bagh8 Privacy
Policy

This Privacy Policy (hereinafter referred to as "the Policy" or "this Policy") is published by bagh8 (hereinafter referred to as "bagh8", "we", "us", or "our"), the operator of the online betting and gaming platform accessible at bagh8.io (the "Platform" or "Website"). This Policy is addressed to all individuals who visit, register on, or otherwise interact with the bagh8 Platform (hereinafter referred to as "you", "your", or "the User").

bagh8 is committed to handling your personal data responsibly, transparently and securely. This Policy sets out in full: the categories of personal data we collect and process; the purposes for which that data is used; the lawful basis upon which processing is carried out; the parties with whom your data may be shared; the period for which your data will be retained; the security measures in place to protect it; and the rights you hold in relation to your personal information.

This Policy should be read in conjunction with the bagh8 Terms and Conditions, which govern your use of the Platform and are incorporated herein by reference. By accessing or using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with the manner in which bagh8 processes personal data as described herein, you must discontinue your use of the Platform immediately.

For the purposes of applicable data protection legislation, bagh8 acts as the data controller in respect of the personal data collected and processed via the Platform. As data controller, bagh8 determines the purposes and means by which personal data is processed and bears primary responsibility for ensuring that such processing is carried out lawfully, fairly and transparently.

bagh8 is operated by an internationally licensed entity. Queries regarding data protection, requests to exercise data subject rights, and formal data-related complaints may be directed to the bagh8 Data Protection contact point using the details provided in Section 15 (Contact Us) of this Policy.

bagh8 collects and processes the following categories of personal data in connection with the operation of the Platform. We collect only the minimum data necessary for the specified purposes in accordance with the principle of data minimisation.

3.1 Registration & Identity Data

When you create a bagh8 account, we collect your full legal name, date of birth, residential address (including city, district and postcode), email address, mobile phone number, and the username and password you select. This data is required to establish and maintain your account and to verify your identity in accordance with our Know Your Customer (KYC) obligations.

3.2 Identity Verification Documents

To comply with anti-money-laundering (AML) and KYC requirements, bagh8 may request copies of government-issued identity documents (such as a National Identity Card, passport or driving licence), proof of residential address (such as a utility bill or bank statement dated within three months), and proof of the payment method used. These documents are processed securely by our accredited identity verification partner and are retained only for as long as required by applicable law.

3.3 Financial & Transaction Data

bagh8 processes information relating to your deposits, withdrawals, wagers, winnings and account balances. This includes transaction amounts, timestamps, payment method identifiers (such as bKash wallet numbers, Nagad account references, Rocket account details, bank account numbers or masked card numbers), and transaction reference codes. bagh8 does not store full payment card numbers on its own systems; card data is tokenised and handled directly by our PCI-DSS compliant payment processing partners.

3.4 Usage & Behavioural Data

When you use the Platform, bagh8 automatically collects technical and behavioural data including your IP address, browser type and version, operating system, device identifiers, session duration, pages visited, features accessed, betting and gaming activity logs, search queries entered on the Platform, and error reports. This data is used to operate, improve and secure the Platform and to detect fraudulent or abusive behaviour.

3.5 Communications Data

bagh8 retains records of all communications between you and our customer support team, including live chat transcripts, email correspondence, WhatsApp messages and any formal complaint submissions. These records are retained to ensure the quality and consistency of our support services, to resolve disputes, and to comply with legal obligations.

3.6 Marketing Preferences

Where you have provided consent, bagh8 records your marketing preferences and opt-in or opt-out status for various communication channels, including email, SMS and push notifications. We also record the date and method by which consent was given or withdrawn.

3.7 Data You Provide Voluntarily

From time to time, you may voluntarily provide additional personal data to bagh8 — for example, when completing a survey, participating in a promotion, submitting feedback, or contacting us through a support channel. Such data is processed in accordance with this Policy and with any additional terms presented at the time of collection.

bagh8 collects personal data through the following primary channels:

• Direct submission: Data you actively provide when registering an account, completing the KYC process, making a deposit or withdrawal, placing a bet, contacting customer support, or entering a promotion.
• Automated collection: Technical and behavioural data collected automatically by the Platform via cookies, web beacons, server logs and similar tracking technologies when you access or navigate the Platform.
• Third-party sources: Identity verification and fraud prevention agencies may provide supplementary data to confirm or validate information you have submitted directly. Payment processing partners may share transaction confirmation data with bagh8 for reconciliation purposes.
• Publicly available sources: In limited circumstances, bagh8 may consult publicly available information (such as public registers or media reports) for fraud detection and AML compliance purposes.

bagh8 processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases relied upon by bagh8 are as follows:

bagh8 uses the personal data it collects for the following specific, explicit and legitimate purposes:

6.1 Account Operation

To create, verify and maintain your bagh8 account; to authenticate your identity when you log in; to process your transactions and record your betting and gaming activity; to administer bonus and loyalty programme credits; and to communicate with you regarding your account status, transaction confirmations and security alerts.

