ba98 Privacy Policy

1 Introduction

Welcome to ba98. This Privacy Policy ("Policy") describes how ba98 ("ba98", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of players and visitors ("you", "your") who access the ba98 website at ba98.io, its subdomains, mobile-optimised versions, and all associated services, games, and features.

ba98 is an online betting and casino platform serving players in Bangladesh. The platform is designed with the privacy and security of Bangladeshi players in mind. All financial transactions are conducted in Bangladeshi Taka (BDT) and processed via locally trusted payment methods including bKash, Nagad, Rocket, and Upay. This Policy explains how the personal data associated with these and all other platform interactions is managed.

This Privacy Policy should be read together with the ba98 Terms & Conditions and the ba98 Responsible Gaming Policy, both of which are incorporated by reference. By creating a ba98 account or using the ba98 platform, you acknowledge that you have read and understood this Policy.

2 Data Controller

For the purposes of this Privacy Policy, ba98 acts as the data controller in respect of personal data collected from players and visitors to ba98.io. As data controller, ba98 determines the purposes for which personal data is collected and the manner in which it is processed.

If you have any questions regarding this Policy, wish to exercise your data rights, or need to report a data privacy concern, please contact the ba98 Data Privacy team via the contact details provided in Section 16 of this Policy.

ba98 is committed to handling personal data in a manner consistent with applicable data protection standards and best practices for online gaming platforms serving the Bangladesh market.

3 Personal Data We Collect

ba98 collects the following categories of personal data from players and, where applicable, from visitors to ba98.io:

ba98 does not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where identity verification requirements make it unavoidable (for example, a government-issued ID that incidentally contains a photograph). Any such incidentally collected sensitive data is handled with heightened care and is not processed for any purpose beyond identity verification.

4 How We Collect Your Data

ba98 collects personal data through the following channels:

• Direct Registration: Information you provide when creating your ba98 account, completing identity verification, or updating your account profile.
• Transactional Activity: Data generated when you make deposits or withdrawals via bKash, Nagad, Rocket, Upay, or bank transfer. This includes transaction references and amounts which are logged against your account for security and compliance purposes.
• Platform Interaction: Data automatically collected as you navigate and use the ba98 platform, including games played, bets placed, session duration, and in-platform support chat interactions.
• Technical Systems: Automatically collected technical data such as IP address, device identifiers, browser type, and connection information collected by ba98's web servers and security systems on each platform visit.
• Cookies and Tracking Technologies: Data collected via cookies and similar technologies stored on your device when you visit ba98.io. Full details are provided in Section 8 of this Policy.
• Third-Party Verification Providers: Where ba98 uses a third-party identity verification service to confirm your identity documents, that provider may return a verification result and relevant document metadata to ba98.
• Payment Providers: Payment partners such as bKash, Nagad, and Rocket may share transaction confirmation data with ba98 as part of the deposit and withdrawal processing workflow.

5 How We Use Your Personal Data

ba98 uses the personal data it collects for the following purposes:

• Account Management: To create, maintain, and administer your ba98 player account, including verifying your identity and age eligibility (21+), updating your account details, and managing account security.
• Payment Processing: To facilitate deposits and withdrawals in Bangladeshi Taka (BDT) via your chosen payment method, to reconcile transactions, and to investigate and resolve any payment disputes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, account takeover, and other prohibited conduct as defined in the ba98 Terms & Conditions. Technical data including IP addresses and device fingerprints are used for this purpose.
• Legal and Regulatory Compliance: To fulfil obligations under applicable anti-money laundering (AML) requirements, know-your-customer (KYC) standards, and any other legal or regulatory requirements applicable to ba98's operations.
• Customer Support: To respond to your support enquiries, resolve disputes, process complaints, and communicate account-related information to you via live chat, email, or SMS.
• Responsible Gaming: To monitor gaming activity and identify patterns that may indicate problem gambling behaviour. ba98 uses usage data to trigger responsible gaming interventions such as activity summaries, cooling-off prompts, and self-exclusion enforcement.
• Platform Improvement: To analyse aggregated usage data and improve the ba98 platform's performance, game selection, user interface, and overall player experience. Where used for this purpose, data is anonymised or aggregated so that no individual player can be identified.
• Marketing Communications: To send promotional offers, bonus notifications, and event updates to players who have opted in to receive marketing communications. Full details are in Section 12 of this Policy.
• Personalisation: To personalise the ba98 experience by surfacing relevant games, promotions, and content based on your platform usage history and stated preferences.

