29win Privacy Policy — Your Data, Protected

Privacy Summary

The table below gives you a plain-language snapshot of our most important data practices. It does not replace the full policy below — please read every section carefully.

1 Information We Collect

29win collects personal information about you in three main ways: directly from you when you register, deposit, or interact with the Platform; automatically as you use the Platform; and, in limited circumstances, from trusted third parties. Below we describe each category in detail.

1.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, gender, email address, mobile number (typically the number linked to your bKash or Nagad account), and the city or district you reside in (e.g., Dhaka, Chittagong, Sylhet, Khulna).
• Identity verification (KYC) documents: Copies of your National Identity Card (NID), passport, or driving licence, and — where required — a selfie or proof-of-address document.
• Payment information: Mobile wallet account numbers (bKash, Nagad, Rocket, Upay), bank account numbers (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank), and transaction reference numbers. We do not store full payment credentials — these are handled by our certified payment-processing partners.
• Support communications: Messages, transcripts, and attachments you share with our customer support team via live chat or email.
• Responsible gaming information: Deposit limits, session reminders, cooling-off requests, and self-exclusion elections you set in your account dashboard.

1.2 Information Collected Automatically

• Device and browser data: Device type, operating system, browser name and version, screen resolution, language settings, and unique device identifiers.
• Network data: IP address, mobile network operator, and approximate geographic location derived from your IP address (country and city level — not precise GPS coordinates).
• Usage data: Pages visited, time spent on each page, buttons clicked, games played, bet amounts, wagering history, login timestamps, and session duration.
• Cookie and tracking data: As described in Section 4 of this Policy.

1.3 Information from Third Parties

• Payment providers: Transaction status confirmations and fraud-risk signals from bKash, Nagad, Rocket, and Upay.
• Identity verification services: Results of automated document checks and watchlist screening from our KYC and anti-money-laundering (AML) partners.
• Game providers: Aggregated game-round results and RTP audit data from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, as needed for account-level reporting.

2 How We Use Your Data

29win processes your personal data only for specific, documented purposes. The table below maps each processing purpose to the legal basis we rely on.

2.1 Marketing Communications

29win will only send you promotional messages — including information about bonuses, seasonal campaigns (such as Eid or BPL promotions), and new game launches — if you have explicitly opted in to receive such communications during registration or within your account preferences. You may withdraw this consent at any time by updating your notification settings in your account dashboard or by contacting support. Withdrawal of consent for marketing does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect your ability to use the Platform.

2.2 Automated Decision-Making

29win uses automated systems to flag accounts for fraud, AML review, and responsible gaming interventions. Where an automated decision produces a significant effect on your account (for example, a temporary account restriction), you have the right to request a human review of that decision. Please contact our support team via live chat to exercise this right.

3 Data Sharing

29win shares your personal data only in the limited circumstances described below. In every case, we impose contractual obligations on our partners requiring them to protect your data to the same standard we apply ourselves.

3.1 Payment Processing Partners

To process deposits and withdrawals in Bangladeshi Taka, we share the minimum necessary transaction data with our payment partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. These partners receive only the data required to execute and confirm the specific transaction — they do not receive your full account history or betting records.

3.2 Game Technology Providers

To deliver live casino games, slots, and crash games on the Platform, 29win integrates with certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive a pseudonymous player identifier and game-round data necessary to render and audit game outcomes. They do not receive your full name, NID number, or financial transaction details.

3.3 Identity Verification and AML Partners

As part of our KYC and anti-money-laundering obligations, 29win shares identity documents and transaction data with accredited third-party verification and screening services. These partners are contractually prohibited from using your data for any purpose other than fulfilling the verification service provided to 29win.

3.4 Legal and Regulatory Disclosure

29win will disclose personal data to law enforcement agencies, regulatory authorities, or courts if we are required to do so by a valid legal order or if we determine in good faith that disclosure is necessary to prevent fraud, money laundering, or harm to persons. Where legally permitted, we will notify you of such disclosure requests.

3.5 Business Transfers

In the event that 29win undergoes a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. You will be notified via the email address registered to your account before your personal data becomes subject to a different privacy policy.

4 Cookies & Tracking

29win uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and protect your account security. A cookie is a small text file placed on your device when you visit the Platform. Cookies do not contain your password or payment details.

