35bat Privacy Policy

35bat ("35bat", "we", "us", "our") is an online cricket betting and casino platform designed specifically for players across Bangladesh. The platform is accessible at 35bat.io and offers sports betting, live casino games, slot games, crash games, and related services, all conducted exclusively in Bangladeshi Taka (BDT / ৳).

35bat acts as the data controller in relation to the personal data of registered players and visitors to the 35bat platform. As data controller, 35bat determines the purposes and means by which your personal data is collected and processed.

This Privacy Policy applies to all personal data collected and processed in connection with your use of the 35bat website, mobile-optimised platform, customer support channels, and any other services we provide. It should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the contractual relationship between you and 35bat.

If you have any questions about how 35bat handles your personal data, you may contact our support team at any time using the contact details in Section 14 of this Policy.

35bat collects several categories of personal data from registered players and platform visitors. The specific data collected depends on how you interact with the platform:

2.1 Registration & Identity Data

• Full legal name as it appears on your official identity document.
• Date of birth (required to verify that you are aged 21 or above).
• Residential address, including city or district (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar).
• Email address and mobile phone number used during registration.
• Username and encrypted account credentials.

2.2 Identity Verification (KYC) Data

• Copies of government-issued identity documents (National ID card, passport, or driving licence).
• Proof of address documents (utility bills, bank statements, or other official correspondence).
• Selfie or facial verification images where required for enhanced identity confirmation.
• Source of funds declarations where required for large transactions or enhanced due diligence.

2.3 Financial & Transaction Data

• Mobile wallet identifiers associated with your bKash, Nagad, Rocket, or Upay accounts used for deposits and withdrawals.
• Deposit amounts, withdrawal amounts, transaction dates, and transaction reference numbers.
• Account balance history and wagering activity records.
• Bonus and promotional activity records.

2.4 Behavioural & Usage Data

• Games played, bet amounts, win/loss records, session duration, and betting patterns.
• Platform navigation paths, pages visited, features used, and search queries within the platform.
• Responsible gaming tool usage, including deposit limits set and any self-exclusion activity.

2.5 Technical & Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, browser type and version.
• Cookies and similar tracking identifiers (see Section 7).
• Login timestamps and session activity logs.

2.6 Communications Data

• Records of all communications between you and the 35bat support team, including live chat transcripts, email correspondence, and WhatsApp message records.
• Feedback, complaints, and dispute records.

35bat collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or respond to a survey.
• Automatically through platform use — when you browse the 35bat website or use the platform, technical and behavioural data is collected automatically through server logs, cookies, and analytics tools embedded in the platform.
• From payment processors — when you initiate a financial transaction, 35bat receives transaction confirmation data from payment partners including bKash, Nagad, Rocket, and Upay.
• From identity verification services — where enhanced KYC verification is required, we may use approved third-party identity verification service providers who process submitted documents on our behalf.
• From game technology providers — certified game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may share game activity data with 35bat in connection with the operation of their games on our platform.
• From fraud and security screening services — 35bat uses approved third-party fraud detection tools that may provide risk signals or flags associated with specific transactions or account behaviours.

35bat uses the personal data it collects for the following specific purposes:

35bat does not use your personal data for any purpose that is incompatible with the purposes listed above. Where a new processing purpose arises, this Policy will be updated and you will be informed as required.

35bat processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to enter into and perform the contract between you and 35bat — including account registration, deposit and withdrawal processing, game delivery, and customer support.
• Legal obligation: Processing required to comply with applicable legal obligations, including KYC identity verification, AML screening, and data retention requirements imposed by law.
• Legitimate interests: Processing carried out for the legitimate operational interests of 35bat, including fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — provided that such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in respect of marketing and promotional communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

35bat does not sell your personal data to any third party. We share personal data only in the following circumstances and only to the extent strictly necessary:

