Privacy Policy — Your Data, Your Rights at 98db

1 Introduction

98db is Bangladesh's trusted online betting and casino platform, operating at https://98db.io. We are committed to protecting the personal information of every player who registers and participates on our platform. This Privacy Policy sets out a clear and transparent account of how personal data is handled — from the moment you visit our website through to account closure and beyond.

We recognise that privacy is a fundamental right. Our approach to data management is built on four principles: we collect only what is necessary, we use it only for the purposes stated here, we protect it with appropriate security measures, and we give you meaningful control over your own information. These principles guide every data-related decision we make at 98db.

This policy is effective from January 2026. Whenever we make material changes to how we handle your data, we will update this page, revise the "Last Updated" date above, and notify registered players by email where the changes are significant. We encourage you to review this policy periodically to stay informed.

2 Data We Collect

The categories of personal data that 98db may collect about you are set out in the table below. Not all categories apply to every player — the data we hold about you depends on how you use the platform and the verification stage your account has reached.

We do not collect any special category data (such as racial or ethnic origin, religious beliefs, or health information) except where you voluntarily provide context related to a responsible gaming concern, in which case that information is handled with the highest level of sensitivity and used solely to support your welfare.

3 How We Collect Data

98db collects personal data through the following channels:

• Direct submission at registration: When you create a 98db account, you provide identity and contact data directly through the registration form.
• Account activity: As you use the platform — depositing, placing bets, playing casino games, claiming bonuses — transaction and betting data is generated and recorded automatically.
• Identity verification (KYC): When you submit documents to verify your identity prior to withdrawal, additional identity data is collected via our secure document upload process.
• Payment processing: When you make a deposit or request a withdrawal via bKash, Nagad, Rocket, Upay, or a bank card, financial transaction data is received from the payment provider and associated with your account.
• Technical systems: Technical data such as IP addresses, device identifiers, and session logs is collected automatically by our platform infrastructure as part of standard website operation.
• Support communications: When you contact 98db support by email, the content and metadata of that communication are stored as part of your account record.
• Cookies and similar technologies: As described in Section 7, we use cookies to collect technical and usage data to support platform functionality and performance analysis.

4 How We Use Your Data

98db uses the personal data we hold about you for the following purposes. Each purpose is linked to the data categories from Section 2 that are relevant to it:

• Account creation and management: Identity, contact, and account data are used to register your account, authenticate your identity at login, and manage your account settings throughout your time as a 98db player.
• Payment processing: Financial data is used to process deposit credits to your account balance in BDT and to execute withdrawal requests to your nominated payment method.
• Identity verification (KYC): Identity and contact data are used to verify that you meet the 21+ age requirement and to confirm the accuracy of the information provided at registration, as required by our internal compliance procedures.
• Platform personalisation: Account and technical data are used to remember your preferences, optimise the platform experience on your device, and serve content relevant to your activity (for example, surfacing cricket betting markets during BPL season).
• Fraud prevention and security: Technical, financial, and betting data are analysed to detect and investigate suspicious activity, Prohibited Conduct as defined in the Terms & Conditions, and potential money laundering.
• Responsible gaming: Responsible gaming data, betting history, and account activity patterns are monitored to identify signs of problem gambling behaviour and to support the application of player-requested tools such as deposit limits and self-exclusion.
• Customer support: Communications data, account data, and transaction data are used by the 98db support team to respond to and resolve queries, complaints, and disputes.
• Marketing communications: Contact data is used to send promotional emails about 98db offers, bonuses, and platform updates — subject to your marketing preferences as described in Section 13.
• Platform analytics: Aggregated, anonymised technical data is used to analyse platform usage patterns, identify performance issues, and improve the overall user experience.
• Legal compliance: Identity, financial, and communications data may be used to respond to lawful requests from regulatory bodies, law enforcement agencies, or courts where 98db is legally obligated to do so.

5 Legal Basis for Processing

98db processes personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil the agreement between you and 98db — including account management, payment processing, and KYC verification — is carried out because it is necessary to perform the services you have contracted for.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, and platform analytics is carried out on the basis of 98db's legitimate interest in maintaining a safe, fair, and sustainable platform. These activities do not override your fundamental privacy rights.
• Legal obligation: Processing required to comply with applicable laws — including anti-money laundering obligations and responses to lawful authority requests — is carried out on the basis of legal obligation.
• Consent: Processing for optional marketing communications is carried out only with your explicit consent. You may withdraw this consent at any time as described in Section 13.

