678bf Privacy Policy

1. Introduction

678bf ("678bf", "we", "us", "our") is an online casino and sports betting platform designed for players in Bangladesh. We are committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with the 678bf platform at https://678bf.io and any associated mobile applications or sub-domains (collectively, "the Platform").

This Privacy Policy explains in detail how 678bf collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to the Platform ("you", "your"). It also sets out the rights you have regarding your personal data and how to exercise those rights.

This Privacy Policy should be read alongside the 678bf Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Privacy Policy and the Terms and Conditions regarding data protection matters, this Privacy Policy shall take precedence.

This Privacy Policy was last reviewed and updated on 1 January 2026. We encourage you to check this page periodically for any updates.

2. Data Controller

For the purposes of applicable data protection law, 678bf is the data controller responsible for the personal data collected through the Platform. This means 678bf determines the purposes for which and the means by which your personal data is processed.

If you have any questions about how your personal data is handled, or if you wish to exercise any of your data protection rights, you may contact the 678bf Data Protection team by email at [email protected]. We will acknowledge all data protection enquiries within 5 business days (Bangladesh Standard Time, UTC+6) and aim to provide a substantive response within 30 calendar days.

3. Data We Collect

678bf collects personal data from you through a number of channels and at various points during your relationship with the Platform. The categories of personal data we collect are described below.

3.1 Registration Data

When you create a 678bf account, we collect the following information:

• Full legal name (as it appears on your government-issued identification document);
• Date of birth (to verify you are 21 years of age or older);
• Residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or other Bangladeshi cities);
• Mobile phone number;
• Email address;
• Chosen username and password (stored in hashed form — we do not store your password in plain text);
• Preferred payment method (e.g., bKash, Nagad, Rocket, Upay, Visa, Mastercard).

3.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) programme, we may request copies of the following documents before processing withdrawal requests or when our compliance team has reasonable grounds to verify your identity:

• National Identity Card (NID), valid passport, or driving licence;
• A recent utility bill or bank statement confirming your residential address (issued within 90 days);
• Proof of payment method ownership (e.g., a screenshot of your bKash or Nagad account showing your registered mobile number);
• Any other document reasonably required by the 678bf compliance team to satisfy anti-money-laundering (AML) obligations.

3.3 Financial Transaction Data

When you deposit or withdraw funds on 678bf, we record transactional data including the amount (in Bangladeshi Taka, ৳ BDT), the payment method used, the date and time of the transaction (Bangladesh Standard Time), and relevant payment reference numbers. We do not store full card numbers or full mobile banking PINs — these are handled directly by our licensed payment processing partners.

3.4 Gaming and Betting Activity Data

We collect a detailed record of your activity on the Platform, including game sessions played (slots, live baccarat, live roulette, Andar Bahar, Teen Patti, and other titles), sports bets placed (cricket, football, kabaddi, and other markets including BPL, IPL, T20 World Cup, and Bangladesh Tigers fixtures), bet amounts, outcomes, bonus usage history, and session duration and frequency. This data is used for account management, responsible gaming monitoring, fraud detection, and service improvement purposes.

3.5 Technical and Device Data

When you access the Platform, our systems automatically collect certain technical data, including:

• IP address and approximate geolocation (country and city level);
• Device type, operating system, and browser type and version;
• Mobile network operator (relevant for bKash and Nagad mobile payment flows);
• Pages visited, links clicked, session timestamps, and referring URL;
• Crash reports and performance diagnostics.

This technical data is collected automatically and is necessary for the secure, reliable operation of the Platform.

3.6 Communications Data

If you contact the 678bf support team by email or any other channel, we retain records of those communications (including the content of messages and any attachments) for a period of at least 2 years. This data is used to handle your enquiry, improve our customer support service, and for audit and compliance purposes.

4. How We Use Your Personal Data

678bf uses your personal data for the purposes set out in the table below. We process personal data only where we have a valid legal basis for doing so (see Section 5).

