Privacy Policy — How ba89 Collects, Uses, and Protects Your Personal Data

1 Introduction

ba89 ("we", "our", "us") operates the online betting and casino platform accessible at ba89.io (the "Platform"). We are committed to respecting and protecting the privacy of all individuals who visit, register on, or otherwise interact with the ba89 Platform.

This Privacy Policy sets out, in clear and transparent terms, the types of personal data that ba89 collects from players and visitors, the purposes for which that data is processed, the legal bases on which ba89 relies to process personal data, and the rights available to individuals in connection with their personal data.

By accessing the ba89 Platform, registering an account, or using any service offered by ba89, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact our support team to close your account.

This Policy applies to all personal data collected by ba89 in connection with the Platform, including data collected via the ba89 website, mobile application, customer support channels, and any other medium through which ba89 provides services to players in Bangladesh and internationally.

2 Personal Data We Collect

ba89 collects the following categories of personal data from players and Platform visitors. The data collected depends on the nature of your interaction with ba89 — some data is collected only when you register an account, while other data is collected automatically when you visit the Platform.

ba89 does not collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where a document submitted for age or identity verification incidentally contains such information. In such cases, the sensitive data is not extracted, stored separately, or used for any purpose other than verifying the identity of the account holder.

3 How We Collect Your Data

ba89 collects personal data through the following means:

• Direct submission: Data you provide directly when registering an account, completing your player profile, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated collection: Technical data collected automatically when you access the ba89 Platform, including IP address, device identifiers, cookies, and session analytics. This data is collected via standard web server logs, cookies, and analytics tools embedded in the Platform.
• Third-party payment processors: When you transact via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, or Mastercard, ba89 receives a confirmation of the transaction along with limited identifying information necessary to match the transaction to your ba89 account. ba89 does not receive or store your full payment credentials.
• Identity verification partners: Where ba89 uses a third-party KYC provider to verify the authenticity of identity documents, that provider may return a verification result and limited metadata to ba89. Full document images are processed by the KYC provider in accordance with their own privacy policy.
• Game platform providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may share gameplay session data with ba89 for the purpose of crediting winnings, resolving disputes, and monitoring for irregular gameplay patterns.

4 Purpose of Data Processing

ba89 processes your personal data for the following purposes:

• Account creation and management: To register your ba89 account, verify your identity and age, and maintain your account in a secure and functional state throughout your time as a player.
• Service delivery: To process your bets, credit your winnings, manage your account balance in Bangladeshi Taka (৳), and deliver all core Platform services including sportsbook, live casino, slots, and colour game products.
• Financial transaction processing: To handle deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment channels, and to maintain accurate financial records of all transactions on your account.
• Legal compliance and fraud prevention: To comply with applicable anti-money-laundering (AML) obligations, to detect and prevent fraud, collusion, money laundering, and other prohibited conduct, and to respond to lawful requests from regulatory or law enforcement authorities.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance through our 24/7 live chat and email support channels.
• Responsible gaming: To monitor gameplay patterns for signs of problem gambling, to administer deposit limits, cooling-off periods, and self-exclusion requests, and to communicate responsible gaming resources to players who may need support.
• Platform improvement and security: To analyse Platform usage data, diagnose technical issues, improve the user experience, and protect the security and integrity of the Platform for all users.
• Marketing and promotions: To send promotional communications about ba89 offers, seasonal bonuses (including BPL season promotions, Eid bonuses, and Pohela Boishakh offers), and new product launches — but only where you have provided consent or where ba89 has a legitimate interest in contacting existing players. You may opt out of marketing communications at any time.

