Privacy Policy — How nd678 Protects Your Data

1. Information We Collect

nd678 collects personal information from you at various points during the account lifecycle — from initial registration through to ongoing account use and, where applicable, account closure. The categories of data we collect are set out below.

nd678 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information. If you voluntarily disclose such information during a support interaction or responsible gaming self-assessment, nd678 will treat it with heightened confidentiality and use it only for the specific purpose for which it was shared.

2. How We Use Your Data

nd678 processes your personal data only for lawful, specified, and legitimate purposes. The primary purposes for which nd678 uses your data are listed below, together with the legal basis for each processing activity.

• Account management and service delivery: nd678 uses your identity and contact data to create and maintain your player account, authenticate your login sessions, process deposits and withdrawals, and deliver customer support. This processing is necessary for the performance of the contract between you and nd678.
• Identity verification (KYC): nd678 is required to verify the identity and age of all registered players. Your identity and financial data are used to conduct KYC checks, anti-money laundering (AML) screening, and fraud detection. This processing is necessary for compliance with legal obligations.
• Payment processing: Financial data and transaction records are used to process deposits via bKash, Nagad, Rocket, Upay, and bank partners, and to process withdrawal requests to your registered payment method. This processing is necessary for contract performance.
• Responsible gaming monitoring: nd678 uses your usage data — including session frequency, wagering patterns, deposit velocity, and self-assessment responses — to identify players who may be at risk of problem gambling and to offer appropriate responsible gaming interventions. This processing is in nd678's legitimate interest and in the interest of player welfare.
• Platform improvement and analytics: Aggregated, anonymised usage and technical data are used to analyse platform performance, identify technical errors, improve game selection, and enhance user experience. Individual players are not identifiable from this aggregated analysis.
• Marketing communications: Where you have provided explicit consent at the time of registration or subsequently in your account settings, nd678 may send you promotional communications via email or SMS regarding nd678 bonuses, seasonal promotions (such as Eid, Pohela Boishakh, and BPL cricket season offers), and new game releases. You may withdraw consent and unsubscribe from marketing communications at any time by contacting [email protected].
• Legal compliance and dispute resolution: nd678 may process and retain your personal data as required by applicable law, including in response to lawful requests from law enforcement or regulatory authorities, or in connection with the investigation and resolution of disputes.

3. Data Sharing & Third Parties

nd678 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. However, nd678 does share limited personal data with carefully selected third-party service providers and partners where necessary to deliver the nd678 platform services. All third parties who receive your data are contractually required to process it only for the specified purpose, maintain appropriate security standards, and not disclose it further.

• Payment processing partners: Your financial data and transaction identifiers are shared with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card networks (Visa, Mastercard) solely for the purpose of processing your deposits and withdrawals. These providers operate under their own privacy and security frameworks.
• Identity verification providers: nd678 works with KYC and identity verification technology providers to validate documents submitted during account verification. These providers process your identity data on behalf of nd678 under strict data processing agreements.
• Game content providers: When you play games from studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi, limited technical data (such as a session token and game round identifier) is shared with those providers to facilitate gameplay. These providers do not receive your name, contact details, or financial data through this integration.
• Analytics and platform technology providers: nd678 uses third-party analytics tools to monitor platform performance and diagnose technical issues. These tools receive anonymised or pseudonymised technical data only. They do not receive your name, contact details, or financial information.
• Law enforcement and regulatory bodies: nd678 may be required by applicable law to disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities in response to lawful requests, court orders, or regulatory investigations. nd678 will notify affected users of such disclosures where legally permitted to do so.

4. Cookies & Tracking Technologies

nd678 uses cookies and similar tracking technologies on the nd678 platform to ensure that the site functions correctly, to remember your preferences, and to gather anonymised analytics data that helps nd678 improve the platform experience. The following categories of cookies are in use on nd678:

nd678 does not use third-party advertising cookies or behavioural targeting cookies. You may manage, restrict, or delete cookies at any time through your web browser's settings. Please note that disabling strictly necessary or security cookies may impair the functionality of your nd678 account. For guidance on managing cookies in your browser, consult your browser's help documentation.

