baca8 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how baca8 ("baca8", "we", "us", "our"), the operator of the online betting and casino platform available at baca8.io, collects, uses, stores, shares, and protects personal information about individuals ("you", "your", "the Player") who access or use the baca8 platform, including its website, mobile-optimised interface, customer support channels, and related services.

baca8 serves players across Bangladesh, including in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, and all other regions of the country. As a platform operating in the Bangladesh market, baca8 is committed to handling your personal data responsibly and in a manner consistent with internationally recognised data protection principles.

This Policy applies to all personal data processed by baca8 in connection with the services it provides. It should be read alongside the baca8 Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your use of the platform. References to "personal data" in this Policy mean any information that identifies or could reasonably be used to identify you as an individual.

2 Data We Collect

2.1 Information You Provide Directly

When you register a baca8 account, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions, you provide us with personal data including:

Data Category	Examples	When Collected
Identity	Full legal name, date of birth, NID or passport number	Registration & KYC
Contact	Email address, mobile phone number, residential address	Registration
Financial	bKash/Nagad/Rocket account numbers, bank account details, transaction history	Deposits & Withdrawals
Verification	Copies of government-issued ID, proof of address documents	KYC Verification
Communications	Support messages, chat transcripts, email correspondence	Support Interactions
Preferences	Responsible gaming limit settings, marketing opt-in status	Account Settings

2.2 Data Collected Automatically

When you access the baca8 platform, certain technical data is collected automatically through your browser or device, including:

• IP address and approximate geographic location (country/city level);
• Device type, operating system, and browser version;
• Pages visited, time spent on pages, click patterns, and navigation paths;
• Betting and gaming session data (games played, wagers placed, session duration);
• Login timestamps and frequency of platform access;
• Referral source (if you arrived via a link or campaign).

2.3 Data from Third Parties

In certain circumstances, baca8 may receive personal data about you from third-party sources, including payment processors (e.g., bKash, Nagad, Rocket) confirming transaction details, identity verification service providers who assist with KYC checks, fraud prevention agencies that help us identify suspicious account activity, and game providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi) who supply session and RNG data for dispute resolution purposes.

3 How We Use Your Data

baca8 uses personal data collected from players for the following purposes:

• Account Management: Creating and maintaining your baca8 account, verifying your identity, and providing you with access to the platform's services.
• Transaction Processing: Processing deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, and supported bank partners, and maintaining accurate financial records.
• KYC and Compliance: Meeting our legal obligations around age verification (21+ requirement), identity verification, and anti-money laundering (AML) due diligence.
• Responsible Gaming: Monitoring your usage patterns to identify potential signs of problem gambling, applying self-imposed limits you have set, and communicating responsible gaming resources when appropriate.
• Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance.
• Platform Security: Detecting and preventing fraud, bonus abuse, multi-accounting, money laundering, and other prohibited conduct.
• Service Improvement: Analysing aggregated usage data to improve platform performance, game selection, and user experience.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may opt out at any time.
• Legal Obligations: Retaining records as required by applicable financial, anti-money laundering, and data retention regulations.

4 Legal Basis for Processing

baca8 processes your personal data on one or more of the following legal bases, depending on the specific activity:

• Contractual Necessity: Processing required to fulfil the contract between you and baca8 — including account creation, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC, AML checks, age verification, and record-keeping obligations.
• Legitimate Interests: Processing necessary for baca8's legitimate business interests, including fraud prevention, platform security, and service improvement, provided these interests do not override your fundamental rights.
• Consent: Processing based on your explicit, freely given, and informed consent — specifically in relation to direct marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

5 Data Sharing & Third Parties

5.1 Service Providers

baca8 works with carefully selected third-party service providers who assist in operating the platform. These include payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank), identity verification and KYC service providers, game content providers (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi), IT infrastructure and cloud hosting providers, and customer support platform providers. All service providers are contractually bound to use your data only for the purposes for which it was shared and to maintain appropriate security standards.

5.2 Legal and Regulatory Disclosure

baca8 may disclose personal data to law enforcement agencies, regulatory authorities, or other official bodies where required to do so by applicable law, by court order, or where disclosure is necessary to prevent serious harm, fraud, or illegal activity. In such cases, baca8 will disclose only the minimum data necessary to comply with the legal obligation.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of baca8's business, personal data held by baca8 may be transferred to the acquiring entity as part of that transaction. Where this occurs, baca8 will take reasonable steps to ensure that the acquiring party is bound by privacy obligations consistent with this Policy and will notify affected players in advance where practicable.

5.4 No Data Selling

baca8 does not and will never sell, rent, lease, or trade your personal data to third parties for their own commercial or marketing purposes. This is an unconditional commitment.

