bb678 Privacy Policy

This Privacy Policy ("Policy") describes how bb678 ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and protects personal information submitted by users ("you", "your", "Player") when accessing or using the bb678 website at https://bb678.io and all associated services, games, and features.

bb678 is committed to maintaining the highest standards of data privacy and information security. We recognise that our players in Bangladesh entrust us with sensitive personal and financial information, and we take that responsibility seriously. This Policy is intended to give you a clear and complete picture of how your data is handled from the moment you register an account through to the time your account is closed.

This Policy applies to all personal data collected through the bb678 website, mobile-optimised browser experience, customer support channels (email and live chat), and any other touchpoint through which you interact with bb678. It does not apply to third-party websites or services that may be linked to or from our platform — each third party operates under its own privacy terms.

bb678 collects personal data in three ways: information you provide directly, information generated automatically by your use of the platform, and information we receive from trusted third-party partners. The categories of data we collect are set out below.

bb678 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than photographic ID submitted for age verification), or health information, except where required by responsible gaming obligations (e.g., self-exclusion records).

bb678 uses the personal data described above for the following specific purposes. Each purpose is supported by an appropriate legal basis as described in Section 4.

• Account creation and management: To register your bb678 account, verify your identity and age (21+ requirement), maintain your account profile, process password resets, and communicate account-related notices.
• Payment processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank transfer methods. Financial data is shared with payment processors solely for the purpose of completing your requested transactions.
• Identity and age verification (KYC): To confirm that you are who you claim to be and that you are at least 21 years of age, in compliance with responsible gaming standards and anti-money laundering requirements.
• Fraud prevention and security: To monitor account activity for signs of unauthorised access, multi-accounting, money laundering, bonus abuse, and other prohibited conduct. Technical data including IP addresses and device fingerprints are used to identify suspicious patterns.
• Responsible gaming compliance: To monitor gambling patterns, enforce deposit limits and self-exclusion requests, send responsible gaming alerts, and fulfil our obligations to protect vulnerable players.
• Service improvement and analytics: Aggregated, anonymised usage data is analysed to understand how players interact with bb678, identify bugs or performance issues, and improve the overall platform experience.
• Promotional communications (with consent): Where you have explicitly opted in to marketing, we will send you promotional emails and SMS messages about bb678 bonuses, new games, cricket betting markets, and seasonal promotions. You may withdraw this consent at any time.
• Legal and regulatory compliance: To retain records and fulfil reporting obligations as required by applicable law, including cooperation with any lawful investigation by a competent authority.

bb678 does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you without your knowledge or ability to contest the outcome.

bb678 processes your personal data on the following legal grounds:

• Performance of a contract: Processing that is necessary to operate your bb678 account, process transactions, and deliver the services you have requested — including account registration, game access, and payment handling.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering (AML) obligations, age verification requirements, and record-keeping duties.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where our legitimate interests in operating a safe and compliant platform are not overridden by your privacy rights.
• Consent: Processing for optional purposes such as marketing communications, where you have provided a clear, freely given, and revocable consent. You may withdraw consent at any time by updating your account preferences or contacting support.

bb678 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share data only where strictly necessary, with the following categories of recipients:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and other payment processing partners receive financial transaction data solely to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to applicable financial regulations.
• KYC and identity verification partners: Third-party identity verification services receive copies of your identity documents and personal details for the purpose of confirming your identity and age. These partners are contractually prohibited from using your data for any purpose other than verification.
• Game providers and content studios: Licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data (e.g., game round IDs, bet amounts) to facilitate game delivery, resolve technical disputes, and ensure fair play. No directly identifiable personal data (name, NID, contact details) is shared with game studios.
• Fraud detection and security services: Specialist providers of IP intelligence, device fingerprinting, and behavioural analytics receive technical data to assist in identifying and preventing fraudulent activity on the bb678 platform.
• Legal and regulatory authorities: bb678 may disclose personal data to competent authorities — including law enforcement, financial intelligence units, or courts — where required to do so by applicable law, court order, or regulatory directive. bb678 will notify affected players of such disclosures where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, restructuring, or sale of assets involving bb678, player data may be transferred to the acquiring or successor entity, subject to equivalent privacy protections. Affected players will be notified of any such transfer in advance.

All third-party service providers who process personal data on behalf of bb678 are required to enter into data processing agreements that restrict their use of player data to the specific purpose for which it was shared and require them to implement appropriate security measures.

bb678 uses cookies and similar tracking technologies — including local storage, session storage, and pixel tags — to ensure the platform functions correctly, to remember your preferences, and to gather analytical insights about how players use our services.

