ba997 Privacy Policy — How We Protect and Handle Your Personal Data

ba997 is the operator of the online gaming and sports betting platform accessible at https://ba997.io (the "Platform"). In the context of data protection, ba997 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed.

ba997 is committed to operating a safe, transparent and trustworthy platform for players across Bangladesh. Protecting the personal information you share with us is not simply a legal obligation; it is a fundamental part of the trust that underpins our relationship with every registered player.

This Privacy Policy applies to all personal data collected by ba997 through the Platform, including data provided during account registration, KYC verification, payment processing, customer support interactions and general use of ba997 services. It applies to all players who access ba997 from Bangladesh, regardless of the device or connection method used.

For all privacy-related enquiries, you may contact the ba997 data protection team at [email protected] with the subject line "Privacy Enquiry".

ba997 collects several categories of personal data in the course of providing its services. The specific data we collect depends on how you interact with the Platform. The principal categories are as follows:

Identity and Contact Data

• Full legal name
• Date of birth
• Residential address (including city, district and postcode)
• Email address
• Mobile phone number
• Gender (where provided voluntarily)
• Nationality and country of residence

Verification and KYC Data

• Government-issued photo identification (e.g., National ID card, passport, driving licence)
• Proof of address documents (e.g., utility bill, bank statement dated within 90 days)
• Source of funds documentation (where required for AML compliance)
• Selfie or live photo for biometric identity matching (where required)

Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps and payment method used
• bKash, Nagad, Rocket and Upay mobile wallet account references
• Visa and Mastercard partial card numbers (we do not store full card numbers)
• Account balance history
• Bonus and promotional credit records

Gaming and Betting Activity Data

• Game history, including game titles, stake amounts, outcomes and session durations
• Sports betting history, including markets, odds, stake amounts and outcomes
• Responsible gaming preferences, including deposit limits, session limits and self-exclusion status
• Login timestamps, session start and end times, and device information

Technical and Device Data

• IP address and approximate geographic location derived from IP
• Device type, operating system and browser version
• Cookies, session tokens and local storage identifiers
• Referring URL and on-site navigation paths

Communications Data

• Content of support tickets, live chat transcripts and email correspondence with ba997
• Survey responses and feedback submissions
• Marketing preference settings and opt-in/opt-out records

ba997 collects your personal data through the following channels and mechanisms:

• Account Registration: When you create a ba997 account, you provide your name, date of birth, email address, phone number and residential address directly through the registration form.
• KYC Verification: When you submit identity and address verification documents through the ba997 account portal, we collect the data contained in those documents.
• Deposits and Withdrawals: When you initiate a financial transaction, your chosen payment provider (bKash, Nagad, Rocket, Upay, Visa, Mastercard) shares transaction reference data with ba997 to confirm the transaction.
• Platform Use: As you use the ba997 Platform, we automatically collect technical and activity data through server logs, game and betting system records, and session tracking mechanisms.
• Cookies and Tracking Technologies: ba997 uses cookies and similar technologies to collect device and browsing data. See Section 7 for full details of our cookie practices.
• Customer Support: When you contact the ba997 support team by email or live chat, the content of those communications is recorded and stored as part of your customer support history.
• Third-Party Sources: In limited circumstances, ba997 may receive data about you from third-party identity verification services, fraud detection providers or payment processors as part of our AML and KYC compliance processes.

ba997 processes your personal data for specific, legitimate purposes. We do not process your data in any manner that is incompatible with the purposes set out below:

ba997 will never use your personal data for automated decision-making that produces significant legal effects without the involvement of a human review process where you have the right to request one.

ba997 processes your personal data on the following legal bases:

• Contractual Necessity: The majority of the data processing described in this policy is necessary for ba997 to fulfil its contractual obligations to you as a registered player — including managing your account, processing your transactions and delivering gaming and betting services.
• Legal Obligation: Certain processing activities, particularly KYC verification, AML monitoring and the retention of financial transaction records, are required by applicable law. ba997 has no discretion to omit this processing.
• Legitimate Interests: ba997 processes some data on the basis of its legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics. In each case, ba997 has assessed that its legitimate interests are not overridden by your privacy rights.
• Consent: Where ba997 sends you direct marketing communications or uses non-essential cookies, this processing is based on your freely given, specific and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before withdrawal.