4.1 Types of Cookies We Use

4.2 Managing Your Cookie Preferences

You can manage non-essential cookie settings at any time through your account preferences dashboard. You can also configure your browser to block or delete cookies; however, blocking essential or security cookies will prevent you from logging in and using the Platform effectively. Instructions for managing cookies in popular browsers (Chrome, Firefox, Samsung Internet) are available on those browsers' support pages.

5 Data Retention

29win retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The specific retention periods we apply are outlined below.

When the retention period expires, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to you. Anonymised, aggregated data (for example, total bet volumes by game category with no individual player identifiers) may be retained indefinitely for statistical and business-intelligence purposes.

5.1 Self-Excluded Players

If you have elected to self-exclude from 29win under our responsible gaming programme, we retain your identification data for the duration of the self-exclusion period and for 5 years thereafter, specifically to ensure that we can identify and reject any re-registration attempts during the self-exclusion period. This retention is in your interest and forms an essential part of our commitment to player protection.

6 Your Rights

As a user of the 29win Platform, you hold the following rights over your personal data. To exercise any of these rights, contact our support team via live chat or email (see Section 8). We will respond to all verified requests within 30 days.

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is being used. This is sometimes referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For account details such as your registered email or mobile number, you can update most information directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (where consent was the legal basis), or where the processing is unlawful. Note that this right is not absolute — we may be required to retain certain data to comply with legal obligations, as outlined in Section 5.
• Right to Restriction: You may ask us to pause processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you may request that we provide your data in a structured, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider.
• Right to Object: You have the right to object to processing based on legitimate interests (including profiling) and to processing for direct marketing purposes. Where you object to marketing, we will cease all marketing communications immediately.
• Rights Related to Automated Decision-Making: Where 29win makes decisions about your account solely by automated means (for example, fraud-scoring systems), you have the right to request human review, to express your point of view, and to contest the decision.

7 Data Security

29win implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security practices include, but are not limited to, the following:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the 29win Platform is encrypted using industry-standard TLS 1.2 or higher. This applies to account login, game sessions, and all financial transactions.
• Encrypted data storage: Sensitive personal data held in our databases — including identity document references and payment identifiers — is encrypted at rest using AES-256 encryption.
• Access controls: Personal data is accessible only to 29win staff members who have a genuine operational need for it. Access is controlled by role-based permissions, and all access events are logged and audited.
• Payment data isolation: Full payment credentials (mobile wallet PINs, full bank account numbers) are never stored by 29win. Payment processing is delegated entirely to our certified payment-processing partners, who are responsible for PCI DSS-equivalent security on those data elements.
• Fraud monitoring: Automated systems continuously monitor account activity for anomalies including unusual login locations, rapid deposit-withdrawal patterns, and multi-account signals. Suspicious activity triggers immediate review by our security team.
• Security training: All 29win staff with access to personal data undergo regular security awareness training covering phishing, social engineering, and data-handling best practices.
• Incident response: 29win maintains a documented data breach response procedure. In the event of a breach that poses a risk to affected players, we will notify impacted users within a reasonable timeframe and take immediate steps to contain and remediate the incident.

7.1 Your Role in Account Security

While 29win takes every reasonable measure to protect your data, you also play a critical role in maintaining your account security. Use a strong, unique password for your 29win account, do not share your login credentials with anyone, and ensure that your registered mobile number (linked to bKash or Nagad) is kept secure and up to date. If you suspect any unauthorised activity on your account, contact 29win support immediately via live chat.

8 Contact & Updates

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how 29win handles your personal information, please contact our support team using the details below.

8.1 How to Contact Us

• Live Chat: Available 24/7 directly from your account dashboard. This is the fastest way to reach our team and have a data rights request logged.
• Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in the subject line and describe your request clearly. We aim to respond within 3 business days and to resolve all requests within 30 calendar days.
• Support Hours: 24/7 for live chat. Email responses are delivered during Bangladesh Standard Time (BST, UTC+6) business hours but are monitored continuously for urgent matters.

8.2 Updates to This Policy

29win may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer. When we make material changes — changes that significantly affect your rights or how we use your data — we will notify you via the email address registered to your account and by displaying a prominent notice on the Platform for at least 14 days before the changes take effect.

The current version of this Privacy Policy is always accessible at https://29win.bid/privacy-policy. The effective date at the top of this document identifies when the current version came into force. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of those revisions.

If you do not agree with any changes made to this Privacy Policy, you must stop using the Platform and may request account closure by contacting our support team. Your pre-existing data rights are not affected by account closure — you may still exercise any right described in Section 6 after your account has been closed.