5 Legal Basis for Processing

ba89 processes your personal data on the following legal bases, depending on the specific purpose of processing:

• Performance of a contract: The majority of data processing described in this Policy is necessary to provide the ba89 Platform services to you under the Terms & Conditions you accepted at registration. This includes account management, bet settlement, and payment processing.
• Legal obligation: Certain processing activities — particularly KYC identity verification, AML transaction monitoring, and records retention — are required by applicable laws and regulations. ba89 processes data for these purposes regardless of individual consent.
• Legitimate interests: ba89 processes certain technical and behavioural data on the basis of its legitimate interests in operating a secure, fraud-free Platform and in improving the quality of its services. ba89 ensures that these interests do not override your fundamental privacy rights.
• Consent: Where ba89 sends marketing communications to players who are not current active users, or where ba89 deploys non-essential cookies, the processing is based on your prior consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing & Disclosure

ba89 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. ba89 shares personal data only in the following circumstances and only to the minimum extent necessary:

• Payment service providers: Your financial data is shared with the payment processor handling your specific transaction (e.g., bKash, Nagad, Rocket, Dutch-Bangla Bank) solely to complete that transaction. These providers operate under their own privacy frameworks and are not permitted to use your data for any other purpose.
• Identity verification providers: Where ba89 engages a third-party KYC partner to verify identity documents, the minimum necessary data is shared with that provider solely for the purpose of verification. The KYC partner is bound by contractual confidentiality obligations.
• Game technology providers: Gameplay session data may be shared with the relevant game studio (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, etc.) to the extent required to deliver the game service, resolve disputes, and ensure fair play certification obligations are met.
• Legal and regulatory authorities: ba89 will disclose personal data to competent authorities, courts, or law enforcement agencies where required to do so by applicable law, court order, or lawful regulatory directive. ba89 will notify affected players of such disclosure where legally permitted to do so.
• Business succession: In the event of a merger, acquisition, or sale of ba89's business or assets, player data may be transferred to the successor entity, subject to equivalent privacy protections. Affected players will be notified of any material change in data controller.

7 Cookies & Tracking Technologies

ba89 uses cookies and similar tracking technologies on the Platform to deliver a functional, personalised, and secure user experience. The following categories of cookies are used:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They enable core features such as user authentication, session management, and security token validation. These cookies cannot be disabled without impairing your ability to use ba89.
• Functional cookies: These cookies remember your preferences — such as language settings, preferred payment method, and display options — so that you do not need to re-enter them on each visit.
• Analytics cookies: ba89 uses anonymised analytics data collected via first-party and third-party tools to understand how players navigate the Platform, which games are most popular, and where technical issues arise. This data is aggregated and does not identify individual players.
• Marketing cookies: Where you have consented, ba89 may use cookies to deliver targeted promotional content and to measure the effectiveness of marketing campaigns. You may withdraw consent for marketing cookies at any time via your account preferences or by clearing your browser cookies.

You may control cookie settings at the browser level. Please note that disabling certain cookies may limit the functionality of the ba89 Platform. ba89 does not respond to browser-level "Do Not Track" signals at this time, but you retain control over non-essential cookies through your account settings.

8 Data Security

ba89 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and ba89 servers, ensuring that your login credentials, payment details, and personal data cannot be intercepted in transit.
• Encrypted data storage: Sensitive data fields — including passwords and payment identifiers — are stored using industry-standard hashing and encryption algorithms. Plaintext passwords are never stored.
• Access controls: Access to personal data within ba89's internal systems is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and regular security training.
• Two-factor authentication (2FA): 2FA via SMS is available to all ba89 account holders and is strongly recommended. Players who enable 2FA add a critical additional layer of protection against unauthorised account access.
• Intrusion detection and monitoring: ba89's technical infrastructure is monitored continuously for suspicious activity, unusual access patterns, and potential security threats.
• Incident response: In the event of a confirmed personal data breach that poses a risk to the rights and freedoms of affected players, ba89 will notify affected individuals as promptly as is practicable under the circumstances.

While ba89 takes all reasonable precautions to safeguard personal data, no online platform can guarantee absolute security. Players are strongly encouraged to use a strong and unique password, enable 2FA, and notify ba89 support immediately if they suspect unauthorised access to their account.

9 Data Retention

ba89 retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or for as long as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active account data: Personal data associated with an active ba89 account is retained for the full duration of the account's active status and for a reasonable period thereafter to enable account reactivation where appropriate.
• Financial records: Transaction records, deposit and withdrawal histories, and associated financial data are retained for a minimum of five (5) years from the date of the relevant transaction to satisfy standard financial record-keeping and AML compliance obligations.
• KYC documents: Identity and age verification documents submitted by players are retained for a minimum of five (5) years following account closure, or for such longer period as may be required by applicable regulation.
• Support communications: Live chat transcripts and support email correspondence are retained for a period of two (2) years from the date of the relevant interaction, unless a longer retention period is required for the resolution of an ongoing dispute.
• Closed or inactive accounts: Where a ba89 account has been voluntarily closed or has been inactive for a period exceeding 12 consecutive months, ba89 will retain the minimum data required to satisfy legal obligations and to prevent fraud, and will delete or anonymise all other personal data.