5. Data Security & Storage

nd678 takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, disclosure, or destruction. These measures include:

• 128-bit SSL/TLS encryption for all data in transit between your device and the nd678 platform, including during login, deposits, withdrawals, and customer support sessions.
• Encryption at rest for sensitive data stored in nd678's database infrastructure, including identity documents submitted for KYC verification and financial transaction records.
• Strict internal access controls ensuring that nd678 staff can only access personal data on a need-to-know basis relevant to their job function. Access to sensitive financial and identity data is restricted to authorised personnel only.
• Regular security assessments and vulnerability testing of the nd678 platform infrastructure to identify and remediate potential security weaknesses before they can be exploited.
• Two-factor authentication (2FA) available for all nd678 player accounts, adding an additional layer of protection against unauthorised account access even if login credentials are compromised.
• Incident response procedures: In the event of a personal data breach, nd678 will assess the severity of the breach, take immediate containment steps, and notify affected users as promptly as possible. nd678 will also notify relevant authorities where required.

6. Your Privacy Rights

As a registered nd678 user, you hold a number of rights with respect to your personal data. nd678 is committed to facilitating the exercise of these rights in a timely and transparent manner. To exercise any of the rights listed below, contact nd678 at [email protected] with the subject line "Privacy Rights Request" and a description of your request. nd678 will acknowledge your request within 5 business days and respond substantively within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data held about you by nd678, including the purposes for which it is processed and the categories of recipients with whom it has been shared. This is known as a Subject Access Request (SAR).
• Right to Rectification: If any personal data held by nd678 is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update most of your personal details directly within your nd678 account settings.
• Right to Erasure ("Right to be Forgotten"): Following permanent account closure and subject to nd678's legal data retention obligations (see Section 7), you may request that nd678 delete your personal data. nd678 will action erasure requests within 30 calendar days and confirm in writing when deletion is complete.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of your data or have objected to its processing — you may request that nd678 temporarily restrict processing of your personal data while the matter is under review.
• Right to Data Portability: Where nd678 processes your personal data on the basis of your consent or for the performance of a contract, and where that processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object to Marketing: You have the right to object at any time to the processing of your personal data for direct marketing purposes. To unsubscribe from nd678 marketing communications, contact [email protected] or adjust your communication preferences in your account settings.
• Right to Withdraw Consent: Where nd678 processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

7. Data Retention Policy

nd678 retains your personal data for no longer than is necessary for the purposes for which it was collected, subject to any legal, regulatory, or contractual obligations that require longer retention. The general data retention periods applied by nd678 are set out below.

When your personal data reaches the end of its applicable retention period and there is no longer a lawful basis for continued retention, nd678 will securely delete or anonymise that data. Secure deletion means that data is permanently removed from all active systems and backup storage in a manner that makes recovery impossible.

Please note that where nd678 is required to retain your data for a minimum statutory period — for example, to comply with financial record-keeping regulations — nd678 cannot fulfil a right-to-erasure request in respect of that data until the statutory retention period has expired. nd678 will inform you of this limitation where applicable when responding to your erasure request.

8. Updates to This Policy

nd678 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made to this Privacy Policy, nd678 will notify registered users via email to their registered address and/or via an in-platform notification displayed on the nd678 website.

The date of the most recent revision is displayed at the top of this page under "Last Reviewed". nd678 encourages you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Continued use of the nd678 platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or nd678's data handling practices, please contact the nd678 data team directly:

• Email: [email protected] — use the subject line "Privacy Enquiry" for fastest routing.
• WhatsApp: +880 1700 000 678 — available 24/7 Bangladesh Standard Time (BST, UTC+6).
• Response time: nd678 aims to acknowledge all privacy-related enquiries within 2 business days and to provide a full substantive response within 30 calendar days.