Your Privacy Matters at db678 —
Here Is How We Protect It

1 Introduction

db678 is committed to protecting the privacy and personal data of every player who registers and interacts with the db678 platform at https://db678.ws. This Privacy Policy sets out in clear, plain English how db678 collects, uses, stores, shares, and protects your personal information in connection with your use of the platform — including the website, account management system, payment processing interface, games, sports betting markets, and customer support channels.

This Privacy Policy applies to all registered players, prospective players who browse the db678 website without registering, and any individual who contacts db678 through the official support email at [email protected]. By accessing or using the db678 platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the platform immediately.

This Privacy Policy should be read alongside the db678 Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference. In the event of any conflict between these documents on privacy matters, this Privacy Policy shall take precedence.

2 Data We Collect

db678 collects personal data across several categories, depending on the nature of your interaction with the platform. The specific data collected in each category is described below.

db678 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly necessary for identity verification purposes. Where identity documents are submitted for KYC, they are processed securely and deleted from active systems once verification is complete.

3 How We Collect Data

db678 collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when completing the registration form, submitting a KYC verification request, making a deposit or withdrawal, or contacting the support team via email at [email protected].
• Automated technical collection: Data collected automatically by our servers each time you visit or interact with the db678 website, including your IP address, browser fingerprint, device identifiers, and session activity logs. This data is collected regardless of whether you are logged in to an account.
• Cookies and similar technologies: db678 uses first-party cookies and local browser storage to maintain session state, remember login status, and improve platform performance. Third-party analytics cookies may also be used to understand aggregate user behaviour. See Section 6 for full cookie details.
• Payment processors: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Visa, or Mastercard, the relevant payment service provider shares transaction confirmation data with db678, including the transaction reference number and the registered mobile number or masked card details associated with the transaction.
• Game providers: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may return game session data — such as round IDs, wager amounts, and outcomes — to db678 for settlement, dispute resolution, and responsible gaming monitoring purposes.
• Identity verification services: Where db678 uses a third-party KYC provider to verify identity documents, that provider may return a verification status result along with the data points checked (name, date of birth, document number) to db678.

4 Why We Use Your Data

db678 processes personal data only for specific, legitimate purposes. The legal basis and purpose for each type of processing are described below.

• Account administration: We use your identity and contact data to create and maintain your db678 account, verify your eligibility to play (including the 21+ age requirement), communicate important account notices, and process your deposit and withdrawal requests.
• Identity and age verification (KYC): db678 is required to verify the identity and age of all registered players as a condition of providing real-money gambling services. This is a fundamental consumer protection requirement and a condition of the platform's operational standards.
• Fraud prevention and security: Technical data, account activity data, and payment data are used to detect and prevent fraudulent account creation, money laundering, bonus abuse, chargebacks, and other prohibited conduct as defined in the db678 Terms & Conditions.
• Platform improvement: Anonymised and aggregated account activity and technical data are used to improve the platform's functionality, user interface, game selection, and payment processing reliability. This processing does not involve decisions made about individual players.
• Responsible gaming monitoring: db678 monitors account activity patterns — including deposit frequency, session duration, and betting behaviour — to identify signs of problem gambling and to apply responsible gaming interventions where appropriate. This processing is carried out in the player's interest and in accordance with the db678 Responsible Gaming policy.
• Marketing communications: With your explicit consent, db678 may send you promotional emails or platform notifications about bonuses, seasonal offers (such as Eid promotions, BPL cashback offers, and Pohela Boishakh specials), and new game releases. You may withdraw consent and unsubscribe at any time by contacting [email protected].
• Legal and regulatory compliance: db678 retains certain categories of personal data for the periods required by applicable law, including transaction records and account activity logs, in order to comply with anti-money-laundering obligations and to respond to formal legal requests.