6 Legal Basis for Processing

ba98 processes personal data on the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is necessary for ba98 to perform its obligations under the player account agreement — including account creation, payment processing, and customer support — is carried out on the basis of contractual necessity.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming is carried out on the basis of ba98's legitimate business interests. In each case, ba98 has assessed that these interests are not overridden by the privacy rights of individual players.
• Legal Obligation: Processing for AML compliance, KYC verification, and record-keeping pursuant to applicable financial and gaming regulations is carried out on the basis of legal obligation.
• Consent: Processing for marketing communications is carried out only where you have given explicit, freely given, and informed consent. You may withdraw this consent at any time without affecting your account status.

7 Data Sharing and Disclosure

ba98 does not sell your personal data to any third party. Data is shared only in the limited circumstances described below, and always subject to appropriate contractual data protection obligations:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and card network partners (Visa, Mastercard) receive the minimum financial data necessary to process your deposit or withdrawal transaction.
• Game Providers: Third-party game providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and session token to facilitate gameplay. They do not receive your full identity data unless required for regulatory compliance in their own jurisdiction.
• Identity Verification Services: Where ba98 uses a third-party KYC verification provider, your identity document data is shared with that provider solely for the purpose of completing age and identity verification. The provider is contractually prohibited from retaining or using your data beyond this purpose.
• Customer Support Platforms: ba98 may use a third-party live chat or helpdesk platform to manage support interactions. These providers process support communications on ba98's behalf under strict data processing agreements.
• Legal and Regulatory Authorities: ba98 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by law, court order, or regulatory instruction. ba98 will make reasonable efforts to notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or asset sale involving ba98, player data may be transferred to the acquiring entity as part of the transaction. Players will be notified via the email address registered to their account in advance of any such transfer where practically possible.

8 Cookies and Tracking Technologies

ba98 uses cookies and similar tracking technologies on ba98.io to ensure the platform functions correctly, to maintain your session while you are logged in, and to understand how players interact with the site so that we can continuously improve the experience.

The following types of cookies are used on ba98.io:

• Strictly Necessary Cookies: These cookies are essential for the ba98 platform to function. They manage your login session, maintain your account authentication state, and enable security features such as CSRF protection. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional Cookies: These cookies remember your platform preferences such as language settings, display options, and game settings. They enhance your experience by personalising the platform to your saved preferences.
• Analytical Cookies: ba98 uses privacy-respecting analytics tools to understand aggregate usage patterns — which pages are visited most frequently, where players encounter difficulties, and how platform performance can be improved. Analytical cookies collect data in anonymised or pseudonymised form.
• Security Cookies: These cookies are used to detect and prevent fraudulent account activity, bot traffic, and credential stuffing attacks. They form part of ba98's layered security infrastructure.

ba98 does not use third-party advertising cookies or participate in behavioural advertising networks. No cookie data from ba98.io is shared with advertising platforms or used to build advertising profiles about you on external networks.

Most web browsers allow you to control cookies through their settings. You may disable or delete cookies via your browser's privacy settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the ba98 platform.

