bad888 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how bad888 collects, processes, stores, and shares personal data in connection with the bad888 platform, including the website at bad888.bet and all associated services, games, promotions, and customer support channels (collectively, "the Platform").

By creating an account on bad888 or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform and contact support at [email protected] to close your account.

This Policy applies to all registered players located in Bangladesh, including users in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar, as well as any other individuals who access the Platform regardless of geographic location. Bad888 is committed to maintaining the highest practical standards of data protection and privacy for all users.

2. Data Controller Information

Bad888 acts as the data controller for all personal data collected through the Platform. As data controller, bad888 determines the purposes and means of processing your personal data. Any questions, requests, or concerns relating to the handling of your personal data should be directed to our support team in writing at:

Email: [email protected] (plain text — not a clickable link)

We aim to acknowledge all written data-related enquiries within 5 business days of receipt and to provide a substantive response within 30 calendar days, except where the complexity of the request requires a longer period, in which case we will notify you of the extended timeline.

3. Categories of Personal Data We Collect

Bad888 collects the following categories of personal data from users of the Platform:

• Identity Data: Full legal name, date of birth, national ID or passport details (where required for age or identity verification), and a photograph or scan of identity documents submitted during the KYC (Know Your Customer) verification process.
• Contact Data: Residential address (including city, district, and postcode within Bangladesh), email address, and Bangladeshi mobile phone number.
• Financial Data: Payment method details including bKash wallet number, Nagad number, Rocket number, Upay account, Visa or Mastercard details (card number is never stored in full — only the last four digits and expiry date are retained after processing), transaction history, deposit and withdrawal records, and account balance history. All transaction values are denominated in Bangladeshi Taka (BDT).
• Account Data: Username, encrypted password, account registration date, login timestamps, session duration records, and account status history.
• Gaming Activity Data: Game session records, bet amounts and outcomes, sports betting market selections, bonus claims and wagering progress, and responsible gaming tool settings (deposit limits, cool-off periods, self-exclusion status).
• Technical Data: IP address, device type and model, operating system version, browser type and version, mobile network operator, and screen resolution. This data is collected automatically when you access the Platform.
• Communications Data: Records of correspondence with bad888 customer support, including chat transcripts, email messages, and any documents or images you submit to support agents.
• Marketing Preferences: Your stated preferences regarding receipt of promotional communications from bad888, including email and SMS marketing opt-in or opt-out status.

4. How We Collect Your Personal Data

Bad888 collects personal data through the following methods:

• Direct collection: Data you provide when completing the bad888 registration form, submitting identity verification documents, making deposits or withdrawals, completing responsible gaming forms, or contacting our support team.
• Automated collection: Technical data collected automatically by our platform infrastructure when you visit or use bad888, including via cookies, server logs, and session tracking technology. See Section 8 of this Policy for full details of our cookie usage.
• Third-party sources: Data received from third-party payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard) in connection with transaction processing; fraud prevention and identity verification service providers; and, where applicable, publicly available information used for compliance screening purposes.

Bad888 does not purchase personal data from data brokers or list vendors, and does not collect data from social media platforms without your explicit consent.

5. Purposes and Legal Bases for Processing

Bad888 processes your personal data for the following specific purposes, each supported by a defined legal basis:

• Account registration and management — necessary for the performance of a contract between you and bad888.
• Age and identity verification (KYC) — necessary to comply with our legal obligation to verify that all users are aged 21 or above before permitting any financial transactions.
• Payment processing — necessary for the performance of the contract, specifically the processing of deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, and Mastercard.
• Fraud prevention and security monitoring — necessary for the legitimate interests of bad888 in protecting the Platform from financial crime, account takeover, and abuse.
• Anti-money laundering (AML) compliance — necessary to comply with legal obligations applicable to financial services operators.
• Responsible gaming enforcement — necessary to comply with our self-imposed responsible gaming obligations and to protect vulnerable players, including enforcement of the 21+ age restriction.
• Customer support — necessary for the performance of the contract and for our legitimate interest in maintaining service quality.
• Platform improvement and analytics — based on our legitimate interest in understanding how the Platform is used in order to improve the service for all players.
• Promotional communications — based on your explicit consent, where you have opted in to receiving marketing emails or SMS messages from bad888. You may withdraw this consent at any time by contacting [email protected].