6 Data Sharing

6.1 General Principle. 98db does not sell, rent, or otherwise disclose your personal data to third parties for their own commercial purposes under any circumstances. Data sharing outside of 98db occurs only in the limited circumstances described in this section.

6.2 Payment Processors. When you make a deposit or withdrawal, the transaction is processed by a payment provider such as bKash, Nagad, Rocket, Upay, or a bank card network. The minimum data necessary to complete the transaction (such as amount, currency, and reference number) is shared with the relevant provider. Their handling of that data is governed by their own privacy policies.

6.3 Identity Verification Services. To fulfil KYC requirements, identity documents you submit may be shared with a third-party identity verification service. Such services are bound by strict confidentiality agreements and are only permitted to use the data for the purpose of verifying your identity for 98db.

6.4 Game Providers. When you play games supplied by providers such as Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, or Spribe, limited session data (such as your player ID and bet amounts) is shared with the relevant provider to enable game functionality and fair play auditing. Game providers do not receive your name, address, or payment details.

6.5 Legal and Regulatory Disclosures. 98db may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or other binding legal process. We will notify affected players of such disclosures where we are legally permitted to do so.

6.6 Business Transfers. In the event that 98db's business or assets are transferred to a third party (for example, through a merger or acquisition), your personal data may be transferred as part of that transaction. You will be notified of any such transfer and the privacy practices applicable to your data following the transfer.

7 Cookies & Tracking Technologies

7.1 What Are Cookies. Cookies are small text files placed on your device by a website to store information about your session and preferences. 98db uses cookies and similar technologies (such as local storage) to support the operation of the platform and to understand how players interact with it.

7.2 Types of Cookies We Use. The cookies deployed on 98db fall into the following categories:

• Strictly necessary cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in while you navigate the site. These cookies cannot be disabled without impairing platform functionality.
• Functional cookies: Used to remember your preferences such as language settings and last-visited game category, so that the platform behaves consistently across your sessions.
• Analytics cookies: Used to collect aggregate, anonymised data about how players navigate and interact with the 98db platform. This data helps us identify technical issues and improve the user experience. Analytics data is not linked to your individual identity.

7.3 What We Do Not Use. 98db does not deploy third-party advertising cookies, behavioural tracking pixels, retargeting scripts, or any technology that shares your browsing data with external advertising networks or social media platforms.

7.4 Managing Cookies. You may adjust your browser settings to block or delete cookies at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use the platform. Most modern browsers provide cookie management controls in their settings or preferences menus.

8 Data Security

8.1 Technical Measures. 98db applies a range of technical security measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include TLS/SSL encryption for all data in transit between your device and our servers, encryption of sensitive data fields at rest, and firewalled server infrastructure with restricted administrative access.

8.2 Organisational Measures. Access to personal data within 98db is restricted to personnel who have a legitimate need to access it for the performance of their role. All staff with access to personal data are subject to confidentiality obligations. We conduct periodic internal reviews of our data security practices.

8.3 Payment Data. 98db does not store full card numbers, bKash PINs, Nagad PINs, or other payment credentials on our systems. Payment transactions are handled by the respective payment provider's secure infrastructure. Only transaction reference data and outcome information (success or failure) are stored by 98db.

8.4 Security Incidents. In the event of a personal data breach that is likely to result in a risk to affected players, 98db will notify affected individuals as quickly as reasonably practicable. Notifications will be sent to the registered email address on the affected account and will include a description of the breach, the data affected, and the steps being taken to address it.

8.5 Your Responsibilities. You are responsible for maintaining the confidentiality of your 98db account credentials. Choose a strong, unique password and do not share your login details with any other person. If you suspect your account has been compromised, contact [email protected] immediately so we can investigate and, if necessary, temporarily suspend the account.

