Privacy Policy
At bdrumyy, protecting your personal data is a core commitment — not an afterthought. This Privacy Policy explains in plain English exactly what information we collect, how we use it, who we share it with, and what rights you hold over your own data.
On This Page
Your Data, Our Responsibility
The following six principles summarise how bdrumyy approaches personal data. They do not replace the full policy text below — please read every section in full.
Minimal Collection
bdrumyy collects only the data genuinely needed to operate your account, process payments, comply with regulatory obligations, and improve our service. We do not harvest data for resale or advertising profiling.
SSL Encryption
All data transmitted between your browser and bdrumyy is protected by industry-standard SSL/TLS encryption. Your login credentials, payment details, and personal information travel over an encrypted connection at all times.
No Data Selling
bdrumyy never sells, rents, or trades your personal information to third-party marketers or data brokers. Your contact details and player behaviour data are used solely for platform operations and legal compliance.
Purpose Limitation
Data collected for one purpose — for example, payment processing via bKash or Nagad — will not be repurposed for unrelated activities without your explicit consent or a valid legal basis for doing so.
Your Rights Respected
You have the right to access, correct, port, restrict processing of, and request deletion of your personal data. bdrumyy provides a clear process for exercising these rights as outlined in the Your Privacy Rights section below.
Clear Retention Limits
bdrumyy retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. When data is no longer needed, it is securely deleted or anonymised.
Information We Collect
bdrumyy collects personal data through several channels: directly from you when you register or interact with the platform, automatically when you browse our website, and from third-party payment and identity verification providers where necessary. Below is a detailed breakdown of the categories of information we may hold about you.
| Category | Examples | Source |
|---|---|---|
| Identity Data | Full legal name, date of birth, NID/passport number, selfie photograph | Provided by you during registration or KYC |
| Contact Data | Email address, mobile phone number (e.g., bKash/Nagad registered number), city of residence | Provided by you during registration |
| Financial Data | Payment method type (bKash, Nagad, Rocket, Upay, Visa, Mastercard), transaction reference numbers, deposit and withdrawal amounts in BDT | Generated during payment processing; provided by payment gateways |
| Account Activity Data | Bet history, game session data, bonus claims, win/loss records, login timestamps | Automatically generated by platform activity |
| Technical Data | IP address, browser type and version, device type, operating system, screen resolution, time zone (Bangladesh Standard Time UTC+6) | Automatically collected via server logs and cookies |
| Communications Data | Support emails sent to [email protected], chat transcripts, dispute correspondence | Provided by you when contacting support |
We do not knowingly collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric identifiers beyond what is strictly necessary for age and identity verification (e.g., a photograph of a government-issued ID compared against a selfie). Where such data is collected for KYC purposes, it is handled with heightened security controls and deleted promptly once verification is complete.
bdrumyy does not collect data from persons under the age of 18. If we become aware that we have inadvertently collected data from a minor, that data will be permanently deleted and the associated account closed immediately. If you believe a minor has registered on our platform, please contact [email protected] without delay.
What We Do NOT Collect
bdrumyy does not collect or store your full card numbers. Card transactions via Visa or Mastercard are processed directly by our PCI-DSS compliant payment gateway partners. We receive only a masked card reference for our records.
Mobile Number & bKash/Nagad
Your registered bKash, Nagad, or Rocket mobile number is stored as a payment method identifier and for account communication purposes. It is not shared with marketing third parties. It is used solely to match deposits to your bdrumyy account and to process withdrawals to the correct wallet.
How We Use Your Data
bdrumyy processes your personal data only where we have a lawful basis to do so. The lawful bases we rely on are: (a) contract performance — processing is necessary to deliver the service you have signed up for; (b) legal obligation — processing is required to comply with applicable law, including anti-money laundering (AML) and Know Your Customer (KYC) requirements; (c) legitimate interests — processing is necessary for our reasonable business interests, provided those interests are not overridden by your rights; and (d) consent — where we ask for and you provide explicit consent, such as for optional marketing communications.
The table below sets out the specific purposes for which bdrumyy processes your personal data and the corresponding lawful basis for each:
| Purpose | Data Categories Used | Lawful Basis |
|---|---|---|
| Account registration and management | Identity Data, Contact Data | Contract performance |
| Processing deposits and withdrawals | Financial Data, Identity Data, Contact Data | Contract performance |
| Age and identity verification (KYC) | Identity Data, Financial Data | Legal obligation |
| Anti-money laundering monitoring | Financial Data, Account Activity Data, Technical Data | Legal obligation |
| Fraud detection and prevention | Technical Data, Account Activity Data, Financial Data | Legitimate interests |
| Responsible gaming monitoring | Account Activity Data, Contact Data | Legal obligation / Legitimate interests |
| Customer support and dispute resolution | Communications Data, Identity Data, Account Activity Data | Contract performance / Legitimate interests |
| Platform improvement and analytics | Technical Data, Account Activity Data (aggregated/anonymised) | Legitimate interests |
| Sending service-related notifications | Contact Data | Contract performance |
| Sending optional promotional communications | Contact Data | Consent (can be withdrawn at any time) |
bdrumyy does not use automated decision-making that produces legal or similarly significant effects on individual players without a human review process being available. For example, account suspension triggered by automated fraud detection is subject to human review upon player appeal.
