bad89 Privacy Policy

1. Information We Collect

bad89 collects personal information that is necessary to provide a safe, compliant, and fully functional online casino and sports betting platform to players in Bangladesh. We collect information in three primary ways: directly from you when you register or interact with the platform, automatically through your use of the service, and from third-party partners involved in payment processing and identity verification.

1.1 Information You Provide Directly

When you create a bad89 account or use our services, we may ask you to provide the following categories of personal information:

• Identity data: full legal name, date of birth, gender, and nationality as stated on your government-issued identification document.
• Contact data: email address, mobile phone number, and residential address (city, district, and division within Bangladesh).
• Identity verification documents: scanned copies or photographs of your National Identity Card (NID), passport, or other government-issued documents submitted during KYC verification.
• Payment data: bKash account number, Nagad account number, Rocket account number, Upay account number, bank account details, or Visa/Mastercard details used for deposits and withdrawals. Full card numbers are never stored by bad89; payment tokenisation is handled by our certified payment partners.
• Account preferences: preferred language, responsible gaming limits you have voluntarily set, and communication preferences.
• Support correspondence: the content of any messages, emails, or chat conversations you have with the bad89 support team.

1.2 Information Collected Automatically

When you access and use the bad89 platform, we automatically collect certain technical and behavioural data, including:

• Device and connection data: IP address, device type, operating system, browser type and version, screen resolution, and time zone.
• Usage data: pages visited, games played, bet history, session duration, click-through patterns, and feature interactions within the platform.
• Session data: login timestamps, logout timestamps, and session identifiers used to maintain a secure authenticated session.
• Geolocation data: approximate location derived from your IP address, used to apply market-appropriate content and responsible gaming settings. We do not collect precise GPS-level location data unless you explicitly grant permission on a supported device.

1.3 Information from Third Parties

bad89 may receive personal data about you from the following categories of third parties in the normal course of operating the platform:

• Payment processors: transaction confirmation data, payment method validation results, and fraud-screening outputs from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and other processing partners.
• Identity verification providers: the outcome of document verification checks and watchlist screening results used to comply with our KYC and anti-money-laundering obligations.
• Fraud detection partners: device fingerprint signals and risk scores used to identify potentially fraudulent account activity.

2. How We Use Your Data

bad89 processes your personal data only for specific, lawful purposes. We do not use your data for purposes that are incompatible with those stated below. The following table summarises the primary purposes for which we process your information and the legal basis on which we rely.

bad89 does not use automated decision-making that produces legal or similarly significant effects on players, except where such decisions are necessary for fraud prevention or compliance with legal obligations. In such cases, you have the right to request human review of any automated decision that affects your account.

3. Data Sharing & Third Parties

bad89 does not sell, rent, or otherwise commercially disclose your personal data to any third party. We share your information only in the circumstances described below, and only to the minimum extent necessary for the stated purpose.

3.1 Service Providers

We engage carefully selected third-party service providers to help us operate the bad89 platform. These providers act as data processors on our behalf and are contractually bound to process your data only as instructed by bad89 and in accordance with this Privacy Policy. Categories of service providers include payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard), identity verification specialists, cloud hosting providers, IT security and fraud detection firms, and customer support software vendors.

3.2 Game Software Providers

The games available on bad89 are supplied by third-party studios including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Ezugi, and Spribe. These providers may receive session identifiers and anonymous gameplay data as part of the normal technical operation of their games. They do not receive your full name, contact details, or payment information unless explicitly required for a specific service integration and disclosed to you at the time.

3.3 Legal and Regulatory Disclosure

bad89 may be required to disclose your personal data to law enforcement agencies, regulatory authorities, or courts in response to a lawful request, court order, or where disclosure is necessary to comply with applicable legal obligations, including anti-money-laundering and counter-terrorism-financing requirements. We will notify you of any such disclosure where we are legally permitted to do so.

3.4 Business Transfers

In the event that bad89 undergoes a merger, acquisition, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected players before any such transfer takes effect and before your data becomes subject to a materially different privacy policy.

4. Cookies & Tracking Technologies

bad89 uses cookies and similar technologies — including local storage objects and session tokens — to deliver a functional, secure, and consistent experience across all pages of the platform. This section explains what cookies we use and why.

4.1 Essential Cookies

These cookies are strictly necessary for the platform to function. They enable core features such as maintaining your authenticated session after bad89 login, storing your account preferences, and applying responsible gaming limits you have set. Essential cookies cannot be disabled without impairing the basic functionality of the platform.