9 Data Retention

98db retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention principles apply:

• Active account data: All personal data associated with an active 98db account is retained for the full duration of the account's active status.
• Post-closure retention: Following account closure (whether voluntary or by 98db), account and transaction records are retained for a defined period as required by our internal compliance obligations and applicable law. This period is typically five years from the date of account closure, after which the data is securely deleted or anonymised.
• KYC documents: Identity verification documents submitted for KYC purposes are retained for the period required under our internal compliance standards. Copies are not retained beyond this period.
• Support communications: Email and chat records related to support queries are retained for a period of three years from the date of the last interaction in the relevant thread, unless they form part of an ongoing dispute or legal matter requiring longer retention.
• Analytics data: Aggregated, anonymised analytics data does not contain personal identifiers and is not subject to the same retention limits as personal data. It may be retained indefinitely for the purpose of platform improvement.

When data reaches the end of its defined retention period and there is no longer a legal or compliance basis for retaining it, 98db will either permanently delete the data from our systems or irreversibly anonymise it so that it can no longer be linked back to an individual.

10 Your Rights

As a player on the 98db platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within a reasonable timeframe.

11 Children & Minors

The 98db platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes age verification steps, and KYC verification requires documentary proof of age before a withdrawal may be processed.

If 98db discovers that a minor has registered on the platform or that personal data has been collected from a person under 21, we will immediately close the associated account, void all bets placed, and delete the personal data of the minor from our systems as quickly as practically possible. Any deposited funds will be handled in accordance with our Terms & Conditions and our legal obligations.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on 98db, please contact us immediately at [email protected]. We take all such reports with the highest priority and will investigate without delay. For guidance on protecting young people from online gambling, please visit the Responsible Gaming page.

12 Third-Party Links

The 98db platform may reference third-party services such as payment providers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank) and game providers (Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, Spribe). Where the use of such services involves navigating away from the 98db domain, those services operate under their own independent privacy policies.

98db is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policy of any third-party service before submitting your personal data to it. The inclusion of a reference to a third-party service on the 98db platform does not constitute an endorsement of that service's privacy practices.

13 Marketing Communications

13.1 Opt-In Marketing. 98db may send you promotional emails about platform offers, bonuses, new games, and seasonal promotions (such as BPL cricket season offers, Eid specials, and Pohela Boishakh promotions) where you have provided explicit consent to receive such communications during or after the registration process.

13.2 Opting Out. You may withdraw your consent to receive marketing emails at any time by clicking the unsubscribe link in any marketing email from 98db, or by contacting us at [email protected] with the subject line "Unsubscribe". We will process your opt-out request within 5 business days. Please note that withdrawing marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

13.3 Transactional Communications. Withdrawing marketing consent does not affect transactional communications. 98db will continue to send you account-related emails that are necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, security alerts, and responses to support queries. These communications are not marketing and cannot be opted out of while your account remains active.

13.4 SMS and Push Notifications. Where 98db uses SMS or in-platform push notifications to communicate with players, the same opt-in and opt-out principles apply. You may manage notification preferences within your account settings or by contacting support.

14 Changes to This Policy

98db reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. When we make material changes, we will update the "Last Updated" date at the top of this page and notify registered players by email at the address associated with their account.

We encourage you to review this Privacy Policy periodically. Your continued use of the 98db platform following notification of changes constitutes your acknowledgement of the updated policy. If you object to any changes, you may close your account and request deletion of your personal data as described in Section 10.

Minor changes — such as clarifications of existing practices, corrections of typographical errors, or editorial improvements that do not affect the substance of the policy — may be made without direct player notification, though the "Last Updated" date will always reflect the date of the most recent revision of any kind.

15 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how your personal data is being handled by 98db, please contact our support team using the details below. All privacy-related enquiries are handled with strict confidentiality.

• Privacy & Data Enquiries Email: [email protected]
• Subject Line for Data Rights Requests: "Data Rights Request"
• Subject Line for Privacy Concerns: "Privacy Enquiry"
• Support Hours: 24 hours a day, 7 days a week, including Bangladesh public holidays.
• Response Time: We aim to acknowledge all privacy-related emails within 24 hours and to provide a substantive response within 30 days. Where a request is complex or where we require additional information from you to fulfil it, we will notify you of the extended timeline.
• Languages: English and Bengali.