9 Data Security

ba98 takes the security of your personal data seriously and implements a comprehensive set of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• TLS/SSL Encryption: All data transmitted between your browser or mobile device and ba98's servers is encrypted using industry-standard TLS (Transport Layer Security) protocols. The ba98.io domain is served exclusively over HTTPS.
• Password Hashing: Player passwords are stored using strong, one-way cryptographic hashing algorithms. It is technically impossible for ba98 staff to retrieve your plaintext password from the stored hash. ba98 will never ask you for your password via email, chat, or telephone.
• Access Controls: Access to systems containing personal data is restricted to ba98 staff who have a legitimate operational need. Access is controlled through role-based permissions and multi-factor authentication (MFA) for administrative access.
• Payment Security: ba98 does not store full card numbers or mobile banking PINs. Payment credential handling is delegated to PCI-DSS-compliant payment processors. ba98 stores only transaction reference numbers and anonymised payment method identifiers.
• Monitoring and Incident Response: ba98's infrastructure is continuously monitored for security threats. ba98 maintains an incident response plan to address data breaches promptly and to notify affected players and relevant authorities where required by law.
• Data Minimisation at Storage: ba98's databases are designed to store only the data fields that are operationally necessary. Redundant or obsolete data fields are removed during periodic data audits.

10 Data Retention

ba98 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention guidelines apply:

• Active Accounts: Personal data is retained for the full duration of your ba98 account's active status. While your account is open, your data is processed in accordance with this Policy on an ongoing basis.
• Closed Accounts: Following voluntary account closure, ba98 retains your account data (including identity data, transaction history, and bet records) for a minimum period of five (5) years. This retention is required to comply with anti-money laundering regulations, financial record-keeping obligations, and to enable resolution of any disputes or regulatory enquiries that may arise after account closure.
• Suspended or Closed Accounts (Fraud/AML): Where an account has been suspended or closed as a result of a fraud investigation, AML concern, or Terms & Conditions breach, ba98 may retain relevant data for a longer period — up to ten (10) years — as required for the purposes of that investigation or any resulting legal proceedings.
• Self-Excluded Accounts: Where a player has requested self-exclusion, ba98 retains sufficient data to enforce the self-exclusion and prevent re-registration for the elected exclusion period. This is a player protection measure and is carried out in your interest.
• Marketing Data: Where you have opted in to marketing communications, ba98 retains your marketing preferences and contact details for this purpose until you withdraw consent. Upon withdrawal, your details are removed from active marketing lists within 10 business days.
• Support and Chat Records: Customer support interaction records are retained for a period of three (3) years from the date of the interaction, to enable review and dispute resolution.
• Technical and Log Data: Server logs and security event logs are retained for a period of twelve (12) months, after which they are automatically purged or anonymised.

When the applicable retention period expires, personal data is securely deleted or permanently anonymised so that it can no longer be linked to any individual player. ba98 conducts periodic data audits to ensure retention schedules are being applied correctly.

11 Your Data Rights

As a ba98 player, you have the following rights in relation to the personal data we hold about you. These rights may be exercised at any time by contacting ba98 support via the details in Section 16:

• Right of Access: You have the right to request a copy of the personal data ba98 holds about you. ba98 will provide this information in a structured, commonly used, and machine-readable format within 30 days of receiving a valid request.
• Right to Rectification: If any personal data ba98 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For certain data fields (such as name and date of birth), correction may require you to provide supporting identity documentation.
• Right to Erasure: In certain circumstances, you have the right to request that ba98 delete your personal data — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other legal basis for processing. This right is not absolute: where ba98 is required to retain data for legal compliance purposes (such as AML obligations), erasure may not be possible for the data subject to those obligations.
• Right to Restrict Processing: You may request that ba98 restrict the processing of your personal data in certain circumstances, such as while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is carried out by automated means on the basis of your consent or contractual necessity, you have the right to receive your personal data in a portable format and to transmit it to another data controller.
• Right to Object: You have the right to object to processing carried out on the basis of ba98's legitimate interests, including profiling for responsible gaming monitoring purposes. ba98 will consider your objection and cease the processing unless ba98 can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

ba98 will respond to all valid data rights requests within 30 calendar days. In complex cases, ba98 may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it. Data rights requests are processed free of charge for standard requests. Where requests are manifestly unfounded or excessive, ba98 reserves the right to charge a reasonable administrative fee or decline to act on the request.

