ba66 Privacy Policy

---

1 Introduction

ba66 is Bangladesh's trusted online casino and sports betting platform, serving adult players across Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all other regions of Bangladesh. As a platform that handles financial transactions, account credentials, and sensitive personal information, ba66 treats data privacy as a core operational responsibility — not merely a regulatory formality.

This Policy is written in plain, accessible English so that every ba66 player can understand precisely how their personal data is handled from the moment they visit ba66.bid through the entirety of their relationship with ba66. We encourage all players to read this document in full and to contact our support team if any part is unclear.

This Policy should be read alongside ba66's Terms & Conditions and Responsible Gaming policy, both of which form part of the overall agreement between ba66 and each registered player.

---

2 Who We Are

ba66 operates the online casino and sports betting platform accessible at ba66.bid. For the purposes of this Privacy Policy, ba66 is the data controller — meaning we are the entity that determines the purposes for which and the manner in which your personal data is processed.

If you have any questions about how ba66 handles your personal data, or if you wish to exercise any of the data rights described in Section 11, you may contact ba66's data handling team via the contact details set out in Section 16 of this Policy.

---

3 Personal Data We Collect

ba66 collects personal data in the following categories. We apply the principle of data minimisation, meaning we collect only what is necessary for the specific purpose described.

3.1 Registration & Identity Data

• Full legal name
• Date of birth (to verify you are 18 years of age or older)
• Residential address, including city and district within Bangladesh
• Mobile phone number (registered in Bangladesh)
• Email address
• Username and hashed password

3.2 Identity Verification (KYC) Data

• National ID card number or passport number
• Government-issued photographic identification document images
• Proof of address documentation
• Selfie photographs submitted for liveness verification where requested

3.3 Financial & Transaction Data

• Payment method details (bKash account number, Nagad account number, Rocket number, Upay details, masked Visa/Mastercard numbers)
• Deposit amounts, withdrawal amounts, and transaction timestamps
• Account balance history and transaction records

3.4 Gaming & Betting Activity Data

• Game session records including game names, bet amounts, outcomes, and timestamps
• Sports betting slip records including market, selection, stake, and settlement details
• Bonus and promotional activity records

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session cookies and persistent cookies (see Section 10)
• Page interaction data and clickstream analytics

3.6 Communications Data

• Records of live chat, email, and support ticket communications with ba66's customer support team
• Records of any complaint or dispute submitted to ba66
• Marketing preference settings and opt-in/opt-out records

---

4 How We Collect Your Data

ba66 collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or update your account profile.
• Automatically: Through cookies, server logs, and analytics tools when you browse or interact with ba66.bid. This includes IP address logging, session data, and device fingerprinting for fraud prevention purposes.
• From payment processors: When you initiate a transaction via bKash, Nagad, Rocket, Upay, or a card payment network, relevant transaction data is shared with ba66 by the payment processor to confirm and reconcile your deposit or withdrawal.
• From identity verification partners: Where ba66 uses a third-party KYC service to verify identity documents, that partner shares verification status and extracted data points with ba66 as part of the verification workflow.
• From fraud prevention databases: ba66 may check submitted registration data against third-party fraud prevention and AML screening databases to detect suspicious activity or sanctioned individuals.

---

5 Why We Use Your Personal Data

The table below summarises each purpose for which ba66 processes your personal data, together with the category of data used for that purpose.

---

6 Legal Basis for Processing

ba66 processes your personal data on one or more of the following legal bases, depending on the specific purpose:

• Contractual necessity: Processing is necessary to fulfil the contract between ba66 and you as a registered player — including account management, payment processing, and game provision.
• Legal obligation: Processing is required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and responses to lawful requests from competent authorities.
• Legitimate interests: Processing is necessary for ba66's legitimate business interests, including fraud prevention, platform security, and analytics to improve services, provided those interests are not overridden by your data protection rights.
• Consent: For optional processing activities such as marketing communications and non-essential cookies, ba66 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time — see Section 11.

---

7 Sharing Your Personal Data

ba66 does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. ba66 may share your personal data with the following categories of third party only where strictly necessary and subject to appropriate data protection obligations:

7.1 Payment Processors

ba66 shares transaction-relevant data with payment service providers including bKash, Nagad, Rocket, Upay, and card payment networks (Visa, Mastercard) in order to process your deposits and withdrawals. These providers process your data as independent data controllers subject to their own privacy policies.

7.2 Identity Verification Partners

Where ba66 uses a third-party KYC provider to verify identity documents, the relevant documentation and personal data are shared with that provider solely for verification purposes. The provider is contractually bound to process the data only for this specified purpose.

7.3 Game Content Providers

ba66's casino and sports betting products are powered by third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, Microgaming, NetEnt, and Spribe. Minimal technical data (such as a pseudonymous player session identifier) is shared with these providers to enable game session management. No personally identifiable information beyond what is technically required is shared with game providers.

7.4 Fraud Prevention & AML Services

ba66 may share data with fraud prevention and AML screening services to check registration details and transaction patterns against known fraud indicators and sanctions lists. This processing is carried out in ba66's legitimate interest and to fulfil legal obligations.

7.5 Legal & Regulatory Authorities

ba66 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, a court order, or a lawful request from a competent authority. ba66 will, where permitted by law, notify the affected player of such a request.

7.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of ba66's business assets, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and of any change in data controller identity via the registered email address on file.

---

8 International Data Transfers

ba66's primary operational infrastructure is located in servers serving the Bangladesh region. However, some of ba66's third-party service providers — including game content providers and fraud prevention services — may be located outside Bangladesh and may process your data in other jurisdictions.

Where personal data is transferred internationally, ba66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include contractual clauses, data processing agreements, or the use of providers operating under internationally recognised data protection frameworks.