If you have opted in to receive promotional communications from bdrumyy — such as bonus offers, BPL season promotions, or Eid special events — you may withdraw that consent at any time by contacting [email protected] or by using the unsubscribe link in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn, and it does not affect the delivery of non-promotional service notifications (e.g., deposit confirmations, account security alerts).
Data Sharing & Third Parties
bdrumyy does not sell your personal data. We share personal data with third parties only where it is necessary to deliver our services, meet legal obligations, or protect the security of the platform and its players. The following categories of third parties may receive limited personal data from bdrumyy:
- Payment Processors: bKash, Nagad, Rocket, Upay, and card payment gateways handling Visa and Mastercard transactions. These providers receive the minimum data required to process deposits and withdrawals — typically your registered mobile number or masked card reference and transaction amount in BDT. Each payment provider operates under its own privacy policy and is responsible for data handled within its own systems.
- Identity Verification Providers: Third-party KYC service providers who assist in verifying the identity and age of players, particularly for first-time withdrawal verification. These providers are bound by strict data processing agreements and may not use your data for any purpose other than identity verification on behalf of bdrumyy.
- Game Content Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token and anonymous player identifier when you launch a game. These providers do not receive your name, contact details, or financial information directly from bdrumyy.
- Fraud Prevention & Security Vendors: Technology partners who assist in detecting suspicious login activity, bot traffic, and payment fraud. These vendors process technical data (IP addresses, device fingerprints) under strict contractual terms.
- Legal and Regulatory Authorities: Where required by law, court order, or regulatory directive, bdrumyy may be obligated to disclose certain player data to law enforcement agencies or financial intelligence units. bdrumyy will only comply with such requests where legally compelled to do so and will inform the affected player where permitted by law.
All third-party data processors engaged by bdrumyy are required to maintain appropriate technical and organisational security measures, to process data only on bdrumyy's documented instructions, and to return or delete data upon termination of the processing relationship.
bdrumyy does not transfer your personal data to countries outside the jurisdiction where our platform is incorporated without ensuring that appropriate safeguards are in place — such as standard contractual clauses or equivalent data protection mechanisms — to protect your information during any such transfer.
Data Retention
bdrumyy retains your personal data only for as long as it is necessary for the purposes described in this Privacy Policy, or for as long as required by applicable law. The following retention schedule applies to the main categories of data held by bdrumyy:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account identity and contact data | Duration of account + 5 years after closure | AML compliance, dispute resolution |
| KYC verification documents | 5 years from date of verification | Regulatory and legal obligation |
| Financial transaction records | 7 years from transaction date | Financial reporting, AML obligations |
| Game session and betting history | 3 years from account closure | Dispute resolution, responsible gaming |
| Support communications | 3 years from last communication | Dispute resolution |
| Technical / log data (IP, device) | 12 months from collection | Security monitoring, fraud detection |
| Marketing consent records | Until consent is withdrawn + 2 years | Proof of consent |
When the applicable retention period expires, personal data is either permanently deleted from our systems or anonymised so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis without any privacy impact.
If you request deletion of your account and associated data, bdrumyy will action that request promptly subject to retaining data that we are legally required to keep under the applicable retention periods listed above. Data subject to a mandatory legal retention period cannot be deleted early even upon request.
Account Closure & Data
Closing your bdrumyy account does not immediately delete all associated data. bdrumyy is obligated under anti-money laundering and financial regulations to retain transaction records and identity verification documents for a minimum of 5–7 years after account closure. During this period, the data is stored securely and is not used for any commercial purpose.
Anonymisation vs. Deletion
Where full deletion is not immediately possible due to legal hold obligations, bdrumyy may anonymise your data — removing all identifying information so that the remaining records cannot be linked back to you as an individual. Anonymised data falls outside the scope of data protection law and may be retained as part of our aggregate analytics.
Your Privacy Rights
As a bdrumyy player, you hold the following rights over your personal data. To exercise any of these rights, submit a written request to [email protected] from your registered email address. bdrumyy will respond within 30 days.
Right of Access
You may request a copy of all personal data bdrumyy holds about you, including what categories of data are held, why, and who it has been shared with.
Right to Rectification
If any personal data bdrumyy holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
Right to Erasure
Also known as the "right to be forgotten". You may request deletion of your personal data where bdrumyy no longer has a lawful basis for retaining it, subject to legal hold requirements.
Right to Restrict Processing
You may request that bdrumyy temporarily suspend the use of your personal data — for example, while you contest its accuracy or while a complaint is under investigation.
