Privacy Policy
2xwinner

2xwinner processes your personal data for the following clearly defined purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your consent or notifying you of the change in accordance with the "Changes to This Policy" section.

Account Management and Service Delivery

The most fundamental use of your data is to create and maintain your player account, authenticate your identity at login, process your deposits and withdrawals in Bangladeshi Taka (BDT) via bKash, Nagad, Rocket, Upay, and partner banks, and to provide access to all casino games, cricket betting markets, slots, and live dealer tables on the 2xwinner platform. Without this processing, we cannot provide you with any services.

Identity Verification and KYC Compliance

We use identity data — including your name, date of birth, address, and government-issued documents — to verify your identity, confirm you are 18 years of age or older, and comply with our Know Your Customer (KYC) obligations. This processing is also essential for our Anti-Money Laundering (AML) monitoring programme, which reviews transaction patterns to detect and prevent financial crime.

Responsible Gaming Monitoring

Your gaming activity data — including session durations, bet sizes, deposit frequency, and win/loss patterns — is used to operate our responsible gaming tools. This includes monitoring for signs of problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and proactively reaching out to players who may be exhibiting at-risk patterns. This processing is conducted in the interest of player welfare and is a core component of our responsible gaming programme. See our Responsible Gaming page for full details.

Security and Fraud Prevention

IP addresses, device fingerprints, session data, and transaction histories are analysed by our security systems to detect and prevent fraudulent activity, multi-accounting, bonus abuse, unauthorised account access, and money laundering. This processing is essential to protect both the integrity of the platform and the interests of legitimate players.

Marketing and Promotional Communications

If you have opted in to marketing communications during registration or subsequently via your account settings, we will use your email address and mobile number to send you information about bonuses, promotions, seasonal offers (such as BPL cricket promotions, Eid special offers, and Pohela Boishakh bonuses), and new games on 2xwinner. You may withdraw your consent to marketing communications at any time by updating your account preferences or by emailing support@2xwinner. Withdrawal of marketing consent does not affect the lawfulness of processing conducted prior to withdrawal, and will not prevent us from sending transactional communications (such as deposit confirmations, withdrawal notifications, and account security alerts).

Customer Support

When you contact our support team via live chat or email, the information you provide — including your account details, the nature of your query, and any correspondence exchanged — is used to respond to and resolve your request. Support records are retained for a period defined in Section 6 to enable us to reference prior interactions in future disputes or escalations.

Platform Analytics and Improvement

Aggregated and anonymised usage data is used to understand how players navigate the 2xwinner platform, which games and features are most popular, and where user experience improvements can be made. This processing uses anonymised data wherever possible and does not involve profiling individual players for commercial purposes without consent.

We do not sell your personal data. However, in order to operate the 2xwinner platform effectively and comply with our legal obligations, we share certain categories of personal data with trusted third-party partners and service providers. All third parties with whom we share data are required to handle it in accordance with applicable data protection standards and are permitted to use it only for the purposes specified by 2xwinner.

Payment Providers

To process your deposits and withdrawals in BDT, we share your account identifier and transaction details with our payment processing partners — including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and Sonali Bank. Each payment provider operates under its own privacy and security framework regulated by Bangladesh Bank. 2xwinner does not transmit your full banking credentials or mobile banking PIN to these providers — authentication with your payment method is handled directly between you and the provider.

Game Providers

Some game providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive a pseudonymous player identifier to facilitate game session management, audit trail maintenance, and RNG certification. These providers do not receive your name, address, or payment data in connection with game sessions.

Identity Verification Services

To fulfil our KYC obligations, we use third-party identity verification services to validate the authenticity of government-issued documents submitted by players. These services process document images and perform automated verification checks. Document data shared with verification partners is used solely for KYC purposes and is not retained by those partners beyond the verification workflow.

Analytics and Technology Providers

We use third-party technology providers for platform analytics, security monitoring, and infrastructure services. Where these providers process personal data on our behalf, they do so as data processors under strict contractual data processing agreements. They do not use your data for their own commercial purposes.

Legal and Regulatory Authorities

2xwinner will disclose personal data to law enforcement agencies, financial intelligence units, regulatory bodies, or courts when required to do so by applicable law, court order, or regulatory instruction. We will endeavour to notify you of any such disclosure where we are legally permitted to do so.

Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of 2xwinner's business assets, personal data held by 2xwinner may be transferred to the acquiring entity as part of that transaction. In such circumstances, we will notify affected players via their registered email address prior to the transfer and inform them of any material changes to this Privacy Policy that result from the transaction.

