brummy Privacy Policy

brummy ("we", "us", "our") operates the online casino and sports betting platform accessible at brummy.club, serving players across Bangladesh with a portfolio of casino games, live dealer tables, jackpot slots, cricket betting, sports wagering, and lottery products. brummy is the data controller in respect of all personal data collected through the platform.

This Privacy Policy ("Policy") governs the collection, use, storage, sharing, and protection of personal data submitted to or collected by brummy in the course of your use of our website, mobile-optimised interface, and any associated services. This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference.

brummy collects personal data through several channels: directly from you when you register an account or contact our support team, automatically when you interact with our platform, and from trusted third-party service providers (such as payment processors and identity verification partners) as part of our standard operational procedures.

The categories of personal data we collect are set out in the table below:

We do not knowingly collect special categories of sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless this is strictly required for responsible gaming self-exclusion purposes, in which case such data is handled with the highest degree of care and stored in isolated, access-controlled systems.

brummy uses the personal data we collect for the following specific and documented purposes. We do not use your data for any purpose that is incompatible with the original reason for which it was collected without first obtaining your explicit consent.

• Account creation and management: To register your account, verify your identity, maintain your account profile, and communicate essential account-related information such as security alerts, password resets, and policy updates.
• Transaction processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard, and to maintain accurate financial records of all account activity.
• Identity and age verification (KYC): To verify that you meet the minimum age requirement of 18 years and to confirm that the person operating the account is the same individual who registered it, in compliance with anti-money-laundering (AML) obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms and Conditions.
• Personalisation: To tailor the content, game recommendations, promotional offers, and user interface of the platform to your demonstrated preferences and playing history, where you have consented to personalisation.
• Customer support: To respond to your queries, resolve disputes, process complaints, and improve the quality and responsiveness of our support services.
• Responsible gaming: To monitor gameplay patterns for signs of problematic gambling behaviour, to apply and enforce deposit limits, time-out periods, and self-exclusion requests, and to direct at-risk players to appropriate support resources.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates by email or SMS — but only where you have opted in to receive such communications. You may opt out at any time.
• Legal compliance: To comply with applicable laws, regulations, court orders, and requests from competent regulatory authorities, including record-keeping obligations and mandatory reporting requirements.
• Platform improvement: To analyse aggregated, anonymised usage data for the purposes of improving platform performance, fixing bugs, developing new features, and enhancing the overall player experience.

brummy processes your personal data only when we have a valid legal basis for doing so. The legal bases we rely upon are as follows:

• Contractual necessity: Processing that is required to perform our contract with you — including account registration, transaction processing, identity verification, and customer support — is carried out on the basis that it is necessary for the performance of that contract.
• Legal obligation: Certain processing activities — including KYC identity checks, AML transaction monitoring, and the retention of financial records — are required by applicable law and are carried out on the basis of legal obligation.
• Legitimate interests: brummy processes Technical Data and Usage Data for fraud prevention, security monitoring, and platform analytics on the basis of our legitimate interest in operating a safe, reliable, and commercially sustainable platform. We have assessed these interests against your privacy rights and determined that they do not override your fundamental interests or freedoms.
• Consent: Where processing is not required by contract or law — in particular, for marketing communications and optional personalisation — we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without detriment to your account.

brummy does not sell or rent your personal data to third parties. We share your data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment processors: Your financial data is shared with our payment partners — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and international card schemes — solely for the purpose of executing your deposit and withdrawal instructions.
• Identity verification providers: Your identity documents and personal details may be passed to trusted third-party KYC and AML compliance service providers for the purpose of verifying your identity and screening against watchlists as required by law.
• Game content providers: Certain technical identifiers (such as a pseudonymous player ID and session token) are shared with our game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) solely to the extent needed to initialise and maintain your game session. These providers do not receive your full identity data.
• Analytics and technology partners: Aggregated and/or anonymised usage data may be shared with analytics platforms to help us understand platform performance. No personally identifiable information is included in such transfers.
• Regulatory and legal authorities: brummy may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory authorities where required to do so by applicable law, valid court order, or regulatory direction. We will notify you of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of brummy's business, your personal data may be transferred to the successor entity as part of the transaction, subject to equivalent privacy protections remaining in place.