4.2 Analytics Cookies

bad89 uses first-party analytics cookies to collect aggregated, anonymised data about how players navigate the platform. This data helps us identify pages that perform well and areas that need improvement. Analytics cookies do not track individual player identities and are never linked back to your personal account without your consent.

4.3 Security Cookies

Security cookies are used to support fraud detection, bot prevention, and session integrity verification. These cookies help bad89 identify and block suspicious access patterns, protecting the security of your account and the integrity of our platform.

4.4 Cookies We Do Not Use

bad89 does not use third-party advertising cookies, cross-site behavioural tracking pixels, social media tracking scripts, or retargeting tags of any kind. Your browsing activity on the bad89 platform is not shared with advertising networks.

4.5 Managing Cookies

You may configure your browser settings to block or delete cookies at any time. Please note that blocking essential cookies will prevent you from logging into your account and using the platform's core features. For guidance on managing cookies in your specific browser, refer to your browser's official help documentation.

5. Data Retention

bad89 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations. The following retention periods apply as a general guide:

• Account data and KYC documents: retained for a minimum of 5 years from the date of account closure, in compliance with anti-money-laundering record-keeping requirements.
• Transaction records: retained for a minimum of 5 years from the date of each transaction.
• Support correspondence: retained for 2 years from the date of the last interaction, after which records are anonymised or deleted.
• Analytics and usage data: aggregated and anonymised after 13 months; no individually identifiable records are retained beyond this period.
• Marketing consent records: retained for as long as you remain an active player, or until you withdraw consent, plus 1 year thereafter to demonstrate compliance.

When personal data is no longer required for its original purpose or any secondary legal purpose, bad89 will securely delete or irreversibly anonymise it in accordance with our data destruction procedures. Anonymised data — which can no longer be attributed to any specific individual — may be retained indefinitely for statistical analysis and platform improvement purposes.

6. Your Privacy Rights

As a player on the bad89 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact the bad89 Data Protection team at the address provided in Section 8 of this policy. We will respond to all verified requests within 30 days.

• Right of access: you may request a copy of the personal data bad89 holds about you, together with information about how it is processed.
• Right to rectification: if any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected.
• Right to erasure: in certain circumstances, you may request that bad89 delete your personal data. Note that we may be required to retain some data to comply with legal obligations even after an erasure request.
• Right to restriction: you may request that we restrict processing of your personal data in specific circumstances, for example while a correction request is being resolved.
• Right to data portability: where processing is based on your consent or a contractual relationship, you may request a structured, machine-readable export of your personal data.
• Right to object: you may object to processing of your personal data where we rely on legitimate interest as the legal basis, including for direct marketing purposes.
• Right to withdraw consent: where we process your data on the basis of your consent (for example, for promotional communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

bad89 will not charge a fee for handling data rights requests that are reasonable in scope. Where a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline to act, and will notify you accordingly with an explanation.

7. Data Security Measures

bad89 applies a layered security architecture to protect your personal data from unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to, the following:

• Transport Layer Security (TLS 1.2+): all data exchanged between your device and bad89 servers is encrypted in transit, including login credentials, payment data, and personal account information.
• AES-256 encryption at rest: personal data and payment information stored in bad89 databases is encrypted using AES-256, a military-grade encryption standard.
• Access controls and role-based permissions: internal access to player data is restricted on a strict need-to-know basis. No single team member has unrestricted access to all data categories.
• Multi-factor authentication: administrative and internal systems require multi-factor authentication for all personnel with access to production data environments.
• Penetration testing and vulnerability scanning: bad89 conducts regular third-party penetration tests and continuous automated vulnerability scans across all platform components.
• Incident response procedures: bad89 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected players promptly and take all necessary remedial steps.

While bad89 takes all reasonable and practicable steps to protect your data, no internet-based service can guarantee absolute security. You are responsible for keeping your bad89 login credentials confidential and for logging out of the platform when using shared or public devices. If you suspect that your account has been compromised, please contact our support team immediately.

8. Contact & Data Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bad89 handles your personal data, please contact our Data Protection team using the details below. All privacy-related correspondence will be handled with strict confidentiality.

bad89 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or regulatory guidance. When material changes are made, we will update the effective date at the top of this document and, where appropriate, notify registered players via their registered email address. We encourage you to review this policy from time to time to stay informed about how we protect your information.