-registration of self-excluded players.
• Customer Support Logs: Communications data and support ticket records are retained for three (3) years from the date of the last interaction, or longer if related to an unresolved dispute or legal matter.
• Technical and Usage Data: Anonymised or aggregated usage and analytics data may be retained indefinitely for platform improvement purposes, as it can no longer be linked to an identifiable individual.

Upon expiry of applicable retention periods, personal data is securely deleted from active systems and any offline backups. Where full deletion is not technically feasible within a specific backup cycle, data is rendered inaccessible and is scheduled for deletion at the next available cycle.

The dd678 Platform uses cookies and similar client-side storage technologies to operate correctly and to improve your experience. A cookie is a small text file placed on your device by your browser when you visit a website. dd678 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are required for the Platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load-balancing cookies. Without these, core features such as logging in and maintaining your session would not work.
• Functional Cookies: These cookies remember your preferences — such as your preferred language display or previously used payment method — to personalise your experience across sessions.
• Analytics Cookies: dd678 uses first-party analytics tools to understand aggregate usage patterns, such as which game categories are most popular and at what times of day. This data is processed in aggregate and is not linked to your personal identity.
• Security Cookies: These cookies assist in identifying and preventing fraudulent access attempts, including tracking failed login patterns and flagging suspicious device fingerprints.

dd678 does not deploy third-party advertising cookies, cross-site tracking cookies, or social media pixel trackers on any page of the Platform. You may manage or disable non-essential cookies through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the Platform's core functions.

dd678 takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your browser or device and the dd678 servers.
• Encryption of sensitive data fields at rest, including identity document data and financial reference information.
• Role-based access controls ensuring that dd678 staff can access personal data only to the extent required for their specific job function.
• Regular internal security reviews, vulnerability assessments, and penetration testing of the Platform infrastructure.
• Two-factor authentication options available to players to strengthen account-level security.
• Contractual data security requirements imposed on all third-party processors who handle personal data on behalf of dd678.

Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, dd678 will notify affected players without undue delay and take immediate steps to contain the breach and mitigate its impact.

You are responsible for keeping your dd678 login credentials confidential. If you believe your account has been accessed without your authorisation, contact dd678 support immediately at [email protected] (plain text — not a clickable link).

Subject to applicable law, you have the following rights in relation to the personal data dd678 holds about you. To exercise any of these rights, submit a written request to our support team with sufficient information to verify your identity:

• Right of Access: You may request a copy of the personal data we hold about you, including information about how it is processed and with whom it is shared.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that we correct or update it. Corrections to identity data may require supporting documentation.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to our legal retention obligations — data we are required to keep by law cannot be deleted on request.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in specific situations, such as while a correction request is being assessed.
• Right to Object: You may object to processing of your personal data carried out on the basis of legitimate interests. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request a structured, machine-readable copy of the personal data you provided to us directly.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

dd678 will respond to all verified data rights requests within 30 days of receipt. In cases of complexity or high volume, this period may be extended by a further 30 days, with notification provided to you before the initial deadline expires. dd678 does not charge a fee for reasonable data rights requests.

The dd678 Platform is strictly for adults aged 21 years and above. dd678 does not knowingly collect or process personal data belonging to any person under the age of 21. We implement age verification checks during the registration process and as part of ongoing KYC procedures to enforce this requirement.

If dd678 becomes aware, or has reasonable grounds to believe, that personal data has been submitted by or on behalf of a person under the age of 21, that account will be immediately suspended, all associated data will be reviewed, and any funds deposited will be returned to the verified source payment method after deducting any bonuses claimed. The account will then be permanently closed.

If you are a parent or guardian and believe that a minor in your care has registered an account on dd678, contact our support team immediately at [email protected] (plain text — not a clickable link). We will investigate and take appropriate action promptly.

dd678 operates as an offshore platform. Your personal data may be processed on servers or by service providers located in jurisdictions outside Bangladesh. When personal data is transferred internationally, dd678 ensures that appropriate safeguards are in place to protect your data to a standard consistent with this Policy:

• Where transfers are made to third-party processors in other countries, we enter into data processing agreements that include standard contractual clauses requiring the recipient to apply equivalent data protection standards.
• dd678 conducts due diligence on third-party processors to assess the adequacy of their data protection frameworks before any personal data transfer takes place.
• Payment processing transfers to Bangladeshi payment providers (bKash, Nagad, Rocket, Upay) are conducted within Bangladesh in compliance with those providers' own regulatory frameworks.

By using the dd678 Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Bangladesh. Such transfers are made in accordance with the safeguards described in this section.

dd678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. The following process applies to policy amendments:

• Material changes — those that affect your rights or the way we use your personal data in a significant way — will be communicated to you via the email address registered on your account at least 7 days before the changes take effect.
• Minor or non-material changes (such as typographical corrections, formatting updates, or clarifications that do not alter the substance of the Policy) may take effect immediately upon publication on this page.
• The "Last Updated" date at the top of this page and in the hero section above reflects the date the most recent version of this Policy was published. We recommend checking this page periodically to stay informed of any updates.
• Continued use of the dd678 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way dd678 handles your personal data, please reach out to our support team. All privacy-related enquiries should be submitted in writing to ensure a formal response is provided:

• Support email (plain text — not a clickable link): [email protected]
• Customer support is available 24 hours a day, 7 days a week.
• For data rights requests (access, rectification, erasure, portability, objection), please include your registered username and a clear description of the request. We may require identity verification before processing certain requests.
• dd678 aims to acknowledge all privacy-related enquiries within 48 hours and provide a substantive response within 30 days of receipt.