db888 Privacy Policy

This Privacy Policy ("Policy") is published by db888 and applies to all players, visitors, and users who access or use the db888 platform at db888.io ("Platform"). It describes how db888 collects, uses, stores, shares, and protects personal data, and sets out the rights available to individuals whose data we hold.

By registering an account on the Platform or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy in full. If you do not agree with any part of this Policy, you should discontinue use of the Platform and may request account closure by contacting the db888 support team.

This Policy applies in conjunction with the db888 Terms & Conditions and the Responsible Gaming Policy. Where any conflict arises between this Policy and those documents on a data-specific matter, this Policy governs.

db888 is committed to protecting the privacy of its players across Bangladesh, including users in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. The platform operates in English and processes all player data in that language.

db888 collects personal data in several ways: directly from you when you register or use the Platform, automatically through technical systems as you browse or play, and from third-party service providers where necessary. The categories of data we collect are set out in the table below.

db888 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric data for identification purposes. Where a document submitted for verification incidentally contains such information, it is stored only as part of the verification record and is not used for any other purpose.

db888 uses the personal data it collects for the following purposes. Each purpose is linked to a legal basis, which is described in Section 4.

• Account creation and management: To register your account, verify your identity, maintain your player profile, and provide access to the Platform's features.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment channels, and to maintain accurate financial records.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, bonus abuse, and other forms of misconduct or criminal activity.
• Regulatory compliance: To fulfil Know Your Customer (KYC), Anti-Money Laundering (AML), and other legal obligations applicable to online gaming platforms operating in or serving the Bangladesh market.
• Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, enforce self-exclusion requests, apply deposit and loss limits, and contact players where welfare concerns are identified.
• Customer support: To respond to enquiries, process complaints, and maintain records of support interactions for quality assurance and dispute resolution.
• Platform improvement: To analyse usage patterns, identify technical issues, improve the user experience, and develop new features or products for db888 players.
• Marketing communications: To send promotional offers, bonus notifications, and relevant platform updates to players who have opted in to receive such communications. See Section 12 for opt-out information.
• Legal proceedings: To establish, exercise, or defend legal claims in the event of a dispute between the player and db888.

db888 processes personal data on one or more of the following legal bases depending on the specific purpose:

• Contractual necessity: Processing required to perform the contract between db888 and the player — including account registration, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC, AML obligations, and responses to lawful requests from authorities.
• Legitimate interests: Processing carried out for db888's legitimate business interests where those interests are not overridden by the player's rights — including fraud prevention, platform security, responsible gaming monitoring, and business analytics.
• Consent: Processing based on the player's freely given, specific, and informed consent — including the sending of marketing communications and the use of non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

db888 does not sell, rent, or trade personal data to any third party. Data may be shared only in the limited circumstances described below, and always subject to strict confidentiality obligations or legal requirements:

• Payment service providers: Personal and financial data is shared with payment processors (including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and City Bank) solely to facilitate the deposit and withdrawal transactions you initiate.
• Identity verification providers: Identity and verification data may be shared with third-party KYC service providers engaged by db888 to perform automated or manual identity checks.
• Game and software providers: Technical and gaming data may be accessible to third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe) in the course of delivering their game services on the Platform.
• Fraud prevention and security services: Technical data and gaming behaviour data may be shared with specialist fraud detection and cybersecurity providers that assist db888 in identifying and mitigating threats.
• Legal and regulatory authorities: Personal data may be disclosed to law enforcement agencies, regulatory bodies, or courts in response to a lawful request, court order, or legal obligation. db888 will notify the affected player of such disclosure where it is legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or transfer of all or part of db888's business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. Players will be notified in advance of any such transfer that materially affects their data rights.

All third-party data processors engaged by db888 are bound by written data processing agreements that require them to handle personal data only in accordance with db888's instructions and to maintain appropriate security measures.

db888 uses cookies and similar tracking technologies on the Platform to deliver core functionality, remember your preferences, analyse usage patterns, and support fraud prevention. The categories of cookies used are as follows:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that maintain your login state and security tokens. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, display options, and recently viewed games. These improve your experience but are not required for the Platform to operate.
• Analytical cookies: Collect aggregated, anonymised data about how players use the Platform — including pages visited, session duration, and navigation paths — to help db888 identify areas for improvement.
• Security and fraud detection cookies: Help db888 identify unusual behaviour patterns, detect bot activity, and prevent fraudulent access attempts.

Non-essential cookies (functional and analytical categories) are activated only with your consent. You may withdraw consent and manage cookie preferences at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform.

db888 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in accordance with standard AML record-keeping requirements.
• Financial transaction data: Retained for a minimum of five (5) years from the date of the transaction to support audit, fraud investigation, and regulatory compliance obligations.
• Gaming data: Retained for the duration of the active account and for up to three (3) years following account closure, for dispute resolution and responsible gaming monitoring purposes.
• Support communications: Retained for up to three (3) years from the date of the last interaction to support quality assurance and complaint resolution processes.
• Marketing consent records: Retained for the duration of the marketing relationship and for one (1) year following opt-out, as evidence of consent status.
• Technical and server log data: Typically retained for up to twelve (12) months for security monitoring purposes, after which it is deleted or anonymised.