6. Sharing Your Personal Data

Bad888 shares personal data only with the categories of third parties listed below, and only to the extent strictly necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive the minimum data required to process your deposit or withdrawal transaction. These providers operate under their own privacy policies and data protection obligations.
• Game content providers: Certified game studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, and Spribe receive anonymised or pseudonymised session data necessary to operate their games on the bad888 platform. These studios do not receive your full identity or contact data.
• Identity verification providers: Third-party KYC service providers receive the identity documents and data you submit for age and identity verification purposes.
• Fraud and security services: Providers of fraud detection, IP screening, and device fingerprinting services receive limited technical data to help identify suspicious activity.
• Legal and regulatory authorities: Where required by applicable law or a valid legal order, bad888 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities. Bad888 will not notify the account holder where doing so would prejudice a law enforcement investigation.

Bad888 does not share personal data with third-party advertisers, data brokers, social media platforms, or any entity for commercial marketing purposes without your explicit prior consent.

7. International Data Transfers

Bad888 operates infrastructure and engages service providers that may be located outside Bangladesh. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that applicable in Bangladesh, bad888 implements appropriate safeguards including contractual data protection clauses with the receiving party to ensure your data remains protected to the standard described in this Policy.

By using the bad888 platform, you acknowledge that your data may be processed in jurisdictions outside Bangladesh. If you have concerns about any specific international transfer of your data, please contact us at [email protected] for further information.

8. Cookies and Tracking Technologies

Bad888 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit bad888. We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in to your bad888 account, security tokens, and load-balancing cookies. These cannot be disabled without preventing you from using core Platform features.
• Functional cookies: Store your preferences such as language settings, responsible gaming limit values, and display options so these are retained across sessions.
• Analytics cookies: Used to understand how players navigate and use the Platform, which pages are visited most frequently, and where errors occur. This data is used in aggregate form to guide Platform improvements. Analytics data does not identify you personally.
• Marketing cookies: Used only where you have given explicit consent, to deliver promotional messaging relevant to your interests and gaming history on the bad888 platform.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent certain Platform features from functioning correctly. Withdrawing consent for marketing cookies does not affect the lawfulness of any processing carried out prior to withdrawal.

9. Data Retention

Bad888 retains personal data for the following periods:

• Active account data: Retained for the full duration of your account's active status on the Platform, plus a minimum period of 5 years following permanent account closure, to meet AML compliance and financial record-keeping obligations.
• Identity verification documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction in accordance with financial compliance requirements.
• Customer support communications: Retained for 3 years from the date of the last communication in a given support thread.
• Marketing preference records: Retained for 3 years from the date of the most recent opt-in or opt-out action, to maintain a clear audit trail of consent.
• Technical and analytics data: Retained in anonymised or aggregated form indefinitely for Platform analytics purposes; identifiable technical data (e.g., IP address logs) is retained for no longer than 12 months.

At the end of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to any identifiable individual.

10. Security Measures

Bad888 implements a range of technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the bad888 servers.
• Encrypted storage of passwords using industry-standard one-way hashing algorithms — bad888 support staff cannot view your password in plain text.
• Access controls that restrict internal staff access to personal data on a strict need-to-know basis, with audit logging of all access events.
• Regular third-party security audits and penetration testing of Platform infrastructure.
• Two-factor authentication (2FA) options available to all registered bad888 accounts for enhanced login security.
• Automated fraud detection systems that monitor transaction and login patterns for signs of unauthorised access.

While bad888 takes every reasonable precaution to protect your data, no internet-based system can guarantee absolute security. You play an important role in protecting your own data by keeping your bad888 login credentials confidential and notifying us immediately if you suspect your account has been compromised.

11. Exercising Your Data Rights

To exercise any of the rights described in this Policy — including the right to access, rectify, erase, restrict, port, or object to processing of your personal data — please submit a written request to [email protected] with the subject line "Data Rights Request". Please include your registered email address, your bad888 username, and a description of the specific right you wish to exercise.

Bad888 will acknowledge your request within 5 business days and will provide a substantive response within 30 calendar days. Where the request is complex or where multiple requests have been received simultaneously, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

In some circumstances, bad888 may be unable to fulfil a data erasure or restriction request where continued processing is required by law — for example, where transaction records must be retained for AML compliance. We will always explain the specific reason if we are unable to fulfil a request in full.

12. Children and Minors

Bad888 strictly prohibits access by individuals under the age of 21. The Platform is not directed at, and does not knowingly collect personal data from, any person under the age of 21. If bad888 becomes aware that personal data has been collected from a person under 21 without verified parental consent, we will take immediate steps to close the associated account, return any deposits, and securely delete all personal data associated with that account.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on bad888, please contact us immediately at [email protected] so we can take prompt action.

13. Changes to This Privacy Policy

Bad888 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. When material changes are made, we will notify registered users via the email address on file at least 14 days before the revised Policy takes effect. The updated Policy will also be published on the bad888 platform with a revised "Last updated" date at the top of the page.

Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and contact [email protected] to request account closure.