Privacy Policy — How 21bd Protects Your Data

Payment Service Providers. Transaction data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank solely to process deposit and withdrawal requests you have initiated. Each payment provider processes your data under their own independent privacy policy and applicable financial regulations.

Identity Verification Services. Where 21bd uses a third-party KYC verification service to assist with document authentication or age verification, identity and verification data may be shared with that provider. All KYC partners used by 21bd are contractually required to process data only for verification purposes and to maintain appropriate security standards.

Game Content Providers. 21bd's casino and sports betting content is supplied by third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers operate their own game servers, and technical data (such as your session token and anonymised player identifier) is passed to the relevant provider when you launch a game. Game providers do not receive your full name, contact details, or financial data.

Legal and Regulatory Authorities. 21bd may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where we are required to do so by applicable law, court order, or lawful request. 21bd will not notify you of such a disclosure where doing so would itself constitute a breach of law or compromise an active investigation.

Fraud Prevention Networks. In cases of confirmed or strongly suspected fraud, money laundering, or multi-accounting, 21bd may share relevant account and financial data with industry fraud prevention databases or networks for the purpose of protecting other operators and players from the same harmful actors.

All data transmitted between your device and 21bd.club is encrypted using TLS (Transport Layer Security) with a minimum of 256-bit encryption. This means that data in transit — including your login credentials, payment details, and KYC documents — is protected against interception. The padlock icon visible in your browser's address bar confirms that an encrypted connection is active.

Passwords are never stored in plain text. 21bd stores only a cryptographic hash of your password, generated using a strong one-way hashing algorithm with a unique salt per account. This means that even in the unlikely event of a database breach, your actual password cannot be derived from the stored hash.

Access to personal data within 21bd's internal systems is restricted on a strict need-to-know basis. Staff members who require access to player data as part of their role — such as the KYC verification team and the customer support team — are granted only the minimum level of access necessary to perform their function. All internal access is logged and subject to periodic review.

KYC document scans and identity verification images are stored in encrypted, access-controlled storage environments. These documents are retained for a minimum period consistent with anti-money-laundering record-keeping requirements — typically five years from the date of the last account transaction. After this retention period, documents are securely deleted.

The general data retention schedule 21bd follows is as follows:

• Active account data — retained for the lifetime of the account plus five years after account closure.
• Transaction records — retained for a minimum of five years from the date of the transaction.
• KYC documents — retained for a minimum of five years from the date of submission.
• Customer support communications — retained for three years from the date of the last interaction in a support case.
• Analytics and usage data — retained in anonymised aggregate form indefinitely; identifiable usage logs are deleted after 12 months.
• Marketing consent records — retained for as long as you hold an active 21bd account, plus one year after account closure as evidence of consent.

All privacy-related enquiries and formal data rights requests should be directed to the 21bd support team at [email protected]. Please include "Privacy Request" or "Data Rights" in the subject line of your email so that your message is routed to the correct team promptly.

When submitting a data rights request, please include the following information to help us process your request efficiently:

• Your full name as registered on your 21bd account
• Your 21bd username
• The email address associated with your 21bd account
• A clear description of the right you wish to exercise (e.g., "I am requesting a copy of all personal data you hold about me")
• Any additional details relevant to your specific request

21bd aims to acknowledge all privacy enquiries within 2 BST business days and to provide a substantive response within 30 calendar days. In cases where a request is complex or where we receive a high volume of simultaneous requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

21bd support operates during Bangladesh Standard Time (BST, UTC+6) business hours, Monday through Saturday. Enquiries submitted outside of these hours will be acknowledged on the next available business day.