desi28 Privacy Policy — Your Data, Your Rights, Our Commitment

1. Information We Collect

desi28 collects personal information about you when you register an account, use the platform's services, contact our support team, or interact with the site in any other way. The categories of data we collect are described below.

1.1 Registration & Account Data

When you create a desi28 account, we collect the following information:

• Full legal name — to identify your account and match it against KYC documents.
• Date of birth — to verify that you meet the minimum age requirement of 18 years.
• Mobile number or email address — used for account communications, security alerts, and support correspondence.
• Username and encrypted password — your chosen login credentials. Passwords are stored using one-way cryptographic hashing and are never accessible to desi28 staff.
• Residential address — collected as part of the KYC process where required for enhanced account verification.

1.2 Identity Verification (KYC) Documents

Before processing your first withdrawal, and at any point where our compliance team requires enhanced verification, we may collect copies of the following documents:

• National Identity Card (NID) issued by the Bangladesh Election Commission, or a valid passport showing your full name, photograph, date of birth, and document number.
• Proof of Address — a recent utility bill, bank statement, or government-issued letter dated within the last three months confirming your residential address.
• Payment Method Verification — a screenshot or confirmation of the bKash, Nagad, Rocket, or Upay account registered in your name, to confirm ownership of the payment method used on your desi28 account.

KYC documents are stored in encrypted form and are accessible only to authorised compliance personnel. They are never shared with third parties outside the scope described in Section 3 of this policy.

1.3 Transaction & Financial Data

When you make deposits or request withdrawals, desi28 records the following transactional information:

• Deposit and withdrawal amounts in Bangladeshi Taka (BDT)
• Transaction reference numbers (e.g., bKash transaction ID, Nagad reference)
• Date and time of each transaction (Bangladesh Standard Time, UTC+6)
• Payment method used (bKash, Nagad, Rocket, Upay, bank transfer)
• Account balance history and bonus fund movements

This financial data is retained for a minimum of five years in accordance with our record-keeping obligations and may be used in the resolution of payment disputes.

1.4 Gameplay & Betting Data

desi28 automatically records all gameplay and betting activity associated with your account, including:

• Games played, bets placed, and outcomes recorded
• Wager amounts, win/loss records, and session durations
• Bonus activations, wagering progress, and promotional participation
• Sports betting markets accessed and bet selections made

This data is used to maintain accurate account records, resolve disputes, detect bonus abuse, and monitor for responsible gaming indicators such as unusual betting patterns.

1.5 Technical & Device Data

When you access the desi28 platform, our servers automatically collect certain technical information, including:

• IP address and approximate geographic location (country/city level)
• Device type, operating system, and browser version
• Pages visited, click paths, and time spent on each page
• Referral URL (the website or link that directed you to desi28)
• Session start and end times

Technical data is used for platform security, fraud detection, performance optimisation, and ensuring that the desi28 website functions correctly across different devices and network conditions.

1.6 Communications Data

If you contact desi28 via Live Chat, email, or WhatsApp, we retain records of those communications — including the content of messages, the date and time of contact, and any resolution steps taken. This data is used to manage support queries, improve service quality, and maintain a record of complaints or escalations.

2. How We Use Your Data

desi28 processes your personal data only for specific, legitimate purposes. The table below summarises the main purposes for which we use your information and the legal basis for doing so.

desi28 does not use your personal data for automated decision-making that produces significant legal or similarly significant effects without human review. If you have questions about how a specific decision affecting your account was made, please contact our support team.

3. Data Sharing & Third Parties

desi28 does not sell your personal information to any third party. However, in order to operate the platform and comply with legal obligations, we do share data with a limited set of trusted service providers and authorities as described below.

3.1 Payment Processing Partners

To process your deposits and withdrawals, desi28 shares the minimum necessary financial data with our payment processing partners, which include the operators of bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. Data shared with payment partners is limited to transaction reference details required to verify and complete a payment. These partners operate under their own privacy policies and security frameworks.

3.2 Game Technology Providers

The games available on desi28 are supplied by third-party game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive session tokens or anonymised identifiers to authenticate your game session and record round outcomes. Game providers do not receive your full name, NID details, or payment method information.

3.3 Regulatory & Law Enforcement Authorities

desi28 is required by applicable law to disclose personal data to relevant authorities in specific circumstances, including:

• Where a court order, warrant, or legally binding request from a competent authority requires disclosure
• Where desi28 is required to file a Suspicious Transaction Report (STR) under its Anti-Money Laundering obligations
• Where disclosure is necessary to protect the rights, property, or safety of desi28, its players, or the general public

In all such cases, desi28 will disclose only the minimum information required to satisfy the legal obligation and will, where legally permitted, notify the affected player of the disclosure.