6 Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function correctly, to remember your preferences, and to provide site owners with analytical information about how their platform is used. baca8 uses cookies and similar tracking technologies (including local storage and session storage) on the baca8.io website.

6.2 Types of Cookies Used

• Essential Cookies: Required for the platform to function. These include session management cookies that keep you logged in and security cookies that help detect fraudulent activity. These cookies cannot be disabled without affecting platform functionality.
• Performance and Analytics Cookies: Help baca8 understand how players use the platform by collecting aggregated, anonymised data about page views, session duration, and navigation patterns. This information is used solely to improve platform performance.
• Functional Cookies: Remember your preferences, such as your language settings and responsible gaming limit configurations, so you do not need to re-enter them on each visit.
• Marketing Cookies: Used to track the effectiveness of baca8's promotional campaigns and to deliver relevant offers to opted-in players. These are only active where you have consented to marketing communications.

6.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the baca8 platform, including your ability to log in and access your account. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

7 Data Retention

baca8 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Account Data: Retained for the duration of your account's existence plus a minimum of five (5) years following account closure, to meet anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction data is retained for a minimum of seven (7) years from the date of each transaction, in line with standard financial record-keeping obligations.
• KYC Documents: Identity verification documents are retained for five (5) years following account closure or the completion of the relevant KYC process, whichever is later.
• Support Communications: Customer support interactions are retained for three (3) years following the close of the relevant support case.
• Marketing Data: Data used solely for marketing purposes is deleted or anonymised within twelve (12) months of your withdrawal of marketing consent.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be associated with you as an individual.

8 Data Security

baca8 takes the security of your personal data seriously and implements a comprehensive range of technical and organisational security measures, including:

• SSL/TLS Encryption: All data transmitted between your device and the baca8 platform is encrypted using industry-standard SSL/TLS protocols, preventing interception during transmission.
• Encrypted Data Storage: Sensitive personal data — including financial details and identity documents — is stored in encrypted form on secure servers with restricted access.
• Access Controls: Access to personal data within baca8's systems is restricted to authorised personnel who require it to perform their specific job functions. All internal access is logged and audited.
• Password Security: Player passwords are stored as salted, one-way cryptographic hashes and are never stored in plain text. baca8 staff cannot retrieve your password; only a reset is possible.
• Fraud Monitoring: Automated fraud detection systems monitor platform activity in real time to identify unusual patterns consistent with account compromise or financial fraud.
• Incident Response: baca8 maintains a documented security incident response plan. In the event of a data breach that poses a risk to your rights and freedoms, baca8 will notify affected players without undue delay.

9 Your Data Rights

As a baca8 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact the baca8 Data Protection team at [email protected] with a clear description of your request and sufficient information to verify your identity.

• Right of Access: You may request a copy of the personal data baca8 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held in your baca8 account.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to baca8's legal obligations to retain certain data.
• Right to Restriction: You may request that baca8 restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request that baca8 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to baca8 processing your personal data based on legitimate interests, including profiling for marketing purposes. You may also withdraw consent for direct marketing at any time.
• Right Not to Be Subject to Automated Decisions: baca8 does not make decisions with legal or similarly significant effects on players solely through automated processing without human review.

baca8 will respond to all valid data rights requests within 30 days. Where a request is complex or baca8 receives a high volume of requests, this period may be extended by a further 60 days, with notice provided to you. There is no charge for exercising your data rights under normal circumstances.

10 Children & Minors

baca8 is strictly prohibited to persons under the age of 21. baca8 does not knowingly collect personal data from any individual under the age of 21. Age verification is applied during the registration process and may be requested at any time during the account's lifecycle.

If baca8 becomes aware that personal data has been collected from a person under the age of 21, all such data will be deleted immediately and the associated account will be closed. Any funds held in an underage account will be handled in accordance with applicable legal requirements. If you believe a person under 21 has registered a baca8 account, please notify us immediately at [email protected].

11 Changes to This Privacy Policy

baca8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. Where material changes are made to this Policy, baca8 will notify active players via the email address registered to their account or through a prominent notice on the baca8.io platform prior to the changes taking effect.

The version number and effective date displayed at the top of this Policy indicate when it was last updated. Your continued use of the baca8 platform following notification of any changes to this Policy constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how baca8 protects your personal data.

12 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way baca8 handles your personal data, please contact the baca8 Data Protection team:

• Email: [email protected]
• Platform: baca8.io
• Response Time: Within 5 business days for general enquiries; within 30 days for formal data rights requests.
• Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (BST, UTC+6).

When contacting us about a data rights request, please include your registered baca8 username, the email address associated with your account, and a clear description of your request. We may ask for additional information to verify your identity before processing your request.