ba997 does not sell, rent or otherwise transfer your personal data to unaffiliated third parties for their own marketing purposes. Your data is shared only in the following limited and controlled circumstances:

• Payment Processors: ba997 shares the minimum necessary transaction data with payment service providers (including bKash, Nagad, Rocket, Upay, Visa and Mastercard) to facilitate deposits and withdrawals. These providers act as independent data controllers for the portions of the transaction that occur within their own systems.
• KYC and Identity Verification Providers: ba997 uses accredited third-party identity verification services to assist with document authentication and biometric matching. These providers process your KYC data solely on behalf of ba997 and under strict contractual data processing agreements.
• Game and Content Providers: When you play a game provided by a third-party studio such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe or Ezugi, limited technical session data (such as a session token and stake amounts) is shared with that provider's game server. These providers do not receive your name, contact details or payment information.
• Fraud and AML Service Providers: ba997 may share transaction and behavioural data with specialised fraud detection and anti-money laundering screening services to fulfil its compliance obligations.
• Legal and Regulatory Authorities: ba997 will disclose your personal data to law enforcement agencies, regulatory bodies or courts where required by applicable law or a valid legal order. ba997 will, where legally permitted, notify you of such a disclosure.
• Business Transfers: In the event of a merger, acquisition, restructuring or sale of all or part of ba997's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

All third parties with whom ba997 shares personal data are required by contract to handle that data securely, to use it only for the purposes for which it was shared, and to comply with applicable data protection standards.

ba997 uses cookies and similar tracking technologies (such as pixel tags, local storage objects and session tokens) to operate the Platform, improve your experience and support our analytics and security functions. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your login session, remember your security preferences and enable core features such as the game lobby and cashier. These cookies cannot be disabled without impairing the functionality of the Platform.
• Performance and Analytics Cookies: These cookies collect anonymous or pseudonymous data about how players use the Platform — such as which pages are visited most frequently, how long sessions last, and where errors occur. This data helps ba997 identify areas for improvement.
• Functionality Cookies: These cookies remember your personal preferences, such as your preferred language settings and display preferences, so that you do not need to reconfigure them on each visit.
• Targeting and Marketing Cookies: With your consent, ba997 may use cookies to understand your interests and deliver relevant promotional content within the Platform. These cookies do not share your identity with advertisers.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the ba997 Platform. Most modern browsers allow you to block, delete or receive notifications about cookies through the browser's privacy or security settings.

ba997 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AML record-keeping obligations.
• KYC and Verification Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law or an ongoing legal investigation.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming Activity Logs: Retained for a minimum of three (3) years for responsible gaming monitoring and dispute resolution purposes.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction in each support case.
• Marketing Consent Records: Retained for as long as the consent is active and for two (2) years following withdrawal of consent, as evidence of lawful processing.
• Technical and Server Logs: Retained for twelve (12) months for security monitoring and fraud detection purposes, after which they are anonymised or deleted.

At the end of the applicable retention period, ba997 will securely delete or anonymise your personal data in accordance with its internal data disposal procedures.

As a player on the ba997 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact the ba997 data protection team at [email protected] with the subject line "Data Rights Request" and provide sufficient information to verify your identity.

• Right of Access: You have the right to request a copy of all personal data that ba997 holds about you, along with information about how it is being used. ba997 will respond to verified access requests within 30 days.
• Right to Rectification: If you believe that any personal data ba997 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update your basic account information directly from the ba997 account settings panel.
• Right to Erasure: You have the right to request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to ba997's legal obligations to retain certain data for AML, KYC and financial record-keeping purposes.
• Right to Restriction of Processing: You have the right to request that ba997 restricts the processing of your personal data in certain circumstances — for example, while a dispute about its accuracy is being resolved.
• Right to Data Portability: Where ba997 processes your data on the basis of consent or contractual necessity, you have the right to receive a copy of your data in a structured, commonly used and machine-readable format.
• Right to Object: You have the right to object to ba997's processing of your personal data where that processing is based on legitimate interests. ba997 will assess each objection individually and will cease the relevant processing unless it can demonstrate compelling legitimate grounds that override your privacy rights.
• Right to Withdraw Consent: Where ba997 relies on your consent as the legal basis for processing (e.g., for direct marketing or non-essential cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.

