df77 Privacy Policy — How We Collect, Use, and Protect Your Data

Introduction

df77 ("we", "us", "our") is committed to protecting the personal data of every player who accesses and uses the df77 platform at df77.io. This Privacy Policy sets out how we collect, store, use, disclose, and protect your personal information when you interact with the df77 website, mobile interface, and all associated services.

This policy applies to all players registered on df77, all visitors to the df77 website, and all persons who contact df77 through any supported communication channel. By accessing the df77 platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein.

This Privacy Policy should be read alongside the df77 Terms & Conditions and Responsible Gaming Policy. In the event of a conflict between this Privacy Policy and any other df77 document, this Privacy Policy shall govern matters relating to the collection and handling of personal data.

Data Controller

For the purposes of this Privacy Policy, df77 acts as the data controller in respect of the personal data collected from players and website visitors. As data controller, df77 determines the purposes and means by which your personal data is processed.

All data protection queries, subject access requests, and privacy-related complaints should be directed to the df77 data protection contact using the details provided in Section 15 of this policy. df77 commits to acknowledging all privacy-related correspondence within 5 business days and to providing a substantive response within 30 calendar days of receipt.

Where df77 engages third-party service providers to process data on its behalf (for example, identity verification partners or payment processors), those providers act as data processors under df77's instruction and are bound by contractual data protection obligations consistent with the standards set out in this policy.

Data We Collect

df77 collects the following categories of personal data in the course of providing its betting and casino platform services to players in Bangladesh:

df77 does not collect any special categories of personal data (such as health, biometric, religious, or political data) unless strictly required to fulfil a legal obligation and only with your explicit consent. We do not sell personal data to third parties under any circumstances.

How We Collect Data

df77 collects personal data through the following channels and methods:

• Direct provision by you: When you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion, you provide personal data directly to df77.
• Automated collection: When you browse or use the df77 platform, we automatically collect technical and usage data through cookies, server logs, and similar tracking technologies. This includes your IP address, device identifiers, and session activity.
• Third-party sources: We may receive identity and fraud-screening data from KYC service providers, receive transaction confirmation data from payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, Mastercard), and receive risk signals from anti-fraud partners.
• Publicly available sources: In certain circumstances, df77 may cross-reference your data against publicly available sanctions lists, politically exposed persons (PEP) databases, or adverse media sources as part of our anti-money laundering obligations.

You are under no obligation to provide personal data to df77. However, failure to provide mandatory data at registration or during KYC verification will prevent df77 from opening or maintaining your account or processing financial transactions.

Legal Basis for Processing

df77 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Performance of a contract: The majority of df77's data processing is necessary for the delivery of the betting and casino services described in the Terms & Conditions. This includes account management, bet settlement, payment processing, and customer support.
• Legal obligation: df77 is required by applicable anti-money laundering regulations, financial crime prevention obligations, and responsible gaming requirements to process certain categories of personal data, including identity verification documents and transaction records.
• Legitimate interests: df77 processes technical and usage data on the basis of its legitimate interests in maintaining a secure, fair, and well-functioning platform — including fraud prevention, abuse detection, platform performance monitoring, and responsible gaming signal analysis.
• Consent: Where df77 processes data for marketing communications or optional analytics beyond the scope of core service delivery, we will seek your explicit consent. You may withdraw consent at any time by contacting [email protected] or adjusting your account communication preferences.

How We Use Your Data

df77 uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your account, verify your identity and age (21+ requirement), maintain your account profile, and communicate account-related updates.
• Service delivery: To accept and settle bets, process deposits and withdrawals, credit and track bonuses, and provide access to casino games and sports betting markets.
• Payment processing: To facilitate deposits and withdrawals through bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard, and to maintain records of all financial transactions for reconciliation and dispute resolution.
• Fraud prevention and security: To detect and prevent fraudulent activity, unauthorised account access, money laundering, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Responsible gaming monitoring: To identify behavioural signals that may indicate problem gambling and to enforce the responsible gaming tools available to players, including deposit limits, cool-off periods, and self-exclusion.
• Legal and regulatory compliance: To fulfil df77's obligations under applicable anti-money laundering laws, to respond to lawful requests from competent authorities, and to maintain records required by applicable regulations.
• Customer support: To respond to enquiries, resolve disputes, and maintain records of all support interactions for quality assurance purposes.
• Platform improvement: To analyse usage patterns, identify technical issues, and optimise the performance and user experience of the df77 platform.
• Marketing communications: Where you have provided consent, to send you promotional offers, bonus announcements, and platform news relevant to your interests as a df77 player.

df77 does not use automated decision-making processes that produce legal or similarly significant effects without human oversight. Where automated processes flag an account for review (e.g., fraud detection), a human member of the compliance team will review the case before any material action is taken against the account.

Data Sharing & Disclosure

df77 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share your personal data only in the following limited and controlled circumstances:

• Payment processors: We share necessary financial data (transaction amounts, account identifiers) with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard solely to process deposits and withdrawals on your behalf.
• Identity verification providers: We share identity documents and personal identifiers with KYC service partners to verify your identity and age as required by our responsible gaming and anti-money laundering obligations.
• Game providers: We share your player identifier (not your full identity) with licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to enable game session management and fair-play certification.
• Anti-fraud and AML screening partners: We share data with fraud detection and financial crime prevention service providers to protect the integrity of the df77 platform and to meet our legal obligations.
• Legal and regulatory authorities: df77 will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by a valid legal obligation, court order, or regulatory direction. We will notify you of such disclosures unless we are legally prohibited from doing so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of df77's business assets, personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection commitments being in place.

All third-party service providers who process personal data on behalf of df77 are bound by written data processing agreements that require them to process data only on df77's documented instructions, to maintain appropriate security measures, and to assist df77 in responding to player data subject requests.