Purpose	Data Used	Legal Basis
Account registration and management	Registration data, device data	Contract performance
Processing deposits and withdrawals in ৳ BDT	Financial transaction data, registration data	Contract performance
Identity verification (KYC) and age verification (21+)	KYC documents, registration data	Legal obligation
Fraud detection and prevention	Device data, transaction data, gaming data	Legitimate interest
Anti-money-laundering (AML) compliance	Transaction data, KYC data	Legal obligation
Responsible gaming monitoring	Gaming data, transaction data	Legal obligation / legitimate interest
Customer support and dispute resolution	Communications data, account data	Contract performance / legitimate interest
Platform security and technical operations	Device data, technical data	Legitimate interest
Promotional communications (where consented)	Registration data, gaming preferences	Consent
Personalisation of platform experience	Gaming data, preferences	Legitimate interest / consent
Analytics and platform improvement	Technical data, aggregated gaming data	Legitimate interest

5. Legal Basis for Processing

678bf processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contract Performance: Processing that is necessary to fulfil the contract between you and 678bf — i.e., to operate your account, accept bets, pay out winnings, and provide the services you have signed up for;
• Legal Obligation: Processing that is required for 678bf to comply with applicable legal obligations, including KYC/AML requirements and age verification (21+);
• Legitimate Interest: Processing carried out for the legitimate business interests of 678bf, including fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing for which 678bf has obtained your explicit, freely given, specific, informed, and unambiguous consent — primarily for marketing communications and advanced personalisation features. You may withdraw your consent at any time by contacting [email protected] or adjusting your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Data Sharing & International Transfers

6.1 Third-Party Service Providers

678bf shares personal data with a limited number of carefully selected third-party service providers who assist us in operating the Platform. These providers act as data processors on our behalf and are bound by strict contractual data processing agreements. Categories of third-party processors include:

• Payment Processors: bKash, Nagad, Rocket, Upay, Visa, and Mastercard processing partners — to facilitate deposits and withdrawals in ৳ BDT;
• Game Providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and other licensed game studios — for the operation of casino games and live dealer tables;
• KYC and Identity Verification Partners: Third-party identity verification services used to authenticate the documents you submit;
• Fraud Detection and Cybersecurity Providers: Services that help 678bf identify suspicious login activity, bot traffic, and potential financial fraud;
• Analytics Providers: Anonymised or pseudonymised usage analytics services used to understand player behaviour and improve platform performance.

6.2 Legal and Regulatory Disclosure

678bf may disclose your personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where we are required to do so by applicable law, court order, or other legal process. In such cases, 678bf will disclose only the minimum data necessary to satisfy the legal requirement and will, where legally permissible, notify you of such disclosure.

6.3 No Sale of Data

678bf does not sell, rent, or trade your personal data to any third party for their own independent marketing or commercial purposes. Any sharing of data is strictly limited to the purposes described in this Privacy Policy.

6.4 International Data Transfers

Some of 678bf's third-party service providers (in particular, game providers and analytics platforms) may process data outside of Bangladesh. Where personal data is transferred internationally, 678bf takes appropriate steps to ensure that your data receives an equivalent level of protection to that afforded within Bangladesh, including by entering into standard contractual clauses or other approved transfer mechanisms with the relevant recipients.

7. Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function correctly, to improve efficiency, and to provide information to the site operator. 678bf uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage objects) on the Platform.

7.2 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are required for the Platform to function. They include session cookies that maintain your login state and security tokens that protect against cross-site request forgery (CSRF). These cookies cannot be disabled;
• Performance Cookies: These cookies collect anonymised information about how players use the Platform (e.g., which game pages are visited most frequently, where errors occur) to help us improve the service;
• Functional Cookies: These cookies remember your preferences (e.g., preferred odds display format, language setting) to provide a more personalised experience;
• Analytics Cookies: These cookies help us understand aggregate traffic patterns on the Platform and are used only in pseudonymised or anonymised form.

7.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, accept only certain types of cookies, or delete existing cookies. Please note that disabling strictly necessary cookies will impair the functionality of the 678bf Platform and may prevent you from accessing your account or placing bets. Adjusting browser cookie settings has no effect on any personal data already collected by 678bf through other means.

8. Data Security

678bf takes the security of your personal data seriously and implements a layered approach to information security, including the following measures:

• Encryption in Transit: All data transmitted between your browser or device and the 678bf Platform is protected using 256-bit SSL/TLS encryption. The 678bf website uses HTTPS exclusively;
• Encryption at Rest: Sensitive data fields including KYC document files and financial reference data are encrypted at rest on 678bf's secure servers;
• Password Hashing: Account passwords are never stored in plain text. They are stored as cryptographic hashes using an industry-standard algorithm, meaning that even 678bf's own staff cannot read your password;
• Access Controls: Access to personal data within the 678bf organisation is restricted on a strict need-to-know basis. Staff with access to player data are subject to confidentiality obligations and regular security training;
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their 678bf accounts for an additional layer of login security;
• Regular Security Audits: 678bf conducts periodic security reviews, penetration tests, and vulnerability assessments to identify and remediate potential weaknesses in the Platform's security posture;
• Incident Response: In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, 678bf will notify affected players without undue delay and will take all necessary steps to contain the breach and minimise harm.

