678db Privacy Policy

1 Introduction

678db ("we", "us", "our", "the Platform") is an online casino and sports betting platform operated primarily for the Bangladeshi market. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, whether as registered players, visitors, or support contacts.

This Privacy Policy sets out in clear, plain English how 678db collects, uses, stores, shares, and protects your personal information. It also describes your rights in relation to that data and the mechanisms available to you for exercising those rights.

This Policy should be read together with the 678db Terms and Conditions and the Responsible Gaming Policy, both of which are available on this website. Together, these documents constitute the complete framework governing your relationship with 678db.

678db takes its data protection obligations seriously. We process personal data only where we have a lawful basis to do so, and we implement appropriate technical and organisational measures to safeguard all personal information in our possession against unauthorised access, loss, or disclosure.

2 Data We Collect

678db collects several categories of personal data depending on the nature of your interaction with the platform. The specific data collected at each stage is described below.

2.1 Registration Data

When you create a 678db account, we collect the following information:

• Full legal name
• Date of birth (to verify that you are 21 years of age or older)
• Residential address including city, district, and postcode
• Email address
• Mobile phone number
• Preferred currency (Bangladeshi Taka, BDT)
• Username and hashed password (we never store passwords in plain text)

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may collect the following documentary evidence from you prior to processing withdrawals or at any time we deem a verification check necessary:

• Government-issued photo identification (National Identity Card, passport, or driving licence)
• Proof of residential address (utility bill, bank statement, or official correspondence dated within three months)
• Source of funds documentation (for accounts with high transaction volumes)
• Selfie photograph for liveness verification

2.3 Financial Transaction Data

When you make deposits or withdraw funds via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, or Mastercard, we collect and retain records of:

• Transaction amounts and dates
• Payment method type (e.g., bKash, Nagad)
• Transaction reference numbers issued by the payment provider
• Account balance history

678db does not store full card numbers, bKash PINs, Nagad PINs, or any other authentication credentials associated with your payment accounts. These are processed directly by the respective payment providers.

2.4 Gaming Activity Data

We maintain detailed records of your gaming and betting activity on the 678db platform, including:

• Games played, bets placed, bet amounts, and outcomes
• Sports betting markets wagered on (including cricket BPL, IPL, T20 World Cup, and other events)
• Session start and end times (Bangladesh Standard Time, UTC+6)
• Bonus credits received and wagering progress
• Responsible gaming tool usage (deposit limits set, cool-off periods activated, self-exclusion requests)

2.5 Technical and Device Data

When you access the 678db platform, our servers and analytics tools automatically collect certain technical information:

• IP address
• Device type, operating system, and browser version
• Screen resolution
• Referring URL (the website or link that directed you to 678db)
• Pages visited, time spent on each page, and click-path data
• Cookie identifiers (see Section 7)

2.6 Communications Data

If you contact 678db support via live chat or email, we retain records of those communications including the content of messages, timestamps, and the support agent's responses. This data is used to resolve disputes, improve service quality, and maintain a record of agreed actions.

3 How We Collect Your Data

678db collects personal data through the following channels and mechanisms:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, place a bet, contact support, or update your account settings.
• Automatically via technology: Through cookies, web beacons, server logs, and similar tracking technologies when you browse the 678db platform (see Section 7 for full details).
• From payment providers: Transaction confirmation data and payment status updates are received from bKash, Nagad, Rocket, Upay, and card processing partners when you initiate a financial transaction.
• From identity verification services: Where 678db engages third-party KYC verification providers, those providers return verification status results and risk scoring data to 678db.
• From fraud detection tools: Automated systems monitor platform activity and flag accounts exhibiting patterns associated with fraud, money laundering, or bonus abuse.

4 How We Use Your Data

678db uses the personal data it collects for the following purposes:

678db will not use your personal data for any purpose that is incompatible with those listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

4.1 Marketing Communications

If you have opted in to receive promotional emails or messages from 678db — for example, notifications about bonus offers, BPL cricket betting promotions, Eid special offers, or new game releases — we will use your registered email address or phone number for this purpose. You may withdraw your consent to marketing communications at any time by updating your account notification preferences or by contacting [email protected].

5 Legal Basis for Processing

678db processes personal data under one or more of the following legal bases depending on the nature of the processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and 678db — including account creation, KYC verification, game operation, and payment processing.
• Legal obligation: Processing required to comply with applicable anti-money laundering laws, age verification obligations, record-keeping requirements, and regulatory reporting duties.
• Legitimate interests: Processing carried out for purposes such as fraud detection, platform security, responsible gaming monitoring, and internal analytics, where those interests are not overridden by your privacy rights.
• Consent: Processing for optional purposes such as marketing communications, where you have freely given specific, informed, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

6 Sharing Your Data

678db does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We share personal data only in the following limited circumstances:

6.1 Payment Service Providers

When you make a deposit or request a withdrawal, 678db shares the minimum necessary transaction data with your chosen payment provider (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard) to facilitate the payment. These providers are independent data controllers subject to their own privacy policies and security standards.