6.2 Legal & Regulatory Compliance

To fulfil our obligations under applicable anti-money-laundering legislation, counter-terrorism financing rules, and any other legal or regulatory requirements imposed on bagh8 as a licensed online gaming operator. This includes mandatory reporting of suspicious transactions to relevant financial intelligence units and the retention of transaction records for the periods prescribed by law.

6.3 Fraud Prevention & Security

To detect, investigate and prevent fraudulent activity, account takeovers, bonus abuse, match-fixing involvement, money laundering and any other conduct prohibited under the bagh8 Terms and Conditions. bagh8 employs automated fraud detection systems that analyse account behaviour and transaction patterns in real time. Where suspicious activity is identified, we may restrict account access pending investigation.

6.4 Responsible Gaming

To monitor your betting and gaming behaviour for indicators of problem gambling; to enforce self-exclusion requests, deposit limits and cooling-off periods set by you via the account settings panel; and to proactively contact you where our responsible gaming monitoring systems identify patterns that may indicate disordered gambling behaviour. See the bagh8 Responsible Gaming page for full details.

6.5 Customer Support

To respond to your enquiries, process complaints, and maintain a record of all support interactions for quality assurance and dispute resolution purposes. Communications data is used to train our support team and to improve the quality and speed of our customer service.

6.6 Marketing Communications

Where you have provided valid consent, bagh8 may use your contact details to send you personalised promotional offers, news about new games and features, seasonal offers (such as those relating to BPL cricket, IPL season, Eid promotions, and Pohela Boishakh specials), and other marketing communications. You may withdraw your consent to receive marketing at any time by updating your preferences in the account settings panel or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of marketing activities carried out prior to withdrawal.

6.7 Platform Improvement & Analytics

To analyse usage patterns, identify technical errors, test new features, and generally improve the performance, reliability and usability of the bagh8 Platform. Analytics data is processed in aggregated or pseudonymised form where possible. bagh8 does not use profiling or automated decision-making in any manner that produces legal or similarly significant effects on you without providing a mechanism for human review.

bagh8 uses cookies and similar tracking technologies (including web beacons, pixel tags and local storage) to operate and improve the Platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies allow the Platform to recognise your device on subsequent visits, remember your preferences, and collect usage data.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies, load-balancing cookies, and security tokens. These cookies cannot be disabled without affecting your ability to use the Platform.
• Functional Cookies: Allow the Platform to remember your preferences such as language settings, odds format, and display preferences to provide a more personalised experience.
• Analytics Cookies: Collect aggregated information about how users interact with the Platform, including which pages are visited most frequently and where errors occur. This data is used exclusively to improve the Platform.
• Marketing Cookies: Used, where consent has been obtained, to deliver relevant promotional content and to measure the effectiveness of bagh8 marketing campaigns. Marketing cookies are only activated following your explicit consent.

7.2 Managing Cookies

You may manage your cookie preferences at any time via your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features, including your account dashboard and betting markets.

bagh8 does not sell, rent or otherwise transfer your personal data to unaffiliated third parties for their own commercial purposes. Your personal data may, however, be shared with the following categories of third parties where strictly necessary and under appropriate contractual data protection safeguards:

8.1 Payment Processors

bagh8 shares transactional data with payment service providers — including bKash, Nagad, Rocket, Upay, and banking partners such as Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and international card schemes (Visa, Mastercard) — for the sole purpose of processing your deposits and withdrawals. Each payment processor operates under their own privacy policy and is independently responsible for their own data handling practices.

8.2 Identity Verification & KYC Providers

To fulfil our legal obligations in relation to age verification, identity verification and anti-money-laundering compliance, bagh8 may share identity document data and personal registration details with accredited third-party KYC and fraud prevention services. These providers act as data processors under bagh8's instructions and are contractually prohibited from using your data for any other purpose.

8.3 Technology & Platform Service Providers

bagh8 works with third-party technology providers — including cloud hosting providers, cybersecurity vendors, analytics platforms and customer support software providers — who may process limited personal data on our behalf in the course of delivering their services to bagh8. All such providers are bound by data processing agreements that restrict their use of your data to the services they provide to bagh8.

8.4 Game Content Providers

Live casino and slot game content on the bagh8 Platform is delivered by licensed third-party game studios, including Evolution Gaming, Ezugi, Pragmatic Play, Spribe, NetEnt and Microgaming. These providers may receive limited session and wager data for the purpose of game delivery, result verification and RTP auditing. Game providers do not receive your name, address or financial account details.

8.5 Legal & Regulatory Authorities

bagh8 may be required by law to disclose personal data to competent regulatory authorities, law enforcement agencies, financial intelligence units, tax authorities, or courts of competent jurisdiction. All such disclosures are made only to the extent strictly required by law, and bagh8 will, where legally permitted to do so, notify you of any such disclosure request.

