bm77 Privacy Policy

1 Information We Collect

bm77 collects personal data from you in three primary ways: information you provide directly when using our platform, information generated automatically through your use of our services, and information received from third-party service providers where you have authorised such sharing. The following table summarises the categories of personal data we collect and the context in which each category arises.

Data We Do Not Collect

bm77 does not collect your full payment card number, CVV, or bank account PIN. Payment transactions are processed through our payment partners — bKash, Nagad, Rocket, Upay, and partner banks — and bm77 receives only a tokenised reference sufficient to process future withdrawals to the same method. Full payment credentials remain within the payment provider's secure environment at all times.

bm77 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification purposes, or data concerning sexual orientation. If any voluntary information of this nature is submitted to us incidentally (for example, within a support message), it will not be stored, processed, or used for any purpose.

2 How We Use Your Data

bm77 processes personal data only where we have a lawful basis for doing so. Our primary lawful bases are: the performance of the contract between you and bm77 (providing and maintaining your account and game access), compliance with legal obligations (KYC, anti-money laundering checks), our legitimate interests (platform security, fraud prevention, improving the product), and your consent (marketing communications).

Account Management and Service Delivery

The core purpose of collecting your personal data is to provide you with a fully functional bm77 account. This includes creating and verifying your account, processing deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, or a Bangladeshi bank), crediting bonuses, settling sports bets on markets including cricket BPL, IPL, T20 World Cup, and other events, and providing customer support in response to your queries.

Identity Verification and Fraud Prevention

bm77 is required to verify player identities to comply with applicable anti-money laundering standards and to enforce its 18+ age restriction policy. Identity data and financial data may be cross-referenced with internal risk models to detect patterns consistent with fraudulent activity, multi-accounting, bonus abuse, or money laundering. Where suspicious activity is identified, bm77 may act on that determination — which may include suspending withdrawals or closing the account — and may share relevant information with appropriate third parties as required by law.

Platform Improvement and Analytics

Technical data and usage data are analysed in aggregate to understand how players interact with the bm77 platform — which games are most popular, where players encounter friction in the navigation, and how the product can be improved. Where analytics processing involves personal data, it is carried out under bm77's legitimate interests and is subject to the data minimisation principle: we use the minimum personal identifiers necessary to derive meaningful insight.

Responsible Gaming Monitoring

Usage data — including session frequency, session duration, bet volumes, and deposit patterns — is monitored by bm77's responsible gaming systems to identify players who may be exhibiting signs of problem gambling. Where such indicators are present, bm77 may proactively contact the player with information about responsible gaming tools, or may apply account-level restrictions in line with our Responsible Gaming Policy. This processing is carried out under bm77's legitimate interest in safeguarding player welfare.

Marketing Communications

With your consent, bm77 may send you promotional communications by email regarding new games, seasonal promotions (such as Eid or Pohela Boishakh offers), deposit bonuses, cricket betting markets, and other offers. You may withdraw consent and unsubscribe at any time by following the unsubscribe link in any marketing email, or by contacting [email protected]. Withdrawal of marketing consent does not affect the processing of data for account management or legal compliance purposes.

3 Data Sharing & Third Parties

bm77 does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for the specific purpose in each case.

Payment Processors

To process deposits and withdrawals, bm77 shares necessary financial and identity data with our payment processing partners, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank. These partners operate under their own privacy policies and applicable financial regulations. bm77 shares only the data each provider requires to authenticate and settle the relevant transaction.

Game Technology Providers

Games available on the bm77 platform are supplied by third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you launch and play a game, certain technical data (such as a session token and your account identifier) is transmitted to the relevant provider's game servers to enable gameplay and record the outcome of each round. Game providers do not receive your full name, payment details, or contact information unless required for a specific verified purpose such as a jackpot prize claim.

Identity Verification Services

bm77 may use third-party identity verification and KYC technology providers to assist with document verification and age confirmation. These providers process identity data on bm77's behalf under strict data processing agreements and are not permitted to use your data for their own independent purposes.

Legal and Regulatory Disclosure

bm77 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required by a valid legal obligation, court order, or regulatory instruction. In such cases, bm77 will disclose only the minimum data necessary to satisfy the legal requirement and will, where legally permissible, notify you of such a disclosure.

4 Cookies & Tracking Technologies

bm77 uses cookies and similar tracking technologies (including local storage and session storage) on its website and platform. Cookies are small text files placed on your device that allow bm77 to recognise your browser, maintain your session, and collect information about how you use the platform.

