md222 Privacy
Policy

📋 Information We Collect

When you register an account, deposit funds, place bets, or contact md222 customer support, we may collect and process the following categories of personal data:

md222 does not collect or store your full bKash PIN, Nagad PIN, card number (PAN), CVV, or online banking login credentials. Payment transactions are processed exclusively through tokenised, encrypted integrations with the official APIs of each payment partner. md222 only retains the minimum transaction reference data required for reconciliation, dispute resolution, and regulatory compliance.

Where we need to collect personal data by law or under a contractual obligation and you fail to provide that data when requested, we may not be able to create or maintain your md222 account, process your transactions, or provide the requested service. We will notify you clearly at the point of data collection if providing certain information is mandatory versus optional.

⚙️ How We Use Your Data

md222 processes your personal data only where we have a lawful basis to do so. The primary legal bases we rely on are: performance of a contract (operating your account and processing bets), compliance with a legal obligation (KYC, anti-money-laundering checks), legitimate interests (fraud prevention, platform security), and, in limited cases, your explicit consent (optional marketing communications).

The following table sets out the specific purposes for which md222 processes your personal data:

md222 does not use automated decision-making that produces legal or similarly significant effects on players without human review. Where automated systems flag an account for suspected fraud, underage activity, or bonus abuse, a trained member of the md222 compliance team manually reviews the case before any account action is taken.

If you have opted in to receive promotional communications from md222 — including bonus offers, BPL/IPL season promotions, Eid specials, and Pohela Boishakh rewards — you may withdraw your consent at any time by contacting support at [email protected] or updating your communication preferences in the account dashboard. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

🤝 Data Sharing & Third Parties

md222 may share your personal data with the following categories of third parties:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard, solely for the purpose of processing your deposit and withdrawal transactions. These providers operate under their own strict privacy and data security policies and are required to handle your data in accordance with applicable financial regulations.
• Game Technology Providers: Third-party game studios and RNG (Random Number Generator) platform providers whose games are hosted in the md222 game lobby. These providers may receive limited technical session data to load and operate games securely. They do not receive your identity or financial data.
• Identity Verification Services: KYC and age-verification technology providers who assist md222 in verifying identity documents and confirming that players meet the 18+ age requirement. These providers are bound by confidentiality obligations and process data only on md222's instruction.
• Fraud Prevention and AML Services: Third-party fraud detection, transaction monitoring, and anti-money laundering platforms that analyse behavioural and transactional data to identify suspicious activity. These services help md222 protect the platform and its players from financial crime.
• Analytics Providers: Anonymised, aggregated usage data may be shared with analytics platforms to help md222 understand how the platform is used and to improve the player experience. No personally identifiable information is included in these analytics data flows.
• Legal and Regulatory Authorities: md222 will disclose personal data to law enforcement agencies, courts, or regulatory bodies when required to do so by law, court order, or regulatory instruction. md222 will notify the affected player wherever it is legally permissible to do so before making such a disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets involving md222, your personal data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and the privacy terms applicable to their data under the new entity.

All third-party processors that handle md222 player data on our behalf are required to sign data processing agreements that mandate appropriate technical and organisational security measures, restrict the use of data to the agreed purpose, and require notification to md222 in the event of a data breach involving md222 player data.

🍪 Cookies & Tracking Technologies

md222 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate the platform, maintain your login session, remember your preferences, detect fraud, and improve site performance. By continuing to use the md222 platform, you consent to the use of cookies as described in this section.

The following categories of cookies are used on the md222 platform:

md222 does not use third-party advertising cookies or behavioural tracking cookies that build profiles of your activity across external websites. The tracking technologies deployed on md222 are limited to those that support the direct operation, security, and improvement of the md222 platform itself.

You can control and manage cookies through your web browser settings. Please note that disabling strictly necessary or security cookies will impair the functionality of the md222 platform, including your ability to log in, deposit funds, or play games. For guidance on managing cookies in your specific browser, visit the help documentation provided by your browser's developer.

🗓️ Data Retention

md222 retains your personal data only for as long as is necessary for the purposes for which it was collected, including compliance with legal, accounting, and reporting obligations. When the retention period applicable to a specific data category has expired, that data is securely deleted or anonymised so that it can no longer be attributed to any individual player.