12 Marketing Communications

ba98 will only send promotional or marketing communications to players who have given explicit prior consent to receive them. Marketing communications may include information about bonuses, promotions, new game releases, seasonal offers (such as Eid or Pohela Boishakh specials), sports betting markets, and other platform news.

Marketing communications may be delivered via the following channels, subject to your opt-in preferences:

• Email to your registered ba98 email address
• SMS to your registered Bangladesh mobile number
• In-platform notifications displayed when you log in to ba98

You may update your marketing preferences or withdraw consent at any time via your ba98 account settings page, or by contacting ba98 support. Withdrawal of marketing consent will take effect within 10 business days. Please note that even after opting out of marketing, ba98 will continue to send you essential service communications — such as transaction confirmations, account security alerts, and responses to your support requests. These essential communications are not marketing and cannot be opted out of while your account remains active.

ba98 does not share your contact details with third-party marketers or advertising networks. All marketing communications originate from ba98 directly.

13 Age Restriction and Children's Privacy

The ba98 platform is strictly for adults aged 21 years and above. ba98 does not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is a mandatory part of the ba98 account registration and KYC process. Players who cannot provide satisfactory proof of age will not be permitted to access the ba98 platform.

If ba98 becomes aware that it has inadvertently collected personal data from a person under the age of 21, ba98 will immediately close the relevant account, refund any remaining balance in accordance with its policies, and securely delete all associated personal data. If you believe that a minor has registered an account on ba98, please contact ba98 support immediately so that appropriate action can be taken.

14 Third-Party Links and Services

The ba98 platform integrates third-party game content from providers including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. While ba98 takes care in selecting reputable game providers, these providers operate their own platforms and are subject to their own privacy policies in respect of any data they independently collect through their game software.

ba98.io may contain links to third-party websites or resources for informational purposes. ba98 has no control over the content or privacy practices of these external sites. The inclusion of a link to a third-party site does not constitute an endorsement by ba98, and ba98 accepts no responsibility for the privacy practices of any external site. We strongly encourage you to review the privacy policy of any third-party site you visit.

Payment method providers such as bKash, Nagad, Rocket, and Upay operate their own independent privacy frameworks in connection with the transactions they facilitate. ba98's privacy obligations apply to data within the ba98 platform environment; ba98 does not control how these payment providers handle data on their own platforms and systems.

15 Changes to This Privacy Policy

ba98 reserves the right to update or amend this Privacy Policy at any time. All changes will be published on this page (ba98.io/privacy-policy) with a revised effective date at the top of the Policy. We encourage you to review this page periodically to stay informed about how ba98 protects your personal data.

For material changes — those that meaningfully affect how your personal data is collected, used, or shared — ba98 will provide advance notice to registered players via email or in-platform notification at least seven (7) days before the changes take effect. For minor, non-material changes such as clarifications, formatting updates, or corrections of typographical errors, ba98 may update this Policy without prior individual notification.

Your continued use of the ba98 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the updated Policy, you must stop using the platform and may contact support to request account closure.

16 Contact and Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a data privacy concern, please contact the ba98 Data Privacy team using the following details:

• Live Chat: Available 24/7 directly within the ba98 platform. This is the fastest way to reach ba98 support for any account or privacy-related query.
• Email: [email protected] (plain text — not a clickable link). Please include your registered username, account ID, and a clear description of your request. ba98 aims to acknowledge all privacy-related email enquiries within 24 hours (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.

When submitting a data rights request, please provide sufficient information to allow ba98 to verify your identity before fulfilling the request. This is necessary to protect the privacy of all players and to ensure that personal data is not disclosed to unauthorised parties. ba98 may ask you to confirm your registered email address, username, or provide a form of identity documentation as part of this verification process.

ba98 is committed to responding to all data rights requests and privacy enquiries promptly, fairly, and transparently. All formal privacy requests are logged and tracked internally to ensure compliance with ba98's response obligations.