9. Data Retention

678bf retains your personal data for only as long as is necessary for the purposes for which it was collected, or as required by applicable law. The table below summarises our standard data retention periods:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years after closure	AML / legal obligation
KYC identity documents	Duration of account + 5 years after closure	AML / regulatory compliance
Financial transaction records	7 years from date of transaction	AML / financial record-keeping obligations
Gaming and betting history	Duration of account + 5 years after closure	Dispute resolution / responsible gaming
Customer support communications	2 years from last interaction	Dispute resolution / service improvement
Marketing consent records	Until consent is withdrawn + 1 year	Consent audit trail
Technical / device logs	90 days from collection	Security / fraud detection (rolling basis)

When retention periods expire, personal data is securely deleted or permanently anonymised so that it can no longer be associated with any identifiable individual. Where legal proceedings or regulatory investigations are ongoing, relevant data may be retained beyond standard retention periods until the matter is fully resolved.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights in relation to the personal data that 678bf holds about you:

• Right of Access: You have the right to request a copy of the personal data 678bf holds about you. We will provide this information within 30 calendar days of a verified request;
• Right to Rectification: You have the right to request that 678bf corrects any inaccurate or incomplete personal data held about you. You can update many account details directly within your account settings;
• Right to Erasure ("Right to Be Forgotten"): You may request that 678bf deletes your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. Please note that this right is subject to our legal obligations to retain certain data (see Section 9);
• Right to Restriction of Processing: In certain circumstances, you may request that 678bf restricts the processing of your personal data — for example, while a dispute about its accuracy is being resolved;
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you may request that 678bf provides your personal data in a structured, commonly used, machine-readable format;
• Right to Object: You have the right to object to processing based on legitimate interests. 678bf will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of the above rights, please contact the 678bf Data Protection team at [email protected]. We may need to verify your identity before processing your request. All requests will be handled free of charge, except where requests are manifestly unfounded or excessive, in which case 678bf reserves the right to charge a reasonable administrative fee or decline the request, with written justification provided.

11. Children & Minors

12. Marketing Communications

With your explicit consent, 678bf may send you promotional communications about new games, seasonal bonuses (including Eid promotions, Pohela Boishakh offers, and BPL cricket season specials), and other offers relevant to your interests as a 678bf player in Bangladesh. Marketing communications will be sent to the email address or mobile number registered on your account.

You may opt out of receiving marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email sent by 678bf;
• Adjusting your communication preferences within your 678bf account settings; or
• Contacting the 678bf support team at [email protected] with a request to be removed from marketing lists.

Opting out of marketing communications does not affect transactional communications that are necessary for the operation of your account (such as deposit confirmations, withdrawal processing notices, security alerts, and important account notifications).

13. Third-Party Links

The 678bf Platform may, from time to time, contain references to third-party services or platforms (for example, game providers). 678bf does not operate or control these third-party platforms and is not responsible for their privacy practices or content. This Privacy Policy applies solely to the 678bf Platform. We strongly encourage you to review the privacy policies of any third-party platforms you visit or interact with.

14. Changes to This Privacy Policy

678bf reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes to the services we offer. When material changes are made, 678bf will notify registered players by email or via a prominent on-platform notification at least 7 days before the revised policy takes effect, except where an immediate change is required by law or for security reasons.

The effective date at the top of this Privacy Policy indicates when it was last reviewed. Your continued use of the 678bf Platform after the revised Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree to the revised Privacy Policy, you must stop using the Platform and contact support to arrange closure of your account.

The current version of this Privacy Policy is always available at https://678bf.io/privacy-policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data 678bf holds about you, please contact us using the details below:

• Data Protection Enquiries: [email protected]
• Response Time: Within 5 business days for acknowledgement; within 30 calendar days for substantive response
• Operating Hours: Bangladesh Standard Time (BST, UTC+6), Monday to Sunday