Cookies & Tracking Technologies

df77 uses cookies and similar tracking technologies to deliver and improve its platform services. A cookie is a small text file placed on your device when you visit a website. Cookies allow df77 to recognise your browser, remember your preferences, maintain your session state, and analyse how the platform is used.

df77 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable core features such as user authentication, session management, security token handling, and fraud prevention. These cookies cannot be disabled without significantly impairing your ability to use df77.
• Functional Cookies: These cookies remember your preferences (such as language settings, game lobby view, and notification preferences) to provide a more personalised experience on df77.
• Analytical Cookies: These cookies collect aggregated, anonymised data about how players interact with the df77 platform — including pages visited, time on platform, and feature usage — to help us identify areas for improvement.
• Marketing Cookies: Where you have provided consent, these cookies allow df77 to measure the effectiveness of promotional campaigns and to deliver relevant offers. Marketing cookies are not placed without your consent.

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please be aware that blocking strictly necessary cookies will affect the functionality of the df77 platform and may prevent you from logging in or placing bets.

Data Retention

df77 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following retention periods apply as standard:

• Account and identity data: Retained for the full duration of your account and for a minimum of 5 years following account closure, in line with standard anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required by applicable financial regulations.
• Betting and gaming history: Retained for a minimum of 3 years following the last activity on your account.
• Customer support correspondence: Retained for a minimum of 2 years from the date of the last interaction in a support thread.
• Technical and usage data (logs): Retained for up to 12 months from collection, after which they are anonymised or deleted.
• Marketing consent records: Retained for the duration of your consent plus 2 years following withdrawal of consent, to demonstrate compliance.

When personal data is no longer required for any of the above purposes and no legal obligation requires its continued retention, df77 will securely delete or anonymise the data using industry-standard methods that prevent reconstruction.

Data Security

df77 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the df77 platform is protected by 256-bit SSL/TLS encryption, ensuring that your personal and financial information cannot be intercepted in transit.
• Password hashing: Account passwords are never stored in plain text. df77 uses industry-standard cryptographic hashing algorithms to store password credentials.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their df77 accounts. 2FA adds an additional verification step to the login process, significantly reducing the risk of unauthorised account access.
• Access controls: Access to player personal data within df77's systems is restricted on a strict need-to-know basis. Internal access logs are maintained and reviewed regularly.
• Regular security assessments: df77 conducts periodic vulnerability assessments and security reviews of its platform infrastructure to identify and remediate potential weaknesses.
• Incident response: df77 maintains a documented data breach response procedure. In the event of a personal data breach that presents a risk to players, df77 will notify affected players promptly and take all reasonable steps to contain and mitigate the breach.

Your Rights

As a player on the df77 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact df77 at [email protected] with a clear description of your request. df77 will respond within 30 calendar days.

• Right of access: You have the right to request a copy of the personal data df77 holds about you. df77 will provide this in a structured, commonly used format.
• Right to rectification: If any personal data df77 holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
• Right to erasure: You may request that df77 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests. Note that this right is subject to df77's legal retention obligations — data required for AML compliance cannot be erased until the statutory retention period has elapsed.
• Right to restriction of processing: In certain circumstances (for example, while a dispute about data accuracy is resolved), you may request that df77 restrict the processing of your data to storage only.
• Right to data portability: Where processing is based on your consent or contract performance, you have the right to receive your personal data in a machine-readable format and to request that it be transferred to another service provider where technically feasible.
• Right to object: You have the right to object to processing carried out on the basis of df77's legitimate interests. df77 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

df77 will not charge a fee for responding to reasonable data subject requests. If a request is manifestly unfounded or excessive, df77 reserves the right to charge a reasonable administrative fee or to decline the request, providing written reasons for the decision.

Children's Privacy

The df77 platform is strictly for adults aged 21 and above. df77 does not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is conducted at the point of registration and is reinforced through KYC checks during the account lifecycle.

If df77 becomes aware that personal data has been collected from a person under the age of 21 — whether through misrepresentation at registration or through subsequent identity verification — we will immediately suspend the relevant account, delete the collected data to the extent permitted by law, and return any real money funds through the original payment method following identity confirmation.

Third-Party Links

The df77 platform may contain references to or integrations with third-party game providers, payment processors, and data verification services. While df77 selects its partners carefully, we are not responsible for the privacy practices of third-party organisations. Each third-party provider operates under its own privacy policy and data protection framework.

df77 does not embed third-party advertising or affiliate tracking scripts that collect your personal data for the benefit of external advertisers. Any data shared with third parties is limited strictly to what is necessary to deliver df77's core platform services, as described in Section 7 of this policy.

We encourage you to review the privacy policies of any third-party service you interact with through or in connection with the df77 platform, including your mobile payment provider (bKash, Nagad, Rocket) and your bank.

Changes to This Policy

df77 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform functionality. The effective date at the top of this document indicates when the current version came into force.

Where changes to this Privacy Policy are material — for example, where we introduce a new purpose for processing your data or a new category of third-party sharing — df77 will notify you by email at the address registered to your account at least 14 days before the changes take effect. For minor or administrative updates, the revised policy will be published on the df77 website and the effective date updated accordingly.

Your continued use of the df77 platform after any update to this Privacy Policy constitutes your acknowledgement of the revised document. If you do not accept the revised terms, you must cease using the platform and may request account closure by contacting [email protected].

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact the df77 data protection team using the details below. All privacy-related communications must be submitted in English.

When submitting a data subject request, please include your full name, the email address associated with your df77 account, and a clear description of your request. df77 may request additional identification to verify your identity before processing the request, in order to protect your data from unauthorised third-party access.