Your Privacy Matters to 89bad

1 Information We Collect

89bad collects personal information through several channels: directly from you when you register an account or interact with the platform, automatically as you browse and use our services, and from third-party partners involved in payment processing and fraud prevention. The categories of data we collect are described below.

Information You Provide Directly

When you create a 89bad account, contact our support team, or engage with promotional offers, you voluntarily provide us with personal information that may include:

• Identity data: Full legal name, date of birth, national identity number or passport number (for KYC/age verification purposes).
• Contact data: Email address, mobile phone number, residential address (city, district, and full address for KYC purposes).
• Account credentials: Your chosen username and a hashed representation of your password. 89bad never stores passwords in plain text.
• Financial data: Mobile wallet account details (bKash, Nagad, Rocket, Upay account numbers registered in your name), bank account details for bank transfers, and card type/last four digits for card payments. Full card numbers and PINs are never stored by 89bad.
• KYC documentation: Scanned or photographed copies of government-issued identity documents, proof of address documents, and proof of payment method ownership, submitted in response to a verification request.
• Communications data: The content of messages you send to the 89bad support team via email at [email protected], including any attachments, together with metadata such as timestamps.

Information Collected Automatically

When you visit and use the 89bad platform, certain data is collected automatically by our systems:

• Device and browser data: IP address, device type (mobile, tablet, desktop), operating system version, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, time spent on each page, games played, bet amounts and frequencies, sports markets browsed, deposit and withdrawal history, session start and end times, and click-path data.
• Location data: Approximate geographic location derived from your IP address, used to detect access from restricted jurisdictions and to detect suspicious account access patterns. 89bad does not collect precise GPS coordinates.
• Cookie and tracking data: Identifiers set by cookies and similar technologies as described in Section 4 below.

Information from Third Parties

89bad may receive supplementary data about you from the following categories of third party:

• Payment processors: Transaction confirmation references, payment status updates, and fraud-signal data from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and card networks (Visa, Mastercard).
• Fraud prevention and KYC providers: Risk scores, identity verification outcomes, and sanctions-screening results from third-party compliance service providers used by 89bad.
• Game providers: Session logs, round outcomes, and RTP (return-to-player) statistics from third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe, to the extent such data is linked to your account.

Data Category	Examples	Source
Identity	Name, DOB, NID / Passport	You (registration & KYC)
Contact	Email, phone, address	You (registration)
Financial	bKash number, bank account	You & payment processors
Technical	IP address, device ID, browser	Automatic (platform systems)
Usage / Behavioural	Pages visited, bets placed	Automatic (platform systems)
KYC Documentation	Passport scan, utility bill	You (verification request)
Compliance / Fraud signals	Risk score, sanctions check	Third-party KYC / AML providers

2 How We Use Your Data

89bad uses the personal data we collect for clearly defined purposes. We do not use your data for any purpose that is incompatible with the reasons listed below. The principal purposes for which we process your personal information are:

Account Management and Service Delivery

• Creating and maintaining your 89bad account, authenticating your identity at login, and managing your session security.
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard.
• Crediting and debiting wagers, winnings, and bonus amounts to and from your account balance.
• Providing customer support in response to your enquiries, complaints, and dispute submissions.
• Sending transactional communications such as deposit confirmations, withdrawal receipts, and account security alerts by email or SMS.

Legal and Regulatory Compliance

• Verifying your age and identity to comply with our minimum age policy (18+) and anti-money-laundering obligations.
• Screening your identity against sanctions lists and politically exposed persons (PEP) databases as required by applicable offshore compliance standards.
• Retaining transaction records and account activity logs for the time periods required by applicable financial and gaming regulations.
• Responding to lawful requests from regulatory authorities, courts, or law enforcement agencies.

Fraud Prevention and Platform Security

• Detecting and investigating suspected multi-accounting, bonus abuse, collusion, or other prohibited conduct as defined in the 89bad Terms & Conditions.
• Analysing device fingerprints, IP addresses, and usage patterns to identify and block fraudulent account access attempts.
• Monitoring transactions for indicators of money laundering or other financial crime.

Platform Improvement and Analytics

• Analysing aggregate, anonymised usage data to understand player preferences, optimise the lobby layout, and improve the performance and stability of the 89bad platform.
• Testing new features, game integrations, and payment methods in a controlled manner before full rollout.
• Generating internal reports on player activity to inform responsible gaming interventions where usage patterns suggest potential problem gambling behaviour.