3.4 Technology Infrastructure & Cloud Services

desi28 uses third-party cloud hosting, content delivery, and analytics infrastructure to operate the platform. These service providers process data on our behalf under strict data processing agreements and are not permitted to use your data for their own purposes. All infrastructure partners are required to maintain security standards consistent with or exceeding those described in Section 5 of this policy.

3.5 Business Transfers

In the event that desi28 undergoes a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, desi28 will notify registered players in advance via their registered contact method and will ensure that the acquiring entity is bound by privacy obligations no less protective than those set out in this policy.

4. Cookies & Tracking Technologies

desi28 uses cookies and similar tracking technologies to operate the platform, remember your preferences, keep your session active, and understand how players interact with the website. This section explains the types of cookies we use and the options available to you.

desi28 does not use advertising or retargeting cookies. We do not share cookie data with advertising networks or social media platforms for the purpose of serving you targeted advertisements on other websites.

4.1 Managing Your Cookie Preferences

You can manage cookie settings through your browser's built-in privacy controls. Most modern browsers — including Chrome, Firefox, Safari, and Opera Mini (widely used across Bangladesh) — allow you to view, block, or delete cookies at any time. Please note that disabling strictly necessary or security cookies will prevent the desi28 platform from operating correctly and may result in your session being terminated.

For detailed instructions on managing cookies in your specific browser, refer to your browser's Help documentation. If you have questions about how desi28 uses cookies, contact support at support@desi28.app.

5. Data Security Measures

desi28 implements a layered security architecture to protect your personal information against unauthorised access, disclosure, alteration, or destruction. Our security measures include but are not limited to:

1. Transport Layer Security (TLS): All data exchanged between your device and the desi28 servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed to ensure continuous protection.
2. Password Hashing: Account passwords are processed through a one-way cryptographic hashing algorithm before storage. desi28 staff cannot read or retrieve your password in plain text under any circumstances.
3. Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Only authorised team members — such as compliance officers handling KYC reviews and support agents resolving account queries — can access your account data, and only to the extent required to perform their role.
4. Encrypted Document Storage: KYC documents are stored in encrypted form in access-restricted storage environments. Encryption keys are managed separately from the data they protect.
5. Intrusion Detection & Monitoring: The desi28 infrastructure is monitored continuously for signs of unauthorised access, anomalous traffic patterns, and potential security incidents. Alerts are reviewed by our security team around the clock.
6. Regular Security Reviews: desi28 conducts periodic internal reviews of its security posture and data handling practices to identify and address vulnerabilities before they can be exploited.

6. Data Retention Policy

desi28 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Once the applicable retention period has expired and there is no outstanding legal hold or active investigation requiring the data, desi28 will securely delete or anonymise the relevant personal information. Anonymised data — where all identifying details have been irreversibly removed — may be retained indefinitely for statistical and analytical purposes.

7. Your Privacy Rights

As a desi28 player, you have the following rights with respect to your personal data. To exercise any of these rights, contact our support team via Live Chat or by emailing support@desi28.app. We will respond to verified requests within 30 calendar days.

1. Right of Access: You have the right to request a copy of the personal data desi28 holds about you, including your account registration details, transaction history, and gameplay records. This is sometimes called a Subject Access Request (SAR).
2. Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Some account details (such as your date of birth) can only be amended following submission of supporting documentation.
3. Right to Erasure: In certain circumstances, you may request that desi28 delete your personal data. This right is subject to limitations — for example, we cannot delete data that we are legally required to retain for AML compliance or that is necessary to resolve an open dispute or investigation.
4. Right to Restrict Processing: You may request that desi28 restrict the processing of your personal data in certain situations — for example, while a rectification request is being assessed or where you have objected to processing based on legitimate interest.
5. Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, machine-readable format (such as CSV or JSON) so that it can be transferred to another service if you wish.
6. Right to Object: You have the right to object to the processing of your personal data where desi28 relies on a legitimate interest as the legal basis for that processing. You also have an absolute right to object to processing for direct marketing purposes at any time.
7. Right to Withdraw Consent: Where processing is based on your consent (for example, receiving promotional communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

desi28 will not discriminate against you — for example, by restricting your access to the platform or applying less favourable account terms — because you have exercised any of the rights described above. If you are not satisfied with how desi28 has handled a privacy request or complaint, you may escalate the matter by emailing support@desi28.app with the subject line "Privacy Complaint".

8. Updates to This Policy

desi28 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, the effective date displayed at the top of this page will be updated, and where practicable, registered players will be notified via their registered contact method or via a notice on the platform upon login.

Your continued use of the desi28 platform after the revised Privacy Policy comes into effect constitutes your acceptance of the updated terms. If you do not agree with any material change, you should cease using the platform and may request account closure in accordance with our Terms & Conditions.

We recommend bookmarking this page and checking it periodically. If you have any questions about a change to this policy, contact our support team via Live Chat or at support@desi28.app.