The categories of cookies we use are as follows:

• Strictly necessary cookies: These are essential for the bb678 platform to operate. They manage your login session, maintain your account state between pages, and enable core platform functions such as the cashier and game launcher. These cookies cannot be disabled without breaking the platform.
• Functional cookies: These remember your preferences such as language settings, display options, and notification settings, so you do not need to re-enter them each visit.
• Analytical cookies: We use anonymised analytics tools to understand aggregate player behaviour — which pages are most visited, where players encounter errors, and how the registration funnel performs. This data is collected in aggregate and is not linked to your individual identity.
• Security cookies: Used to detect fraudulent activity, bot traffic, and multi-account behaviour. These cookies are part of our fraud prevention infrastructure and are treated as strictly necessary.

bb678 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not share cookie data with advertising networks or data brokers.

bb678 implements a comprehensive, layered information security programme to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your device and bb678's servers is encrypted using TLS 1.2 or higher (256-bit encryption). Our entire platform operates over HTTPS; unencrypted HTTP connections are automatically redirected.
• Encryption at rest: Sensitive data fields — including identity document copies, financial account references, and authentication credentials — are encrypted at rest in our databases using AES-256.
• Password security: Passwords are never stored in plain text. bb678 uses industry-standard bcrypt hashing with an appropriate cost factor, ensuring that even in the event of a database breach, raw passwords remain protected.
• Two-factor authentication: bb678 offers SMS OTP two-factor authentication for all player accounts. Players are strongly encouraged to enable this feature in their account security settings.
• Access controls: Access to production systems and player data is restricted to authorised bb678 personnel on a strict need-to-know basis. All internal access is logged, monitored, and audited.
• Security audits: bb678 conducts regular internal and third-party security assessments, including penetration testing of the web application and underlying infrastructure, to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data security incident that poses a material risk to player data, bb678 will notify affected players and relevant authorities as required by applicable law, within the timeframes prescribed.

bb678 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law, whichever is longer. Our standard retention schedules are as follows:

Upon expiry of the applicable retention period, bb678 will securely delete or anonymise your personal data in a manner that renders it irrecoverable. Where anonymisation is used, the resulting data — which can no longer identify you — may be retained indefinitely for statistical purposes.

As a bb678 player whose personal data we process, you have the following rights with respect to your data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and respond in full within 10 business days.

• Right of access: You may request a copy of the personal data bb678 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. You may update most profile information directly within your account settings.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no overriding legal obligation requires its retention. Note that regulatory retention obligations (e.g., AML record-keeping) may prevent us from fulfilling erasure requests in full.
• Right to restriction of processing: You may request that we restrict the processing of your data while a dispute about its accuracy or the lawfulness of its processing is being resolved.
• Right to data portability: Where processing is based on your consent or the performance of a contract, you may request that we provide your personal data in a structured, machine-readable format (e.g., CSV) so that it can be transferred to another service provider of your choice.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

bb678 operates a strict 21+ only policy. We do not knowingly collect personal data from, or provide services to, any person under the age of 21. The bb678 platform is not designed for, directed at, or intended to attract minors.

If bb678 discovers or is notified that personal data has been collected from a person under the age of 21, we will promptly close the associated account, forfeit any balances in accordance with our Terms & Conditions, and delete all personal data associated with that account as soon as technically practicable.

If you are a parent or guardian and you believe that your child under the age of 21 has registered an account on bb678, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and take immediate action.

bb678 recommends that households with minors implement parental control software to restrict access to online gambling platforms. Third-party tools such as browser-level content filters can help prevent underage access to services like bb678.

The bb678 platform may contain references to third-party game providers, payment processors, and other external services. While bb678 takes care to engage only reputable third-party partners, we have no control over the privacy practices or content of third-party websites or services.

This Privacy Policy applies solely to data collected directly by bb678 through the https://bb678.io platform and its associated customer service channels. When you interact with a third-party service — such as completing a bKash payment within the bKash app — you are subject to that third party's own privacy policy and terms of service.

bb678 encourages you to review the privacy policies of any third-party service you use in connection with your bb678 account, particularly payment service providers, before submitting personal data to them.

bb678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. The most current version of the Policy will always be published on this page, with the "Last Updated" date revised accordingly.

Where changes to the Policy are material — meaning they significantly affect how we collect, use, or share your personal data — bb678 will notify registered players by email to their registered address at least fourteen (14) days before the changes take effect. For non-material updates (e.g., clarifications, formatting corrections), we will update the Policy without advance notice.

Continued use of the bb678 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a revised Policy, you must close your account and cease using the platform before the effective date of the changes.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bb678 handles your personal data, please contact our Data Privacy team using the details below. All privacy-related communications must be submitted in writing.

Email: [email protected] (subject line: "Privacy Enquiry")

Our support team operates seven days a week, including Bangladesh public holidays. We aim to acknowledge all privacy enquiries within three (3) business days and provide a full response within ten (10) business days. Complex requests — such as full data subject access requests — may take up to thirty (30) days where permitted by applicable law, in which case we will notify you of the extended timeframe.

bb678 is committed to resolving all privacy concerns directly and promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with a competent supervisory authority under the laws applicable in your jurisdiction.