5 Data Sharing

db678 does not sell, rent, or trade your personal data to any third party. Data is shared only in the following strictly limited circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the transaction data necessary to process your deposit or withdrawal. Each payment provider operates under its own privacy policy and is independently responsible for the data it receives and processes.
• Game providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a player session token and anonymised player identifier to facilitate game launch and round settlement. They do not receive your full name, contact details, or payment information.
• Identity verification providers: Where a third-party KYC service is used, your identity document data is transmitted to that provider for the sole purpose of verification. Verification providers are contractually prohibited from retaining or using your data for any other purpose.
• Legal authorities: db678 will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by a valid legal order, court warrant, or applicable law. db678 will notify affected players of such disclosures wherever legally permitted to do so.
• Platform infrastructure providers: Cloud hosting, database, and security service providers that support the technical operation of the db678 platform may process data on db678's behalf as data processors. These providers are bound by data processing agreements that restrict their use of your data to platform operation only.

All third parties with whom db678 shares personal data are required to maintain appropriate technical and organisational security measures to protect that data. db678 does not permit third-party service providers to use player data for their own marketing purposes.

6 Cookies & Tracking Technologies

db678 uses cookies and similar browser-based storage technologies to deliver a functional, personalised, and secure platform experience. The cookies used on the db678 platform fall into the following categories:

Strictly necessary cookies are essential for the db678 platform to function and cannot be disabled without affecting core functionality such as login and payment processing. All other cookies may be managed through your browser settings. Most modern browsers allow you to view, delete, and block cookies through the browser's privacy or settings menu.

db678 does not use advertising cookies, retargeting pixels, or social media tracking scripts on its platform. No cookie data from the db678 platform is shared with social media advertising networks.

7 Data Security

db678 implements a comprehensive set of technical and organisational security measures to protect player personal data from unauthorised access, accidental loss, alteration, disclosure, or destruction. The key security measures in place include:

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and the db678 servers is encrypted using 256-bit SSL/TLS protocols. This applies to all interactions including login, game play, payment processing, and support communications.
• Encrypted data at rest: Sensitive personal data stored in db678 databases — including identity data and payment reference data — is encrypted at rest using AES-256 encryption.
• Access controls: Access to player personal data within db678's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access control policies, and all internal data access is logged and audited.
• Password security: Player account passwords are stored as salted cryptographic hashes. db678 does not have access to plaintext passwords and cannot retrieve them — only a password reset is possible in the event of a forgotten password.
• Network security: db678's infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation technologies. The platform undergoes regular security assessments to identify and remediate vulnerabilities.
• Payment data isolation: db678 does not store full card numbers or mobile wallet PINs. Payment credentials are handled exclusively by the respective payment service provider's PCI-DSS compliant systems. db678 receives only a tokenised reference for transaction reconciliation.

8 Data Retention

db678 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention guidelines apply:

• Active account data: Identity, contact, and account activity data is retained for the full duration of your active account plus a post-closure retention period of five years to comply with anti-money-laundering record-keeping obligations.
• Transaction records: Deposit and withdrawal transaction records are retained for a minimum of five years from the date of the transaction, in accordance with applicable financial record-keeping standards.
• KYC documentation: Identity documents submitted for KYC verification are retained for the duration of the account relationship and for five years following account closure. Documents are stored in encrypted form with access restricted to the verification team.
• Support communications: Email and live chat support records are retained for two years from the date of the last communication in a thread, to support quality assurance and dispute resolution.
• Responsible gaming records: Self-exclusion status, deposit limit settings, and cooling-off period records are retained for a minimum of five years to ensure that reactivation requests are assessed against an accurate history of responsible gaming interventions.
• Analytics data: Anonymised aggregate analytics data (from which no individual player can be identified) may be retained indefinitely for platform improvement purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Players may request early deletion of their personal data in the circumstances described in Section 9, subject to the legal and regulatory retention obligations described above.

9 Your Privacy Rights

As a player on the db678 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address associated with your db678 account. db678 will respond to all valid requests within 30 days of receipt.