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum necessary transaction data required to process your deposits and withdrawals in Bangladeshi Taka. These providers operate under their own privacy policies and security standards.
• Game technology providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe receive game session data required to deliver their games and to verify game outcomes. Data shared is limited to session identifiers and wagering data.
• Identity verification services: Where KYC verification is required, approved third-party verification providers process identity documents on behalf of 35bat under strict data processing agreements. These providers do not retain or use your documents for any other purpose.
• Fraud and security partners: Approved fraud detection and security service providers may receive technical and transactional data signals for the purpose of identifying and preventing fraudulent activity.
• Legal and regulatory authorities: 35bat will disclose personal data to relevant authorities where required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of 35bat's business, personal data held by 35bat may be transferred to the successor entity. You will be notified of any such transfer and the privacy protections applicable to your data.

All third parties with whom 35bat shares personal data are required to handle that data in a manner consistent with this Privacy Policy and applicable data protection principles. Where third parties act as data processors on our behalf, they do so under written data processing agreements.

35bat uses cookies and similar tracking technologies on the platform to enable core functionality, improve platform performance, and — where you have consented — to personalise your experience and support marketing activities.

Types of cookies used by 35bat:

• Strictly necessary cookies: These cookies are essential for the platform to function. They enable core features such as session management, secure login, and page navigation. These cookies cannot be disabled as the platform cannot operate without them.
• Performance & analytics cookies: These cookies collect aggregated, anonymised data about how visitors interact with the 35bat platform — such as which pages are visited most frequently and whether any errors are encountered. This data is used solely to improve platform performance.
• Functional cookies: These cookies remember preferences you have set — such as your preferred language, display settings, or responsible gaming tool configurations — so that you do not need to re-enter them on each visit.
• Marketing & targeting cookies: Where you have provided consent, these cookies track your browsing activity to enable relevant promotional content to be presented to you. You may withdraw consent for marketing cookies at any time.

You can control cookie settings through your browser's privacy settings. Please note that disabling strictly necessary cookies will affect the functionality of the 35bat platform. Most modern browsers allow you to view, manage, and delete individual cookies through the browser's settings menu.

Session data and login cookies are automatically deleted when you close your browser session. Persistent cookies used for analytics and functional purposes are retained for defined periods not exceeding 24 months from the date of your last platform visit.

35bat retains personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and reporting obligations.

The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with 35bat, plus a minimum of 5 years following account closure, in accordance with applicable anti-money laundering and financial record-keeping requirements.
• KYC verification documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping obligations.
• Customer support communications: Retained for 3 years from the date of the most recent communication in a given support thread, or for 5 years where the communication relates to a formal complaint or dispute.
• Marketing consent records: Retained for as long as you remain opted in to marketing, plus 3 years following opt-out, as evidence of consent history.
• Anonymised analytics data: Aggregated, anonymised usage data that cannot be linked to any individual is retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where deletion is not immediately technically feasible (for example, where data is held in backup systems), the data will be isolated and protected from further processing until deletion is completed.

As a registered player on 35bat, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact our support team as set out in Section 14:

• Right of access: You may request a copy of the personal data that 35bat holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: You may request that any inaccurate or incomplete personal data held about you be corrected or updated without undue delay.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where the data has been unlawfully processed. This right is subject to 35bat's legal data retention obligations.
• Right to restriction of processing: You may request that 35bat restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to data portability: You may request a copy of the personal data you have provided to 35bat in a structured, commonly used, machine-readable format, and request that it be transferred directly to another data controller where technically feasible.
• Right to object: You may object to the processing of your personal data where that processing is based on legitimate interests. You may also object to the processing of your data for direct marketing purposes at any time, unconditionally.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

35bat will respond to all verified data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case you will be informed of the extension and the reasons for it within the initial 30-day period.

35bat operates a strict minimum age policy. The platform is available exclusively to individuals who are 21 years of age or older. 35bat does not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of the account registration and KYC process. Where 35bat becomes aware that a registered account belongs to a person under 21 years of age, the account will be immediately suspended, all associated winnings will be forfeited, and deposits will be returned to the original payment source after deducting any withdrawals already made.