Marketing Communications

89bad may send you promotional communications about new games, bonus offers, and seasonal promotions relevant to the Bangladesh market (such as BPL season offers, Eid promotions, or Pohela Boishakh specials) by email or SMS, provided that you have not opted out of marketing communications. You may opt out at any time by contacting support at support@89bad.net. Opting out of marketing communications will not affect transactional or account-security messages, which are sent regardless of marketing preferences.

3 Data Sharing and Disclosure

89bad does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your information with external parties only in the specific circumstances described below.

Payment Service Providers

To process deposits and withdrawals, 89bad shares the minimum necessary financial and identity data with your selected payment provider (e.g., bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, or Mastercard). These providers operate under their own privacy policies and are contractually required to handle your data securely and only for the purpose of processing the specific transaction.

KYC and Compliance Providers

89bad engages third-party identity verification and anti-money-laundering (AML) service providers to assist with Know Your Customer (KYC) processes. Your identity documents and personal details may be processed by these providers solely for verification purposes. All such providers are contractually bound to strict data-security and confidentiality standards.

Game Technology Providers

Third-party game studios (including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe) receive a pseudonymous player session identifier and game-activity data necessary to run the game engine and return results to the 89bad platform. These providers do not receive your full name, national ID, or contact details unless required for a specific dispute resolution process.

Legal and Regulatory Disclosure

89bad may disclose your personal data to government authorities, regulatory bodies, courts, or law enforcement agencies where required to do so by applicable law, valid legal process, or in connection with an investigation into financial crime, fraud, or a breach of these policies. 89bad will, where legally permitted, notify you of such a request before disclosure.

Business Transfers

In the event that 89bad undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, personal data held about players may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer and any change in the applicable privacy terms via a notice on the platform or by email to their registered address.

4 Cookies and Tracking Technologies

89bad uses cookies and similar client-side storage technologies (including local storage and session storage) to operate the platform securely, maintain your login session, and understand how the platform is used. This section explains the types of cookies we set and their purpose.

What Is a Cookie?

A cookie is a small text file placed on your device by a website when you visit it. Cookies allow the website to recognise your device on subsequent visits and to store preferences or session information. 89bad uses both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a defined period).

Categories of Cookies Used by 89bad

Cookie Type	Purpose	Duration
Strictly Necessary	Maintain your authenticated session after login via the 89bad Login portal. These cookies are essential for the platform to function and cannot be disabled.	Session
Security	CSRF (Cross-Site Request Forgery) protection tokens and device-fingerprint identifiers used to detect and prevent fraudulent or hijacked sessions.	Session / 30 days
Functional	Store your preferences such as language settings, preferred lobby view, and last-visited game category so the platform remembers your choices between sessions.	90 days
Analytics	Aggregate, anonymised data on page visits, navigation paths, game load times, and feature usage, used to improve platform performance and design. No personally identifiable information is included in analytics data.	12 months
Payment Flow	Short-lived tokens used to maintain the integrity of a deposit or withdrawal session, ensuring that a transaction initiated in one browser tab cannot be intercepted or modified.	Transaction duration

Managing Cookies

You may configure your browser to block or delete cookies at any time. However, disabling strictly necessary and security cookies will impair or prevent your ability to log in to the 89bad platform and use its core features. Disabling functional or analytics cookies will not prevent platform access but may reduce the quality of your experience. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Firefox, Safari, Edge, Opera, or Samsung Internet).

5 Data Retention and Storage

89bad retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The retention periods applicable to different categories of data are described below.

Account and Identity Data

Account registration data, identity verification documents (KYC), and account history are retained for the lifetime of your active account plus a minimum period of five (5) years following permanent account closure. This retention period reflects standard anti-money-laundering record-keeping requirements applicable to offshore gaming operators.

Transaction and Financial Data

Records of all deposits, withdrawals, wagers, winnings, and bonus credits are retained for a minimum of five (5) years from the date of the transaction. This data may be retained for longer if required in connection with an unresolved dispute, active investigation, or regulatory inquiry.

Communications Data

Support email correspondence and chat logs are retained for two (2) years from the date of the last message in each conversation thread. Correspondence related to formal disputes or complaints may be retained for longer, until the matter is fully resolved.

Usage and Technical Data

Server logs, IP access logs, device fingerprints, and session data are retained for twelve (12) months in active storage and may be archived for an additional period for security and fraud-analysis purposes.

Data Storage Location

89bad's platform infrastructure and data storage systems are hosted on servers maintained by reputable cloud infrastructure providers operating offshore. All data at rest is encrypted using AES-256 encryption. Access to production data systems is restricted to authorised 89bad personnel and is protected by multi-factor authentication and role-based access controls.