2xwinner retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, to comply with applicable legal and regulatory obligations, and to resolve any outstanding disputes or enforce our agreements. The following retention periods apply to different categories of data held by 2xwinner:

• Account Registration Data (name, date of birth, address, email, mobile number): Retained for the lifetime of the account plus 5 years after account closure, to comply with AML record-keeping requirements.
• KYC Identity Documents (NID, passport, driving licence, proof of address): Retained for 5 years from the date of verification, or 5 years from account closure, whichever is later. This retention period reflects standard AML compliance obligations.
• Transaction and Financial Records (deposit history, withdrawal history, bet history): Retained for 7 years from the date of each transaction to comply with financial record-keeping obligations under applicable law.
• Gaming Activity Logs (game sessions, bet outcomes, RNG audit trails): Retained for 3 years from the date of activity for responsible gaming monitoring, dispute resolution, and game provider audit purposes.
• Support Correspondence (live chat logs, email threads): Retained for 3 years from the date of the interaction to facilitate dispute resolution and quality assurance reviews.
• Marketing Consent Records: Retained for the duration of your opted-in period plus 3 years after consent withdrawal, to demonstrate compliance with consent requirements.
• Cookie and Analytics Data: Session cookies are deleted automatically at the end of each browser session. Persistent analytics cookies expire after a maximum of 13 months.
• Self-Exclusion Records: Retained indefinitely to prevent re-registration during an active exclusion period, and for a minimum of 5 years after the exclusion period ends to support responsible gaming monitoring.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data cannot be immediately deleted due to technical constraints (e.g., backup media), it will be isolated from active processing until deletion is possible.

2xwinner takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, or disclosure. The following security controls are in place across the 2xwinner platform:

Technical Security Measures

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and 2xwinner is encrypted in transit using TLS 1.2 or higher. This prevents interception of your credentials, payment data, and personal information during transmission.
• Encrypted Data Storage: Sensitive data fields — including identity document references, payment identifiers, and authentication credentials — are encrypted at rest using AES-256 encryption on our servers.
• Password Hashing: Account passwords are never stored in plain text. They are hashed using a strong adaptive hashing algorithm (bcrypt) with a unique per-user salt, ensuring that even in the event of a data breach, your actual password cannot be recovered from the stored hash.
• Two-Factor Authentication (2FA): 2xwinner offers two-factor authentication as an additional layer of account security. We strongly encourage all players to enable 2FA via their account security settings.
• Firewall and Intrusion Detection: Our servers are protected by enterprise-grade firewalls and real-time intrusion detection systems that monitor for and block suspicious access patterns and known attack signatures.
• Automated Fraud Detection: Our platform employs automated systems that continuously monitor login attempts, transaction patterns, and session behaviour to detect and respond to signs of fraud, account takeover, or unauthorised access in real time.

Organisational Security Measures

• Access Controls: Personal data is accessible only to those members of the 2xwinner team who have a legitimate operational need to access it. Access is managed via role-based access controls and is reviewed regularly.
• Staff Training: All staff who handle personal data receive regular training on data protection obligations, secure data handling procedures, and incident response protocols.
• Data Breach Response: In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, 2xwinner will take immediate steps to contain the breach, assess its scope and impact, and notify affected players via their registered email address without undue delay. We will provide clear information about what data was affected, what steps we are taking, and what actions you can take to protect yourself.
• Third-Party Security Assessments: Third-party service providers who process personal data on behalf of 2xwinner are subject to security assessment prior to engagement and are required to maintain security standards consistent with those applied by 2xwinner.

While 2xwinner implements robust security measures, no online platform can guarantee absolute security. You play an important role in keeping your account secure by choosing a strong, unique password, enabling 2FA, keeping your login credentials confidential, and reporting any suspected unauthorised access to your account immediately via support@2xwinner.

Right to Update: 2xwinner reserves the right to update, revise, or replace any part of this Privacy Policy at any time. Changes may be required to reflect updates to the services we offer, new data processing activities, changes in applicable data protection law or regulatory guidance, or improvements to our privacy practices.

Notification of Material Changes: When we make material changes to this Privacy Policy — that is, changes that significantly affect how we collect, use, or share your personal data — we will notify you by one or more of the following methods: a prominent notice displayed on the 2xwinner platform upon your next login, an email sent to your registered email address, or a notice posted on the 2xwinner homepage. The revised Privacy Policy will carry an updated "Last Updated" date at the top of this page.

Continued Use as Acceptance: Following notification of a material change, your continued use of the 2xwinner platform — including logging in, placing bets, playing games, or making deposits — constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised terms, you should stop using the platform and contact support@2xwinner to request account closure before the revised policy takes effect.

Review Responsibility: We recommend that you review this Privacy Policy periodically, particularly if you have not used the platform for an extended period. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Contact for Privacy Enquiries: For any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data by 2xwinner, please contact our data team at support@2xwinner with the subject line "Privacy Enquiry". We aim to respond to all privacy-related correspondence within 5 business days.

Entire Privacy Framework: This Privacy Policy should be read alongside the 2xwinner Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your use of the platform and our obligations to you as a player.