8.6 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets or other business transfer involving bagh8, personal data held by bagh8 may be transferred to the acquiring or successor entity. You will be notified of any such transfer that materially affects the processing of your personal data, and the acquiring entity will be required to honour the commitments set out in this Policy.

bagh8 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide; specific legal or regulatory requirements may mandate longer retention periods in particular cases:

Upon expiry of the applicable retention period, bagh8 will securely delete or anonymise personal data in a manner that renders it irrecoverable. Where deletion is not technically possible (for example, where data has been archived in backup systems), bagh8 will isolate the data from further active processing until deletion can be carried out.

bagh8 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against accidental loss, destruction, alteration, unauthorised disclosure or access. Our security programme includes, but is not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bagh8 servers.
• Encryption at rest for sensitive personal data stored on bagh8 systems, including KYC documents and financial records.
• Role-based access controls that restrict employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication required for all administrative access to systems that process personal data.
• Regular internal and third-party security audits, vulnerability assessments and penetration testing conducted at least annually.
• Intrusion detection and prevention systems monitoring bagh8 infrastructure in real time, 24 hours a day, 7 days a week.
• Strict data processor vetting procedures ensuring all third-party vendors who handle personal data on bagh8's behalf maintain security standards equivalent to our own.
• A formal incident response plan governing bagh8's obligations and procedures in the event of a confirmed or suspected personal data breach.

Notwithstanding the measures described above, no method of electronic transmission or data storage is entirely free from risk. bagh8 cannot guarantee the absolute security of your personal data. You are responsible for maintaining the confidentiality of your account password and for ensuring that your device is adequately protected by up-to-date security software. If you suspect that your account has been compromised, you must notify bagh8 immediately by contacting [email protected].

Subject to applicable data protection law and any exemptions that may apply (for example, in connection with AML or fraud prevention obligations), you hold the following rights in relation to the personal data bagh8 holds about you:

• Right of Access: You have the right to request a copy of the personal data bagh8 holds about you, together with information about how that data is being processed. Such requests are commonly referred to as Subject Access Requests (SARs).
• Right to Rectification: You have the right to request that bagh8 correct any inaccurate personal data held about you, or complete any incomplete data, without undue delay.
• Right to Erasure: In certain circumstances, you have the right to request that bagh8 delete your personal data. This right is subject to exceptions — for example, we may be required to retain certain data to comply with legal obligations or to defend legal claims.
• Right to Restriction of Processing: You have the right to request that bagh8 restricts the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object at any time to the processing of your personal data where that processing is based on bagh8's legitimate interests. You also have an unconditional right to object to the processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right Not to Be Subject to Solely Automated Decisions: You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects on you, without a mechanism for human review.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". bagh8 will respond to all valid requests within thirty (30) days of receipt. Where a request is complex or numerous, bagh8 may extend this period by a further two months, provided you are notified of the extension within the initial thirty-day period.

The bagh8 Platform is strictly intended for adults aged 21 years and above. bagh8 does not knowingly collect, process or retain personal data from individuals under the age of 21. Age verification is a mandatory component of the bagh8 account registration and KYC process. Any account found to be held by an individual under the age of 21 will be immediately suspended, any funds held in that account will be handled in accordance with applicable law and our Terms and Conditions, and all personal data associated with that account will be deleted or anonymised to the extent permitted by law.

If you have reason to believe that a minor under the age of 21 has registered an account on the bagh8 Platform or provided personal data to bagh8 without appropriate authorisation, you are requested to notify us immediately at [email protected] so that we may investigate and take prompt remedial action.

The bagh8 Platform may from time to time contain references to third-party services, platforms or resources. These references are provided for informational convenience only and do not constitute an endorsement by bagh8 of any third-party website, product or service. bagh8 has no control over the content, privacy practices or data collection activities of any third-party platform and accepts no responsibility for the privacy policies or practices of such third parties.

Before submitting personal data to any third-party platform — including payment service providers, game studios or identity verification portals — you are strongly encouraged to review the privacy policy of that third party. The provisions of this Policy apply solely to data processed by bagh8 in connection with the bagh8.io Platform.

bagh8 reserves the right to amend, update or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, industry best practice, or the operational requirements of the Platform. All amendments will be published on this page with a revised "Last Updated" date. Where an amendment is material — meaning it significantly affects the manner in which bagh8 processes your personal data or the rights available to you — bagh8 will notify registered account holders by email or via an in-platform notice at least fourteen (14) days before the amendment takes effect.

Your continued use of the bagh8 Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the amended Policy, you must discontinue your use of the Platform and may close your account by contacting [email protected].

If you have any questions, concerns or complaints regarding this Privacy Policy or the manner in which bagh8 processes your personal data, or if you wish to exercise any of your data subject rights as described in Section 11, please contact us using the details below:

• Email: [email protected]
• Subject Line (for data requests): "Data Rights Request — [Your Username]"
• Subject Line (for privacy complaints): "Privacy Complaint — [Your Username]"
• Live Chat: Available 24/7 via the Platform
• WhatsApp: +880 1700 000 000
• Support Hours: 8:00 AM – 11:00 PM BST (UTC+6)

bagh8 will acknowledge receipt of all privacy-related correspondence within 24 hours and aims to provide a substantive response within thirty (30) calendar days. Where a complaint cannot be resolved to your satisfaction through bagh8's internal process, you may have the right to escalate the matter to a relevant supervisory authority or independent dispute resolution body, as directed by bagh8 in our written response to your complaint.