Parents and guardians are strongly encouraged to use parental control software to prevent minors from accessing online gambling platforms, including 35bat. If you have reason to believe that a minor has registered an account on 35bat using false date-of-birth information, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

35bat implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the 35bat platform is encrypted using industry-standard SSL/TLS protocols. The padlock icon visible in your browser's address bar confirms that your connection is encrypted.
• Encrypted data storage: Sensitive personal data — including identity documents, financial records, and account credentials — is stored in encrypted form in secured server environments with strict access controls.
• Access control: Access to personal data within 35bat's systems is restricted to authorised personnel on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Security monitoring: 35bat's systems are continuously monitored for unusual activity, attempted breaches, and security anomalies. Incident response procedures are in place to address any confirmed security events promptly.
• Password security: Account passwords are stored using one-way cryptographic hashing. 35bat does not have access to your plain-text password and will never ask you to provide it by email, chat, or telephone.
• Regular security reviews: 35bat conducts periodic reviews of its security infrastructure, policies, and procedures to identify and address potential vulnerabilities before they can be exploited.

While 35bat takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, including your username and password. If you suspect that your account has been accessed without your authorisation, please contact our support team immediately.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 35bat will notify affected players without undue delay and will take all appropriate remediation steps.

The 35bat platform integrates with a number of approved third-party service providers whose products and services are necessary for platform operation. These include game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe, as well as payment processors including bKash, Nagad, Rocket, and Upay.

Each of these third-party providers operates under their own privacy policies, terms of service, and data protection obligations. 35bat carefully selects its third-party partners and requires each to maintain data security standards consistent with those applied by 35bat. However, once data is transferred to a third-party provider in connection with a specific service, the processing of that data by the third party is governed by that provider's own policy.

35bat is not responsible for the privacy practices of third-party providers operating independently of 35bat's instructions. Where you interact directly with a third-party payment provider — for example, when completing a transaction within that provider's own application or interface — your use of that interface is subject to the provider's own terms and privacy policy.

35bat does not embed social media tracking pixels, advertising network scripts, or affiliate tracking cookies from external networks that would allow third parties to build behavioural profiles of our players without their knowledge. Any analytics tools used by 35bat are configured to anonymise IP addresses and aggregate data before storage.

35bat reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or our internal data handling practices. All updates will be published on this page at 35bat.io/privacy-policy with a revised effective date clearly indicated at the top of the document.

Where a proposed update constitutes a material change to how 35bat processes your personal data — for example, a new category of data being collected, a new purpose for processing, or a new category of third party with whom data is shared — 35bat will provide you with advance notice of the change via your registered email address or through an in-platform notification, not less than 14 days before the change takes effect.

Your continued use of the 35bat platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any material changes to this Policy, you may close your account by contacting our support team before the effective date of the update.

We encourage all registered players to review this Privacy Policy periodically to stay informed about how 35bat protects your data. The "Effective Date" at the top of this page will always indicate when the Policy was last updated.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data 35bat holds about you, please contact our support team using any of the following channels. All privacy and data protection enquiries are handled by trained staff and will receive a written response.

• Email: [email protected] — please include "Privacy Request" or "Data Rights Request" in the subject line so your message is routed to the correct team.
• WhatsApp: +880 1700 000000 — available for general support enquiries. For formal data rights requests, written email correspondence is preferred.
• Live Chat: Available 24/7 within the 35bat platform. Our support agents can accept initial data rights requests via live chat and will follow up with a written confirmation to your registered email address.
• Response time: 35bat aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days. Peak response times occur during Bangladesh Standard Time (BST, UTC+6) business hours.

When submitting a data rights request, please provide your registered username and the email address associated with your account so that we can verify your identity before processing the request. Requests from unverified individuals cannot be acted upon, as processing them would itself constitute a breach of the data subject's privacy rights.

35bat is committed to resolving all privacy-related enquiries fairly and promptly. If you are not satisfied with our response to a data rights request, you are entitled to escalate your complaint through the appropriate formal channels available to you under applicable law.