Categories of Cookies We Use

Managing Your Cookie Preferences

Most modern browsers allow you to view, manage, and delete cookies through the browser's settings menu. You may also configure your browser to block cookies from specific domains or all third-party sources. Please note that disabling strictly necessary or responsible gaming cookies will impair your ability to use core platform features, including logging in and accessing your account balance.

bm77 does not use cookies to track your activity across other websites or to build advertising profiles for use by third-party ad networks. Analytics cookies, where used, operate on aggregated data and are not shared with advertising platforms.

5 Data Retention

bm77 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable legal or regulatory obligations.

• Active account data (identity, contact, financial, usage) is retained for the full duration of your account being open and active on the bm77 platform.
• KYC and identity verification documents are retained for a minimum of five years from the date of verification, in line with standard anti-money laundering record-keeping requirements.
• Transaction records (deposits, withdrawals, bet history) are retained for a minimum of five years from the date of each transaction.
• Support communications (emails, chat transcripts) are retained for two years from the date of the final message in each conversation thread.
• Marketing consent records are retained for the duration of the marketing relationship plus one year following opt-out, to evidence compliance with consent requirements.
• Technical and usage data collected for analytics purposes is retained in identifiable form for up to twelve months, after which it is anonymised or deleted.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual. Where anonymisation is not technically feasible within our systems, the data is placed under restricted access controls pending secure deletion at the next scheduled maintenance cycle.

6 Data Security

bm77 implements a layered approach to data security, combining technical controls, access management, and operational procedures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure.

Technical Safeguards

• All data transmitted between your browser and bm77's servers is encrypted using TLS (Transport Layer Security) with a minimum of 256-bit encryption.
• Passwords are stored using a one-way cryptographic hashing algorithm. bm77 staff cannot retrieve your plaintext password and will never ask you for it.
• Payment references received from payment providers (bKash, Nagad, Rocket, Upay, bank partners) are stored in tokenised form; bm77 does not hold full payment credentials.
• Access to production databases and systems containing personal data is restricted to authorised personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• bm77's infrastructure is monitored continuously for anomalous access patterns, and security patches are applied on a defined maintenance schedule.

Operational Safeguards

All bm77 staff and contractors with access to personal data are subject to confidentiality obligations and receive privacy and security awareness training. Third-party service providers who process personal data on bm77's behalf are required to maintain security standards equivalent to those described in this section, under the terms of their data processing agreements with bm77.

Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, bm77 will take immediate steps to contain the breach and assess its scope. Affected players will be notified without undue delay where the breach is likely to result in a high risk to their personal data, and will be provided with clear guidance on protective steps they can take. Notifications will be sent to the email address registered on your account.

7 Your Privacy Rights

As a player on the bm77 platform, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request" and describe the right you wish to exercise. We will respond within a reasonable timeframe, typically within 30 days of receipt of a valid request.

• Right of Access: You may request a copy of the personal data bm77 holds about you. We will provide this in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Rectification: If any personal data bm77 holds about you is inaccurate or incomplete, you may request that we correct or update it. For certain data fields (such as your registered name), we may require supporting documentation before making the change.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (and no other lawful basis applies). Note that certain data — particularly KYC records and transaction history — must be retained for minimum periods as described in Section 5, and erasure requests for such data will be declined to the extent required by law.
• Right to Restriction of Processing: You may request that bm77 limit the processing of your data in certain circumstances, for example while the accuracy of data is disputed.
• Right to Object: You may object to processing based on bm77's legitimate interests, including the use of your data for analytics or responsible gaming monitoring, where you believe your individual circumstances warrant a restriction. You have an absolute right to object to the use of your data for direct marketing, and such objections will always be honoured.
• Right to Withdraw Consent: Where bm77 processes your data on the basis of consent (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

8 Policy Updates & Contact

bm77 reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, improvements to the platform, or evolving legal requirements. The effective date displayed at the top of this page will be updated whenever a substantive change is made. Where changes are material — meaning they significantly affect how we use your personal data or your rights in relation to it — bm77 will notify affected players by email to the address registered on their account prior to the changes taking effect.

We encourage you to revisit this Privacy Policy from time to time to stay informed about how bm77 handles your personal data. Your continued use of the bm77 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the updated document.

Contact the bm77 Privacy Team

If you have any questions, concerns, or requests regarding this Privacy Policy or bm77's handling of your personal data, please contact our support team using the details below. We respond to all privacy-related enquiries in plain English, and our team operates on Bangladesh Standard Time (BST, UTC+6).

• Email: [email protected] — use the subject line "Privacy Enquiry" for the fastest response.
• Response time: We aim to respond to all privacy-related emails within two business days.
• Language: All communications are handled in English.