Where data is no longer required and no legal obligation compels its retention, db888 will securely delete or anonymise that data so that it can no longer be linked to an individual player.

db888 applies a layered security architecture to protect personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between player devices and db888 servers.
• Encryption at rest for sensitive data fields including passwords, payment identifiers, and identity documents stored on db888 infrastructure.
• Access controls ensuring that only authorised db888 personnel with a legitimate business need can access personal data, governed by role-based permissions and multi-factor authentication.
• Audit logging of all access to and modifications of personal data records, enabling detection of any unauthorised activity.
• Routine security assessments including vulnerability scanning and penetration testing of the Platform infrastructure.
• Incident response procedures to ensure that any data breach is identified promptly, contained, and notified to affected players as required.

While db888 employs industry-standard security practices, no digital platform can guarantee absolute security against all threats. Players are encouraged to use strong, unique passwords for their db888 Account and to contact support immediately if they suspect any unauthorised access.

As a db888 player whose personal data we process, you hold the following rights in respect of that data. To exercise any of these rights, please submit a written request to [email protected]. db888 will respond within a reasonable timeframe, typically within thirty (30) days of receiving a valid request.

• Right of Access: You may request a copy of the personal data that db888 holds about you, together with information about how it is being used.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to Erasure: You may request that your personal data be deleted where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where no other legal basis for retention applies. This right is subject to db888's legal obligations — data that must be retained under AML or other law cannot be deleted before the mandatory retention period expires.
• Right to Restrict Processing: You may request that db888 limit the processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes. db888 will consider your objection and cease processing unless it can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications, non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.

The db888 Platform is strictly intended for adults aged 21 years and above. db888 does not knowingly collect or process personal data from individuals under the age of 21. Any account found to belong to a person under this minimum age will be immediately suspended, all associated data flagged for review, and any deposited funds returned subject to identity verification.

If you believe that a minor has registered an account on the db888 Platform or that db888 has inadvertently collected data from a person under 21, please notify the db888 support team immediately at [email protected]. db888 will investigate the matter promptly and take appropriate action, including deletion of the minor's data where confirmed.

Parents and guardians are encouraged to use parental control tools to prevent minors from accessing online gambling platforms. db888 supports responsible measures to keep gambling out of the hands of young people in Bangladesh.

The db888 Platform integrates services provided by third-party companies, including game studios, payment processors, and analytics providers. When you interact with these third-party services — for example, by playing a live dealer game from Evolution Gaming or Ezugi — data may be processed by that third party in accordance with their own privacy policies.

db888 is not responsible for the privacy practices of third-party service providers beyond the data processing agreements in place between db888 and those providers. Players who wish to understand how a specific third-party provider handles their data should consult that provider's published privacy documentation.

Payment providers including bKash, Nagad, Rocket, and Upay operate under their own terms of service and privacy policies, which govern their handling of transaction data. db888 shares only the minimum data necessary with these providers to facilitate the specific transaction requested.

db888 may send promotional messages, bonus offers, seasonal campaign notifications (such as Eid, Pohela Boishakh, or IPL / BPL season promotions), and platform update announcements to players who have opted in to receive such communications at the time of registration or through their account settings.

Marketing communications are sent via email and/or mobile notification. You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email from db888.
• Updating your communication preferences in your db888 Account settings.
• Submitting a written opt-out request to [email protected].

Please allow up to five (5) business days for opt-out requests to take effect across all communication channels. Opting out of marketing communications does not affect transactional messages — you will continue to receive account notifications, payment confirmations, security alerts, and support responses.

db888 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. Where a material change is made to this Policy, db888 will publish a prominent notice on the Platform no less than seven (7) days before the change takes effect, unless a shorter notice period is required to address an urgent legal or security matter.

The effective date shown at the top of this Policy will be updated each time a new version is published. Players are encouraged to review this page periodically to stay informed of how db888 protects their personal data.

Continued use of the db888 Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must stop using the Platform and may request account closure in accordance with the Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way db888 handles your personal data, please contact the db888 privacy team using the details below. All privacy enquiries are handled in English during Bangladesh Standard Time (BST, UTC+6) business hours, with urgent matters escalated promptly.

For data deletion or account closure requests, please include your registered email address, db888 username, and a description of your request. Identity verification will be required before any deletion or access request can be processed.

For concerns specifically about responsible gaming, self-exclusion, or deposit limits, please mark your message "Responsible Gaming" to ensure it is routed to the appropriate team without delay.