The following retention periods apply to the main categories of md222 player data:

• Account and Identity Data: Retained for the duration of your active account and for 5 years after permanent account closure. This retention period supports our obligations in relation to anti-money laundering regulations and potential dispute resolution.
• Financial Transaction Data: Retained for 7 years from the date of each transaction, in accordance with standard financial record-keeping requirements. This includes deposit records, withdrawal records, and bet transaction logs.
• KYC Verification Documents: Retained for the duration of your account and for 5 years after closure. Original document images are securely deleted once the verification outcome has been confirmed; only the verification result and reference number are retained beyond that point.
• Customer Support Communications: Retained for 2 years from the date of the last interaction. This allows md222 to refer back to prior support history when handling follow-up queries or escalations.
• Responsible Gaming Records: Self-exclusion requests, deposit limit settings, and cooling-off period records are retained for the duration of the exclusion/limit plus 5 years. This ensures that re-registration attempts after a self-exclusion period are correctly managed.
• Technical and Usage Data: Retained in identifiable form for up to 12 months and then anonymised for long-term analytics purposes. Anonymised analytics data may be retained indefinitely as it cannot be traced to an individual player.
• Marketing Consent Records: Retained for 2 years after consent is withdrawn, solely as evidence that the processing during the consent period was lawful.

Where md222 is involved in active litigation, regulatory investigation, or formal dispute with a player, relevant data will be retained beyond the standard retention periods set out above until the matter is fully resolved.

⚖️ Your Privacy Rights

The following rights are available to all md222 players in relation to their personal data:

• Right of Access: You have the right to request a copy of the personal data md222 holds about you, along with information about how it is used and with whom it has been shared. md222 will respond to verified access requests within 30 days of receipt.
• Right to Rectification: If any of the personal data md222 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Certain data updates (such as legal name or date of birth corrections) may require supporting documentation to verify the change.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no overriding legal basis; or (c) the data has been unlawfully processed. Note that erasure requests cannot be fulfilled where md222 is required to retain the data by law or for the defence of legal claims.
• Right to Restriction of Processing: You may request that md222 temporarily suspend the processing of your personal data — for example, while the accuracy of data is being contested or a legitimate interest objection is being assessed — without requiring deletion of the data.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to md222 in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to request that this data be transmitted to another data controller where technically feasible.
• Right to Object: You have the right to object to md222 processing your personal data for legitimate interest purposes (including profiling for fraud detection). md222 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the defence of legal claims.
• Right to Withdraw Consent: Where md222 processes your data on the basis of consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, contact the md222 Data Protection team at [email protected]. md222 will verify your identity before processing any rights request and will respond within 30 calendar days. Where a request is complex or numerous, md222 may extend this period by a further 30 days, notifying you of the extension and the reasons for it.

🛡️ Data Security

md222 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures are reviewed and updated on a regular basis to reflect evolving security best practices and emerging threats.

Key security measures deployed on the md222 platform include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the md222 platform — including login credentials, payment data, and personal information — is encrypted using industry-standard 256-bit SSL/TLS protocols. You can verify this by checking for the padlock icon in your browser's address bar when accessing md222.app.
• Password Security: Player passwords are stored using one-way cryptographic hashing algorithms with per-account salting. md222 staff cannot view your password in plaintext. md222 will never ask you for your password via email, live chat, or any other channel.
• Two-Factor Authentication (2FA): OTP-based two-factor authentication is available for all registered md222 accounts and is strongly recommended for all players, particularly those with regular deposit activity above ৳10,000 per session.
• Access Controls: Access to md222 player data within the organisation is restricted on a strict need-to-know basis. Staff with access to personal data receive mandatory privacy and data security training and are bound by confidentiality obligations in their employment agreements.
• Payment Data Isolation: md222 does not store full payment credentials (PINs, full card numbers, CVV codes, or bank login details) on its own systems. All sensitive payment data is handled exclusively by the respective payment provider's certified infrastructure using tokenised references.
• Incident Response: md222 maintains a documented data breach response procedure. In the event of a security incident that poses a risk to player data, md222 will notify affected players and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable data protection obligations.

📬 Contact & Data Controller

md222 is the data controller for all personal data processed through the md222 platform at md222.app. If you have any questions, concerns, or requests relating to this Privacy Policy or the way md222 handles your personal data, please contact the md222 Data Protection team using the details below.

If you believe that md222 has not handled your personal data in accordance with this Privacy Policy, you have the right to lodge a complaint. md222 takes all privacy complaints seriously and will investigate and respond to every complaint in good faith within the timeframes stated above.

md222 reserves the right to update this Privacy Policy at any time to reflect changes in applicable laws, regulatory guidance, or our data processing practices. When material changes are made, md222 will display a prominent notice on the platform and, where appropriate, send notification to registered players via their registered email address. Continued use of the md222 platform following notification of a Privacy Policy update constitutes acceptance of the revised terms.