Right to Data Portability
Where processing is based on consent or contract, you may request a machine-readable copy of your personal data to transfer to another service provider.
Right to Object
You may object to processing carried out on the basis of legitimate interests, including profiling. bdrumyy will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
To exercise any of the rights above, send a clear written request to [email protected] from the email address registered to your bdrumyy account. Please include your full name and account username to allow us to locate your records efficiently. bdrumyy will acknowledge your request within 5 business days and provide a full response within 30 calendar days. In complex cases, this period may be extended by a further 30 days with notification provided.
bdrumyy will not charge a fee for responding to privacy rights requests unless the request is manifestly unfounded or excessive in volume, in which case a reasonable administrative fee may apply with prior notification.
Data Security
bdrumyy implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, destruction, or alteration. These measures include:
- SSL/TLS Encryption: All data in transit between your device and bdrumyy servers is encrypted using industry-standard TLS 1.2 or higher. This protects your login credentials, payment data, and personal information during transmission.
- Encryption at Rest: Sensitive data fields — including passwords (stored as salted hashes), payment method identifiers, and identity documents — are encrypted at rest in our database infrastructure.
- Access Controls: Access to player personal data within bdrumyy's internal systems is restricted on a strict need-to-know basis. Staff who do not require access to personal data for their role are not granted it. Access logs are maintained and reviewed regularly.
- Password Security: User passwords are never stored in plain text. bdrumyy uses a modern cryptographic hashing algorithm with per-user salting. Even in the event of a data breach, stored passwords would not expose your plaintext credentials.
- Incident Response: bdrumyy maintains a documented data breach response procedure. In the event of a security incident that results in unauthorised access to personal data, we will assess the risk and notify affected players and relevant authorities within the timeframe required by applicable law.
- Infrastructure Security: bdrumyy's platform is hosted on hardened server infrastructure with firewalls, intrusion detection systems, and regular vulnerability assessments. Server-side security patches are applied promptly upon release.
While bdrumyy takes all reasonable steps to protect your data, no internet-based service can guarantee absolute security. You also have a responsibility to protect your own account by choosing a strong password, not sharing your credentials, and logging out of shared devices. If you suspect your account has been compromised, contact [email protected] immediately.
Password Best Practices
Use a unique password for your bdrumyy account that you do not use on any other service. A strong password contains at least 12 characters, mixes upper and lowercase letters, includes numbers, and contains at least one special character. Never share your password with anyone — bdrumyy support staff will never ask for your password.
Suspicious Activity
If you notice any unrecognised login activity, unexpected withdrawals, or unusual changes to your bdrumyy account, contact [email protected] immediately. Our security team operates 24/7 and will investigate promptly and freeze any suspicious transactions where necessary.
Contact & Privacy Requests
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how bdrumyy handles your personal data, please contact us using the details below. All privacy-related correspondence should be submitted in writing so that a clear record is maintained for both parties.
Privacy Contact:
Email: [email protected]
Subject line: Privacy Request — [Your Account Username]
Response time: Within 5 business days for acknowledgement; 30 days for full resolution.
When submitting a privacy request, please include the following information to allow bdrumyy to locate your records and respond efficiently:
- Your full name as registered on the bdrumyy account
- Your bdrumyy username
- The email address registered to your account
- A description of the specific right you wish to exercise or the concern you wish to raise
- For erasure or portability requests: confirmation that you understand the implications, including that erasure of data subject to legal hold periods cannot be immediately actioned
bdrumyy may need to verify your identity before processing a privacy rights request to ensure that data is not disclosed to or deleted at the request of an unauthorised third party. We may ask you to provide a copy of an identity document or to confirm specific account details for verification purposes.
If you are dissatisfied with bdrumyy's response to a privacy concern, you have the right to raise the matter with an appropriate data protection supervisory authority in the jurisdiction applicable to you. bdrumyy is committed to working constructively with supervisory authorities to resolve any complaints.
This Privacy Policy was last updated in January 2026. bdrumyy reserves the right to update this policy at any time to reflect changes in law, regulatory guidance, or our data processing practices. Where changes are material, registered players will be notified via email before the changes take effect. Continued use of the bdrumyy platform after notification of changes constitutes acceptance of the revised Privacy Policy.
Policy Updates
bdrumyy may update this Privacy Policy periodically. The effective date at the top of this page reflects the date of the most recent revision. We recommend reviewing this page at intervals to stay informed of any changes to how we handle your personal data.
Third-Party Links
The bdrumyy platform does not contain links to external third-party websites. This Privacy Policy applies solely to data collected and processed by bdrumyy. If in the future any third-party content is presented on the platform, those providers will be governed by their own privacy policies, which bdrumyy is not responsible for.
Ready to Play at bdrumyy?
Now that you understand how bdrumyy protects your personal data, explore our games, read our FAQ for common questions, or visit the bdrumyy Casino to get started. Play safely, play responsibly — 18+ only.