Privacy Policy — dd22 Platform

1.1 Data Controller: dd22 operates the online betting and casino platform accessible at https://dd22.io (the "Platform"). For the purposes of this Privacy Policy, dd22 acts as the data controller in respect of all personal data collected from users of the Platform.

1.2 Contact Details: If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact the dd22 data protection team at [email protected]. All privacy-related enquiries will be acknowledged within 2 business days (Bangladesh Standard Time, UTC+6).

1.3 Scope: This Privacy Policy applies to all personal data processed by dd22 in connection with your registration, account management, deposits, withdrawals, betting and gaming activity, customer support interactions, and any marketing communications you receive from dd22. It applies to all players accessing the Platform from Bangladesh and other permitted jurisdictions.

2.1 dd22 collects the following categories of personal data from registered players and platform visitors:

2.2 Sensitive Data: dd22 does not intentionally collect special category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where strictly required for regulatory compliance. Where the collection of such data is unavoidable (for example, where a government-issued identity document contains a religious designation), that data will be processed only to the extent required for the specific verification purpose and will not be used for any other purpose.

3.1 Directly from You: The majority of personal data that dd22 holds about you is information you provide directly. This includes data submitted during account registration, information supplied during the KYC verification process, data provided when contacting customer support, and preferences you configure within your account settings panel.

3.2 Automatically During Platform Use: When you access and use the dd22 Platform, certain technical and usage data is automatically recorded by our systems. This includes your IP address, the type of device and browser you are using, the pages and games you interact with, session duration, and timestamps of your actions on the Platform. This data is collected via server logs, cookies, and similar tracking technologies (see Section 6).

3.3 From Third-Party Service Providers: dd22 may receive personal data about you from third-party service providers engaged to support the operation of the Platform. These include:

• Payment processors and mobile financial service providers (bKash, Nagad, Rocket, Upay, DBBL) — for transaction verification and fraud prevention;
• Identity verification and KYC service providers — for document authentication and age verification;
• Fraud prevention and AML screening services — for risk assessment and regulatory compliance;
• Analytics providers — for aggregated, anonymised Platform performance data.

3.4 From Public Sources: In limited circumstances, dd22 may supplement the information it holds about you with data obtained from publicly available sources (such as sanctions screening databases or public records) strictly for the purposes of regulatory compliance.

4.1 dd22 processes your personal data only where there is a lawful basis for doing so. The primary legal bases on which dd22 relies are: (a) performance of the contract between dd22 and you as a registered player; (b) compliance with legal obligations applicable to dd22 as an operator; (c) legitimate interests pursued by dd22 that are not overridden by your rights; and (d) your consent, where specifically requested.

4.2 The specific purposes for which dd22 processes your personal data include:

• Account creation and management: to register your account, authenticate your identity, maintain your account settings, and manage your relationship with dd22 as a player;
• Transaction processing: to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, DBBL, Visa, and Mastercard, and to maintain accurate financial records in BDT;
• KYC and age verification: to verify that all players are aged 21 or above and to comply with anti-money laundering and know-your-customer obligations;
• Fraud and security monitoring: to detect, investigate, and prevent fraudulent activity, account takeovers, and other security threats on the Platform;
• Customer support: to respond to your queries, process complaints, and resolve disputes;
• Platform improvement: to analyse usage patterns and technical performance data for the purposes of improving the Platform's functionality, reliability, and user experience;
• Responsible gaming: to monitor betting and gaming activity for signs of problem gambling and to apply responsible gaming tools (deposit limits, cooling-off periods, self-exclusion) where appropriate or requested;
• Marketing communications: to send you promotional offers, bonus notifications, and product updates — subject to your communication preferences (see Section 12);
• Legal compliance: to comply with applicable laws, regulatory requirements, court orders, and official government requests.

5.1 We Do Not Sell Your Data: dd22 will never sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your data is not a product. Period.

5.2 Service Providers: dd22 shares personal data with carefully selected third-party service providers who assist in the operation of the Platform. All such providers are engaged under contractual data processing agreements that require them to process your data only on dd22's instructions, in accordance with this Privacy Policy, and to maintain appropriate security standards. Current categories of service providers with whom data may be shared include:

• Payment processing and mobile financial services (bKash, Nagad, Rocket, Upay, DBBL, Visa, Mastercard network processors);
• Identity verification and KYC platform providers;
• Fraud detection and AML screening service providers;
• Cloud hosting and infrastructure providers;
• Customer support platform providers;
• Game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) — for the purposes of game round verification and dispute resolution only.

5.3 Legal Disclosure: dd22 may disclose your personal data to law enforcement agencies, regulatory authorities, or other official bodies where required to do so by applicable law, court order, or regulatory directive. In all such cases, dd22 will disclose only the minimum amount of data required to comply with the relevant legal obligation.

5.4 Business Transfers: In the event that dd22 undergoes a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. dd22 will notify you via the email address associated with your account before your data is transferred and becomes subject to a materially different privacy policy.

6.1 What Are Cookies: Cookies are small text files placed on your device when you visit a website. dd22 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate the Platform effectively, maintain your login session, and analyse Platform usage.

6.2 Types of Cookies Used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They enable core features such as account authentication, session management, and security. These cookies cannot be disabled without impairing the functionality of the Platform.
• Performance Cookies: These cookies collect anonymised data about how users interact with the Platform (pages visited, error messages encountered, load times). This data is used solely to improve Platform performance and user experience.
• Functional Cookies: These cookies remember your preferences (such as preferred language settings or display options) to provide a more personalised experience when you return to the Platform.
• Analytics Cookies: dd22 uses analytics tools that set cookies to track aggregated, anonymised usage patterns across the Platform. This data helps us understand which features are most used and where improvements are needed.