ba997 takes the security of your personal data extremely seriously and implements a comprehensive set of technical and organisational security measures to protect against unauthorised access, disclosure, alteration or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the ba997 Platform is encrypted using industry-standard 256-bit SSL/TLS protocols, ensuring that your data cannot be intercepted in transit.
• Encrypted Storage: Personal data and financial records stored on ba997's servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within ba997's internal systems is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access necessary to perform their duties, and all access is logged and audited.
• Two-Factor Authentication: ba997's internal administrative systems require two-factor authentication for all staff access, significantly reducing the risk of unauthorised internal access.
• Regular Security Audits: ba997 conducts regular security assessments and penetration tests of its Platform and infrastructure, and acts promptly on any vulnerabilities identified.
• Incident Response: In the event of a data security incident that affects your personal data, ba997 will notify affected players and the relevant authorities within the timeframe required by applicable law, and will take immediate remedial action.

While ba997 takes every reasonable measure to protect your data, no online platform can guarantee absolute security. You are also responsible for keeping your own login credentials secure. If you suspect that your ba997 account has been compromised, please contact [email protected] immediately.

The ba997 Platform integrates with a number of third-party service providers to deliver its full range of gaming, payment and support functions. While ba997 takes care to work only with reputable, security-conscious partners, you should be aware that third-party services operate under their own privacy policies.

Third-party providers whose services are integrated into ba997 include, but are not limited to:

• Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi and other studio partners. Game session data is processed on their servers to deliver fair and certified game outcomes.
• Payment Processors: bKash, Nagad, Rocket, Upay, Visa and Mastercard. Transaction data is processed on their secure payment infrastructure.
• Analytics Providers: ba997 may use analytics services to collect aggregated, anonymised usage data about Platform performance. No personally identifiable information is shared with analytics providers.
• Identity Verification Services: Accredited KYC and AML compliance providers that assist ba997 in verifying player identities and screening against sanction lists.

ba997 is not responsible for the privacy practices of third-party websites or services that you may access independently outside of the ba997 Platform. We encourage you to review the privacy policies of any external services you use.

The ba997 Platform is strictly intended for adults aged 21 years and above. ba997 does not knowingly collect or process personal data from any person under the age of 21. Age verification is a mandatory step in the ba997 account registration and KYC process, and ba997 reserves the right to request documentary proof of age from any player at any time.

If ba997 becomes aware that personal data has been collected from a person under the age of 21, it will immediately take the following steps:

• Permanently close the account associated with the underage individual.
• Delete all personal data collected from that individual to the extent permitted by applicable law.
• Return any deposited funds to the payment method used, following necessary due diligence.

If you have reason to believe that a minor has registered an account on the ba997 Platform, please contact [email protected] immediately with the subject line "Underage Account Report". ba997 treats such reports as the highest priority and will act on them without delay.

ba997 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law or Platform functionality. When a material change is made, ba997 will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date at the top of the document.
• Send a notification to the email address registered to your ba997 account, providing a summary of the key changes, no less than seven (7) days before the updated policy takes effect.

Your continued use of the ba997 Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must cease using the Platform and may request account closure by contacting [email protected].

ba997 recommends that you review this Privacy Policy periodically to remain informed of how your personal data is being handled. The date of the most recent revision is always clearly displayed at the top of this page.

For any questions, concerns or requests relating to this Privacy Policy or ba997's data protection practices, please contact the ba997 data protection team using the details below. All correspondence should be in English for the fastest possible response.

• Email: [email protected]
• Subject Line (for privacy matters): "Privacy Enquiry" or "Data Rights Request"
• Support Hours: 24 hours a day, 7 days a week, 365 days a year
• Response Language: English
• Platform: https://ba997.io

ba997 aims to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within 30 calendar days. If you are submitting a formal data rights request under Section 9 of this policy, please include your full registered name, account username and a description of the right you wish to exercise to help us process your request promptly.