All third parties with whom brummy shares personal data are required to treat that data confidentially, to use it only for the specified purpose, and to maintain appropriate technical and organisational security measures.

brummy uses cookies and similar tracking technologies (including local storage and session tokens) on our platform to ensure core functionality, improve your experience, and gather aggregated analytics. The categories of cookies we use are as follows:

• Strictly necessary cookies: These cookies are essential for the platform to function. They include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. The platform cannot operate without these cookies and they cannot be disabled.
• Functional cookies: These cookies remember your preferences — such as your preferred language, currency display, and notification settings — so you do not have to re-enter them on each visit. Disabling these cookies may reduce your comfort when using the platform but will not prevent core functionality.
• Analytics cookies: These cookies collect aggregated, anonymised information about how visitors use the platform — pages visited, session duration, game categories explored — to help us understand performance and improve the user experience. No personally identifiable information is transmitted via analytics cookies.
• Marketing cookies: Where you have consented to receive personalised promotions, marketing cookies may be used to track which offers you have seen or interacted with, so that we can avoid showing you irrelevant or repetitive communications. You may withdraw this consent at any time through your account preferences.

brummy retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention guidelines are set out below:

• Account data (identity, contact, KYC documents): Retained for the duration of your active account relationship with brummy, plus a minimum of 5 years following account closure, to comply with AML record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in line with standard financial compliance requirements.
• Customer support communications: Retained for 3 years from the date of the communication, or for the duration of any ongoing dispute or legal proceedings, whichever is longer.
• Marketing preference records: Retained for the duration of your account relationship plus 2 years after account closure, to demonstrate compliance with consent obligations.
• Technical and usage logs: Typically retained for 12 months from the date of generation, after which they are aggregated and anonymised or securely deleted.

When the applicable retention period expires, data is either securely deleted using industry-standard deletion methods or permanently anonymised so that it can no longer be associated with any individual. Data that must be retained to comply with a legal obligation or to defend a legal claim will be preserved for as long as that obligation or claim remains live.

brummy implements a multi-layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• Encryption in transit: All data transmitted between your device and brummy's servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and regularly renewed to ensure continuous protection.
• Encryption at rest: Sensitive personal data stored in our databases — including identity documents, financial records, and authentication credentials — is encrypted at rest using industry-standard algorithms.
• Access controls: Access to systems containing personal data is restricted on a strict need-to-know basis. All staff members with access to personal data undergo background screening and are bound by confidentiality obligations.
• Intrusion detection and monitoring: Our platform is monitored continuously for anomalous activity, potential intrusions, and data exfiltration attempts using automated security information and event management (SIEM) tools.
• Penetration testing: brummy conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, brummy will notify affected users as promptly as the investigation permits, and will take all reasonable steps to contain and mitigate the breach.

As a brummy member, you hold the following rights in respect of the personal data we process about you. These rights may be exercised at any time by contacting our support team at [email protected] with the subject line "Privacy Rights Request":

• Right of access: You may request a copy of the personal data brummy holds about you, together with information about how it is used and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing based on legitimate interests and we cannot demonstrate an overriding justification. This right is subject to our legal retention obligations.
• Right to restriction of processing: You may request that we restrict the processing of your data in certain circumstances — for example, while a rectification request is being assessed.
• Right to data portability: Where processing is carried out by automated means on the basis of your consent or contract, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests at any time. You also have an unconditional right to object to the use of your data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

brummy will acknowledge all Privacy Rights Requests within 5 business days and will provide a substantive response within 30 calendar days of receipt. We will never charge a fee for processing a reasonable request, and we will never restrict your account as a consequence of exercising your privacy rights.

brummy is a gambling platform intended exclusively for adults. We do not knowingly collect personal data from individuals under the age of 18. Registration requires confirmation that the user is at least 18 years of age, and all accounts are subject to mandatory age and identity verification as part of our KYC process.

If brummy becomes aware that a registered account belongs to an individual under the age of 18, we will immediately suspend the account, void any bets placed, return any unplayed deposited funds to the originating payment method following verification, and permanently delete all personal data associated with the underage account from our systems as soon as our legal obligations permit.

brummy reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made to this Policy, we will notify registered members by email to the address on file and by displaying a prominent notice on the brummy.club homepage for a period of at least 14 days prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page and in the table of contents sidebar will be revised each time this Policy is updated. We encourage you to review this Policy periodically to stay informed of how brummy protects your personal data.

Your continued use of the platform following the effective date of an amended Policy constitutes your acknowledgement of the updated terms. If you do not agree with any material change to this Policy, you may close your account by contacting our support team and requesting account closure in accordance with the procedures described in our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data brummy holds about you, please contact our Data Support team through any of the following channels:

• Email: [email protected] — use the subject line "Privacy Rights Request" for data subject access requests or "Privacy Enquiry" for general questions about this Policy.
• Live Chat: Available 24 hours a day, 7 days a week, directly within the brummy platform. Average response time: 2–5 minutes. Suitable for urgent account security concerns.

brummy's support team operates on Bangladesh Standard Time (BST, UTC+6), 365 days a year. All privacy correspondence is handled in English and Bengali. We are committed to resolving all privacy-related enquiries promptly, fairly, and transparently.