6.3 Managing Cookies: You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to your dd22 account and using core Platform features. Blocking other categories of cookies will not affect your ability to use the Platform but may reduce the quality of your experience.

6.4 Session Duration: Session cookies are deleted automatically when you close your browser. Persistent cookies remain on your device for a defined period (typically between 30 days and 12 months depending on their purpose) unless you delete them manually or via your browser settings.

7.1 dd22 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The key retention periods applied by dd22 are as follows:

7.2 Upon expiry of the applicable retention period, dd22 will securely delete or anonymise your personal data in accordance with industry-standard data destruction practices. Anonymised, aggregated data may be retained indefinitely for statistical and business analysis purposes, as it can no longer be used to identify you.

8.1 As a data subject whose personal data is processed by dd22, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact [email protected] with the subject line "Data Rights Request". dd22 will respond to all verified rights requests within 30 calendar days.

9.1 dd22 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Key security measures currently in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the dd22 Platform;
• At-rest encryption for all databases and file stores containing personal data;
• Access controls and role-based permissions limiting internal access to personal data to authorised personnel only, on a strict need-to-know basis;
• Multi-factor authentication (MFA) for all dd22 internal systems that process personal data;
• Regular penetration testing and vulnerability assessments conducted by independent security professionals;
• 24/7 intrusion detection and real-time security monitoring of Platform infrastructure;
• Secure data destruction procedures for all physical and digital media upon decommissioning.

9.2 Your Responsibility: The security of your dd22 account also depends on actions you take yourself. You are responsible for keeping your login credentials confidential, using a strong and unique password, enabling two-factor authentication on your account, and logging out from shared devices. dd22 cannot be held responsible for data breaches resulting from your failure to maintain the security of your own credentials.

9.3 Data Breach Notification: In the unlikely event of a personal data breach that is likely to result in a high risk to your rights and freedoms, dd22 will notify affected players without undue delay via the email address registered on their account, and will take all reasonable steps to contain and mitigate the impact of the breach.

10.1 The dd22 Platform is strictly intended for adults aged 21 years and above. dd22 does not knowingly collect, process, or store personal data from any individual under the age of 21. If you are under 21, you must not register an account on dd22, and you must not submit any personal data to the Platform.

10.2 If dd22 becomes aware that personal data has been submitted by or on behalf of an individual under the age of 21, that data will be deleted immediately and the associated account will be permanently closed. Any funds held in that account may be forfeited in accordance with the dd22 Terms & Conditions.

10.3 If you are a parent or guardian and believe that a minor in your care has submitted personal data to dd22 or has registered an account on the Platform, please contact [email protected] immediately. We will investigate and take appropriate action without delay.

11.1 The dd22 Platform may contain links to third-party websites, game providers, or service pages. This Privacy Policy applies exclusively to data processed by dd22 in connection with the Platform at https://dd22.io. It does not apply to any third-party websites or services that you access via links on the Platform.

11.2 dd22 has no control over the content, privacy practices, or data processing activities of any third-party website. We strongly encourage you to read the privacy policy of any third-party site you visit before submitting personal data to that site. dd22 is not responsible for the privacy or data security practices of any third party.

12.1 With your consent, dd22 may send you marketing communications about promotions, bonuses, new games, and other dd22 services. These communications may be delivered via email or SMS to the contact details you have registered on your account.

12.2 Opting Out: You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your dd22 account settings panel;
• Clicking the "unsubscribe" link included in any marketing email from dd22; or
• Contacting [email protected] with the subject line "Marketing Opt-Out".

12.3 Opting out of marketing communications will not affect the delivery of transactional messages (such as deposit confirmations, withdrawal notifications, account security alerts, and important account updates), which are sent as a necessary part of the contractual relationship between dd22 and registered players.

12.4 Personalisation: dd22 may use data about your betting and gaming activity to personalise the offers and promotions you receive. This helps ensure that the communications you receive from dd22 are relevant to your interests. If you do not wish your activity data to be used for this purpose, you may contact [email protected] to request that personalised marketing be disabled on your account.

13.1 dd22 operates as an internationally licensed platform. As a result, personal data collected from players in Bangladesh may be transferred to and processed in countries outside Bangladesh where dd22's infrastructure, hosting providers, or service partners are located.

13.2 Where personal data is transferred internationally, dd22 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections applied within Bangladesh. These safeguards may include contractual clauses in data processing agreements, adequacy assessments, and other appropriate technical and organisational measures.

13.3 dd22 will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your explicit consent.

14.1 dd22 reserves the right to update or amend this Privacy Policy at any time. The most current version of this Privacy Policy will always be available at https://dd22.io/privacy-policy, and the "Last updated" date at the top of this page will reflect the date on which the most recent changes were made.

14.2 Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way in which dd22 processes your personal data — dd22 will notify registered players via email at least 14 days before the changes take effect. Continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

14.3 We encourage you to review this Privacy Policy periodically so that you remain informed about how dd22 is protecting your data. If you have any concerns about a proposed change, please contact [email protected] before the effective date.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which dd22 processes your personal data, please get in touch with our data protection team using the contact details below.

15.2 Email (plain text — not a clickable link): [email protected]

15.3 Response Time: dd22 aims to respond to all privacy-related enquiries within 2 business days (Bangladesh Standard Time, UTC+6). Formal data rights requests (Section 8) will be fully responded to within 30 calendar days of receipt of a verified request.

15.4 Language: All privacy enquiries should be submitted in English. Our data protection team operates in English and will respond in English.