6.2 KYC and Identity Verification Partners

678db may engage specialist third-party KYC verification services to process identity documents and perform liveness checks. These providers act as data processors on 678db's behalf under strict contractual data processing agreements that prohibit them from using your data for any purpose other than providing the verification service to 678db.

6.3 Game Technology Providers

The games available on 678db are provided by licensed third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game, your player ID and gaming session data are shared with the relevant provider to render the game, calculate outcomes, and return results. These providers do not receive your full identity or financial details.

6.4 Legal and Regulatory Disclosure

678db may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required to do so by applicable law, court order, or regulatory directive. In such cases, 678db will disclose only the minimum information necessary to satisfy the legal requirement and will, where permitted by law, notify the affected user of the disclosure.

6.5 Business Transfers

In the event that 678db undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, personal data held by 678db may be transferred to the acquiring entity as part of that transaction. In such an event, 678db will notify affected users by email and will ensure that the acquiring entity is bound by obligations of data protection no less stringent than those set out in this Privacy Policy.

7 Cookies & Tracking Technologies

678db uses cookies and similar tracking technologies to enhance your experience on the platform, maintain your session state, and gather analytics about platform usage. The table below explains the categories of cookies used by 678db.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your 678db account and accessing core platform features. Disabling functional cookies will mean that your preferences are not remembered between sessions.

678db does not use third-party advertising cookies or tracking pixels that transmit your data to advertising networks or social media platforms.

8 Data Security

678db implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your browser or device and the 678db servers is encrypted using TLS 1.2 or higher.
• Password hashing: Account passwords are stored as salted cryptographic hashes. 678db employees cannot view your password in plain text under any circumstances.
• Access controls: Access to personal data within 678db's internal systems is restricted on a strict need-to-know basis. Employee access is logged and audited regularly.
• Secure data centres: Personal data is stored on servers housed in physically secure data centres with restricted access, environmental controls, and redundant connectivity.
• Regular security assessments: 678db conducts periodic internal security reviews and vulnerability assessments to identify and remediate potential weaknesses in its systems.
• Incident response: 678db maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, affected users will be notified without undue delay.

9 Data Retention

678db retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

At the end of the applicable retention period, 678db will securely delete or anonymise your personal data. Anonymised data (from which you cannot be identified) may be retained indefinitely for aggregate statistical and analytical purposes.

10 Your Rights

As a data subject, you have the following rights in relation to the personal data that 678db holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and a description of your request.

• Right of Access: You have the right to request a copy of the personal data that 678db holds about you, along with information about how that data is being used.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate, incomplete, or out of date.
• Right to Erasure: In certain circumstances, you have the right to request that 678db delete your personal data. This right is subject to 678db's legal and regulatory retention obligations — we may not always be able to delete all data on request.
• Right to Restriction of Processing: You have the right to request that 678db restrict processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. You may also object at any time to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11 Children & Minors

The 678db platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Registration on 678db by a person under the age of 21 is a violation of the 678db Terms and Conditions and is strictly prohibited.

If 678db becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the associated account, void any related transactions, and delete the personal data of the underage individual as promptly as possible in accordance with its legal obligations.

If you believe that a minor has registered on the 678db platform, please contact us immediately at [email protected] so that we can take swift action.

12 Third-Party Links

The 678db platform may contain links to the websites or platforms of third-party service providers such as payment processors. These links are provided for your convenience only. 678db does not control the content or privacy practices of any third-party website and is not responsible for the data practices of those sites.

When you click a link to a third-party website, you leave the 678db platform and become subject to the privacy policy and terms of use of the destination site. We encourage you to review the privacy policies of any third-party services you use in connection with your 678db account, including bKash, Nagad, Rocket, and Upay.

13 Changes to This Policy

678db reserves the right to update or amend this Privacy Policy at any time. When we make material changes — that is, changes that meaningfully affect how your personal data is collected, used, or shared — we will notify registered users by email to the address on file at least 14 days before the updated Policy takes effect.

Non-material changes, such as corrections of typographical errors, clarifications of existing practices, or structural reformatting that does not alter the substance of the Policy, may be made without prior notice. The "Last Updated" date at the top of this document will always reflect the date on which the most recent revision was published.

Your continued use of the 678db platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with the changes, you should discontinue use of the platform and contact [email protected] to request account closure and deletion of your personal data to the extent permitted by law.

14 Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 678db processes your personal data, please contact our support team using the details below. All privacy-related enquiries are handled by staff trained in data protection obligations.

Email: [email protected]

Subject line for data rights requests: "Data Rights Request – [Your Username]"

Response time: We aim to acknowledge all privacy enquiries within 5 business days (Bangladesh Standard Time, UTC+6).

When submitting a data rights request, please include your registered username, the email address associated with your account, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing certain requests to ensure that personal data is not disclosed to or modified by an unauthorised party.