On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player.

10 Your Privacy Rights

ba89 respects your rights in relation to your personal data. The following rights are available to you as a ba89 player:

• Right of access: You may request a copy of the personal data that ba89 holds about you at any time. ba89 will respond to verified access requests within a reasonable timeframe.
• Right to rectification: If any personal data that ba89 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. Many basic data fields (such as contact number and email address) can be updated directly within your ba89 account settings.
• Right to erasure: In certain circumstances, you may request that ba89 delete your personal data. This right is subject to limitations where ba89 is required to retain data to fulfil legal obligations (e.g., AML record-keeping requirements).
• Right to restrict processing: You may request that ba89 temporarily restrict the processing of your personal data — for example, while a dispute regarding its accuracy is being resolved.
• Right to data portability: Where ba89 processes your data on the basis of consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing carried out on the basis of legitimate interests, subject to ba89 demonstrating compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where ba89 processes your data on the basis of your consent (e.g., for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact ba89's data team via the email address provided in Section 14 of this Policy. ba89 may need to verify your identity before processing your request.

11 Minors & Age Verification

The ba89 Platform is strictly intended for adults aged 21 and above. ba89 does not knowingly collect or process personal data from any person under the age of 21.

As part of the registration and KYC process, ba89 requires all players to confirm that they are at least 21 years of age and to provide identity documentation that confirms their date of birth where verification is triggered. Any account found to belong to a person under the age of 21 will be immediately suspended, all funds within the account will be withheld, and the matter will be handled in accordance with ba89's Terms & Conditions.

If you are a parent or guardian and believe that a minor has accessed the ba89 Platform using your account or their own, please contact ba89 support immediately. ba89 will take prompt action to investigate and, where confirmed, to close the relevant account and return any deposited funds to the originating payment method.

12 Third-Party Links & Services

The ba89 Platform integrates services provided by third-party game studios and payment processors. While ba89 takes reasonable steps to ensure that its third-party partners maintain appropriate privacy and security standards, ba89 is not responsible for the privacy practices of these external parties.

Any personal data that you submit directly to a third-party service — including your mobile financial service provider (bKash, Nagad, Rocket, Upay) or your bank — is governed by that provider's own privacy policy. ba89 encourages you to review the privacy policies of any third-party service you interact with in connection with your use of ba89.

ba89 does not control, and is not responsible for, the content or privacy practices of any third-party website or service that may be referenced on the Platform. The inclusion of any third-party provider name on the ba89 Platform does not constitute an endorsement of that provider's privacy practices.

13 Changes to This Privacy Policy

ba89 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services offered through the Platform. When material changes are made to this Policy, ba89 will take reasonable steps to notify affected players — which may include displaying a prominent notice on the Platform or sending an email notification to registered players.

The effective date and last-updated date at the top of this document will be updated to reflect any revisions. Players are encouraged to review this Privacy Policy periodically. Continued use of the ba89 Platform following the publication of a revised Policy constitutes acceptance of the updated terms.

If you have any concerns about proposed or implemented changes to this Privacy Policy, please contact our data team using the contact details provided in Section 14 below.

14 Contact & Data Enquiries

If you wish to exercise any of your privacy rights, raise a concern about how ba89 processes your personal data, or request further information about the practices described in this Privacy Policy, please contact the ba89 data team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within your ba89 account dashboard. This is the fastest way to reach our team for urgent privacy matters.
• Email: [email protected] — please include "Privacy Request" in the subject line so that your message is directed to the appropriate team. Allow up to 72 hours for a response to data privacy enquiries.

ba89 will acknowledge receipt of all privacy-related requests promptly and will provide a substantive response within a reasonable period. ba89 may need to verify your identity before processing certain requests (e.g., data access or erasure requests) to protect the privacy of account holders.