---

9 Data Retention

ba66 retains your personal data only for as long as is necessary for the purposes for which it was collected, or for as long as is required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your active account relationship with ba66, plus a minimum of five years following account closure to satisfy AML record-keeping obligations.
• KYC and identity verification documents: Retained for a minimum of five years following account closure or the date of the last relevant transaction, in accordance with anti-money laundering regulations.
• Financial transaction records: Retained for a minimum of five years following the transaction date.
• Customer support communications: Retained for three years following the resolution of the relevant inquiry or dispute.
• Marketing preference records: Retained for the duration of your account, updated in real time when you change your preferences.
• Technical and device data (cookies, logs): Session data is discarded at session end; server logs are retained for up to 12 months; analytics data may be retained in anonymised aggregate form indefinitely.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

---

10 Cookies & Tracking Technologies

ba66 uses cookies and similar tracking technologies on ba66.bid to enable core platform functionality, maintain your session when you are logged in, protect against fraud, and collect analytics data that helps us improve the platform experience for players across Bangladesh.

10.1 Types of Cookies Used

• Strictly necessary cookies: Required for the ba66 platform to function. These include session authentication cookies and security tokens. These cannot be disabled without preventing core platform functionality.
• Functional cookies: Remember your preferences such as preferred language settings and responsible gaming tool configurations to improve your experience on return visits.
• Analytics cookies: Collect anonymised or pseudonymised data about how players interact with ba66.bid, including pages visited, session duration, and device type. This data is used in aggregate to improve platform performance.
• Marketing cookies: Used only where you have given explicit consent. These track your interaction with ba66's promotional content so that we can show you relevant offers. You may withdraw consent for marketing cookies at any time via your account settings.

10.2 Managing Cookies

You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may impair your ability to use the ba66 platform, including logging in to your account. Instructions for managing cookies in the most common browsers are available from each browser's official support documentation.

---

11 Your Data Rights

As a registered ba66 player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact ba66 using the details in Section 16. ba66 aims to respond to all data rights requests within 30 days of receipt.

• Right of access: You have the right to request a copy of the personal data ba66 holds about you, along with information about how that data is being processed.
• Right to rectification: You have the right to request that ba66 corrects any inaccurate or incomplete personal data we hold about you.
• Right to erasure ("right to be forgotten"): You may request that ba66 deletes your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent (and no other legal basis applies). Note that ba66 may be required to retain certain data to comply with legal obligations — for example, AML record-keeping requirements — even after an erasure request is made.
• Right to restriction of processing: You may ask ba66 to restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on ba66's legitimate interests, and to opt out of direct marketing communications at any time.
• Right to withdraw consent: Where ba66 processes your data based on your consent (such as for marketing emails), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

---

12 Children's Privacy

ba66 is strictly an adults-only platform. The ba66 service is intended solely for individuals who are 18 years of age or older. ba66 does not knowingly collect personal data from anyone under the age of 18.

ba66 implements age verification checks at the point of registration and as part of the KYC process specifically to prevent minors from accessing the platform. If ba66 becomes aware or has reason to believe that a user under the age of 18 has registered an account or submitted personal data, ba66 will immediately close the account, delete the associated data (except where retention is required by law), and notify the appropriate responsible adult where possible.

If you have reason to believe that a minor has accessed or registered on the ba66 platform, please contact ba66's support team immediately at support@ba66.bid.

---

13 Security Measures

ba66 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your browser and ba66's servers is encrypted using TLS 1.3, the current industry standard for secure web communications.
• AES-256 encryption at rest: Sensitive stored data, including payment method details and identity documents, is encrypted at rest using AES-256 encryption.
• Password hashing: Player passwords are never stored in plain text. ba66 uses a strong cryptographic hashing algorithm with per-user salting to store password credentials securely.
• Access controls: Access to player personal data is restricted to ba66 personnel with a verified operational need. All internal access is subject to role-based access control (RBAC) and is logged for audit purposes.
• Intrusion detection and monitoring: ba66's infrastructure is monitored continuously for suspicious activity, anomalous access patterns, and potential security incidents.
• Regular security reviews: ba66 conducts periodic internal and third-party security assessments to identify and remediate vulnerabilities in the platform.

While ba66 takes all reasonable and appropriate steps to protect your personal data, no method of internet transmission or electronic storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, ba66 will notify affected players promptly in accordance with applicable legal requirements.

---

14 Third-Party Links

The ba66 platform does not contain links to external third-party websites as a matter of policy. However, where any third-party service is integrated into the ba66 platform (such as game providers' embedded content), those providers operate under their own data handling practices. ba66 is not responsible for the privacy practices of third-party game studios or payment processors beyond the contractual obligations ba66 places on them as described in this Policy.

Players are encouraged to review the privacy policies of any third-party service provider whose services they access in connection with their ba66 account, including their chosen payment method provider (bKash, Nagad, Rocket, Upay, or their card issuer).

---

15 Updates to This Privacy Policy

ba66 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. When material changes are made, ba66 will notify registered players via the email address on file or via a prominent notice on the ba66 platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. ba66 recommends that players review this Policy periodically to remain informed of how their personal data is being handled. Your continued use of the ba66 platform following notification of any changes constitutes your acceptance of the revised Privacy Policy.

---

16 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how ba66 handles your personal data, please contact ba66's support team using the details below:

• Email: support@ba66.bid (plain text — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6)
• Live Chat: Available within the ba66 platform when you are logged in to your account

ba66 aims to acknowledge all privacy-related inquiries within 2 business days and to provide a substantive response within 30 calendar days. For complex data rights requests, ba66 may extend this period by a further 30 days where necessary, and will inform you of any such extension within the initial 30-day window.