6 Your Privacy Rights

89bad recognises and respects your rights over your personal data. The following rights are available to all players registered on the 89bad platform, regardless of their location within Bangladesh (including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar).

Right of Access

You have the right to request a copy of all personal data that 89bad holds about you. Upon receiving a valid access request, 89bad will provide a structured summary of your data within a reasonable timeframe — typically within 30 days of the request being received and verified.

Right to Rectification

If any personal data 89bad holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain information (such as your email address or contact number) directly via your account settings. For corrections to identity documents or KYC records, contact the support team with the updated documentation.

Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the data has been processed unlawfully. Please note that 89bad may be legally required to retain certain data (particularly transaction records and KYC documentation) for the minimum retention periods described in Section 5 above, even following an erasure request.

Right to Restriction of Processing

In certain circumstances — for example, while a dispute regarding the accuracy of your data is being resolved — you have the right to request that 89bad restrict the processing of your personal data. During the restriction period, 89bad may store your data but will not process it further without your consent (or where required for legal claims or the protection of other persons' rights).

Right to Data Portability

Where processing is carried out on the basis of your consent or in connection with a contract, and processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV). You may also request that this data be transmitted directly to another service provider where technically feasible.

Right to Object to Marketing

You have the right at any time to object to the processing of your personal data for direct marketing purposes. Following receipt of an objection, 89bad will cease to use your data for marketing communications without delay. To exercise this right, email support@89bad.net with the subject line "Marketing Opt-Out".

Exercising Your Rights

To exercise any of the rights listed above, please contact the 89bad data team by email at support@89bad.net with "Privacy Request" in the subject line. To protect your data, 89bad may require you to verify your identity before processing any data request. Requests will be handled within 30 days; where additional time is required for complex requests, you will be notified.

7 Data Security Measures

89bad takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or alteration.

Technical Controls

• Transport Layer Security: All data in transit between your browser or app and 89bad's servers is encrypted using TLS 1.2 or higher. Older, insecure protocols (TLS 1.0, SSL 3.0) are disabled.
• Encryption at Rest: All databases and file storage systems containing personal or financial data are encrypted using AES-256 encryption.
• Password Hashing: Passwords are never stored in plain text. 89bad uses a modern, salted cryptographic hashing algorithm (bcrypt or equivalent) to store password representations.
• Multi-Factor Authentication (MFA): Administrative access to 89bad's production systems and data infrastructure requires multi-factor authentication. Players are encouraged to enable any available two-factor authentication options on their account.
• Firewall and Intrusion Detection: 89bad's infrastructure is protected by network-level firewalls, web application firewalls (WAF), and automated intrusion detection systems that flag anomalous access patterns for immediate investigation.
• Regular Security Testing: 89bad commissions periodic penetration tests and vulnerability assessments of its platform infrastructure to proactively identify and remediate security weaknesses.

Organisational Controls

• Access to personal data is granted on a strict need-to-know basis, with role-based access controls ensuring that employees can only access data relevant to their specific function.
• All staff who handle personal data are trained on data protection obligations and the 89bad internal data-handling procedures.
• Third-party vendors who process data on behalf of 89bad are required to demonstrate adequate security standards via contractual data-processing agreements.

Data Breach Response

In the event of a data security breach that poses a risk to the rights of affected players, 89bad will investigate the breach, take immediate steps to contain it, and notify affected players at their registered email address without undue delay. Notifications will include the nature of the breach, the categories of data affected, the likely consequences, and the measures 89bad has taken or proposes to take to address the breach.

8 Contact Us About Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy, the way 89bad handles your personal data, or if you wish to exercise any of your privacy rights as described in Section 6, please contact the 89bad data team using the details below.

Privacy Enquiries

All privacy-related correspondence should be directed to the 89bad support team by email. Please include "Privacy Request" or "Data Enquiry" in the subject line so that your message is routed to the appropriate team promptly.

• Email: support@89bad.net
• Response time: We aim to acknowledge all privacy enquiries within 2 business days and to provide a full response within 30 calendar days.
• Postal contact: As an offshore platform, 89bad does not maintain a publicly listed postal address in Bangladesh. All formal communications should be submitted by email.

Updates to This Privacy Policy

89bad reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform functionality. When material changes are made, we will notify registered players via a notice on the 89bad platform and/or by email to the registered address at least 7 days before the changes take effect. The "Last updated" date at the top of this policy will always reflect when the most recent revision was published. Players are encouraged to review this page periodically.

Continued use of the 89bad platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you should close your account and cease using the platform before the changes take effect.