Privacy Policy — How ba678 Handles Your Personal Data
ba678 is committed to safeguarding the privacy of every player on its platform. This Privacy Policy explains in clear terms what data we collect, why we collect it, how it is used and stored, who we share it with, and what rights you hold over your personal information.
01 Introduction
ba678 ("we", "us", "our") operates the online casino and sports betting platform accessible at ba678.io. As the data controller for personal information collected through this platform, ba678 takes its obligations under applicable data protection principles seriously and is committed to handling all personal data with transparency, integrity, and appropriate security.
This Privacy Policy sets out in full the basis on which any personal data we collect from you, or that you provide to us, will be processed by ba678. It applies to all visitors to ba678.io, all registered account holders, and all individuals who interact with ba678 through any channel including live chat and email support.
The ba678 platform is designed specifically for players in Bangladesh. Where this policy references "applicable law" or "legal obligations", it refers to the data protection and privacy standards applicable to our operations and to our player base in Bangladesh.
This policy should be read alongside ba678's Terms & Conditions and Responsible Gaming policy, both of which contain additional clauses that relate to how your account data is used in connection with those specific services.
02 Data We Collect
ba678 collects personal data in a number of categories depending on how you interact with the platform. The table below summarises the primary data categories we hold:
| Data Category | Examples | Collected At |
|---|---|---|
| Identity Data | Full legal name, date of birth, national ID number, passport number, photograph | Registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, district, postal code) | Registration |
| Financial Data | bKash / Nagad / Rocket / Upay account numbers, Visa/Mastercard last four digits, transaction history, deposit and withdrawal records | Deposit, withdrawal, KYC |
| Account Data | Username, encrypted password hash, account balance, bonus status, wagering history | Registration & ongoing use |
| Technical Data | IP address, device fingerprint, browser type and version, operating system, screen resolution, session timestamps | Every platform visit |
| Usage Data | Pages visited, games played, bet history, session duration, feature interactions, click-path data | Ongoing platform use |
| Communications Data | Live chat transcripts, support email correspondence, complaint records | Support interactions |
| Preference Data | Responsible gaming settings, notification preferences, language preferences, self-exclusion records | Account settings |
ba678 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data unless specifically required to fulfil a responsible gaming obligation (for example, recording a self-exclusion request).
03 How We Collect Data
ba678 collects personal data through the following channels:
- Direct Submission: Data you actively provide when completing the registration form, submitting KYC documents, initiating a deposit or withdrawal, or contacting our support team via live chat or email.
- Automated Technical Collection: Data collected automatically as you interact with the ba678.io platform, including IP address, device identifiers, browser characteristics, and session activity logs. This collection occurs via server logs, cookies, and analytics tools.
- Payment Processors: Financial data received from payment service providers (bKash, Nagad, Rocket, Upay, Visa, Mastercard) when you initiate a transaction. ba678 receives confirmation and reference data from these providers; full payment credentials are processed by the provider and are not stored on ba678 servers.
- Identity Verification Providers: During KYC verification, ba678 may use third-party identity verification services that process the documents you submit. These providers return a verification result to ba678; original document images may be retained by the verification provider in accordance with their own retention policies.
- Game Providers: Third-party game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) may pass gameplay session data back to ba678 for the purposes of bet settlement, dispute resolution, and platform analytics.
04 Purpose & Legal Basis for Processing
ba678 processes your personal data only for specific, defined purposes. The table below sets out each processing purpose and the corresponding legal basis:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Identity, Contact, Account | Performance of contract |
| Identity and age verification (KYC) | Identity, Financial | Legal obligation |
| Processing deposits and withdrawals | Financial, Identity | Performance of contract |
| Fraud prevention and AML monitoring | Technical, Financial, Usage | Legal obligation & legitimate interest |
| Responsible gaming tools and enforcement | Preference, Account, Usage | Legal obligation & legitimate interest |
| Customer support and dispute resolution | Communications, Account | Performance of contract |
| Platform analytics and improvement | Technical, Usage | Legitimate interest |
| Marketing communications (opt-in only) | Contact, Preference | Consent |
ba678 does not process your personal data for any purpose that is incompatible with those listed above. Where we intend to use your data for a new purpose, we will update this Privacy Policy and, where required, seek fresh consent.
05 Data Sharing & Third Parties
ba678 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Data is shared with carefully selected third parties only where necessary to deliver platform services or to comply with legal obligations. The categories of recipient are as follows:
- Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa network processors, and Mastercard network processors receive transactional data necessary to execute deposits and withdrawals. These providers are independent data controllers subject to their own privacy policies.
- Identity Verification Partners: Third-party KYC and AML service providers that process identity documents and return verification results to ba678. These providers are contractually bound to process data only for the purpose of identity verification and to maintain appropriate security standards.
- Game Technology Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studio partners receive a player session token and anonymised player identifier to facilitate game delivery. Full personal identity data is not passed to game providers.
- Analytics and Security Services: Providers of fraud detection, device fingerprinting, and platform analytics tools that process technical and usage data under data processing agreements with ba678.
- Legal and Regulatory Authorities: ba678 will disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by applicable law, court order, or legitimate regulatory request.
- Professional Advisers: Legal, audit, and compliance consultants who are bound by professional confidentiality obligations and who process data only to the extent necessary to provide their professional services to ba678.
All third-party data processors engaged by ba678 are required to enter into data processing agreements that bind them to process data only on ba678's documented instructions, to implement appropriate technical and organisational security measures, and to assist ba678 in meeting its data subject rights obligations.
06 Cookies & Tracking Technologies
ba678.io uses cookies and similar tracking technologies to operate the platform correctly, maintain your session security, and understand how players interact with the site. The categories of cookies in use are:
- Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable session authentication, maintain your login state, and support security features such as CSRF protection. These cookies cannot be disabled without impairing platform functionality.
- Functional Cookies: These cookies remember your stated preferences — such as your responsible gaming settings, notification choices, and display configuration — so that you do not need to reset them each session.
- Analytics Cookies: ba678 uses anonymised analytics to understand which features players use most, where navigation difficulties arise, and how page performance can be improved. Analytics data is aggregated and does not identify individual players.
- Security & Fraud Prevention Cookies: Device fingerprinting and risk-scoring tools use persistent identifiers stored in cookies or local storage to detect unusual login patterns, duplicate accounts, and potential fraud vectors.
Most web browsers allow you to manage your cookie preferences through browser settings. Disabling strictly necessary cookies will affect your ability to log in and use ba678. Disabling analytics or functional cookies will not prevent you from using the platform but may result in reduced personalisation.
ba678 does not use third-party advertising cookies and does not serve retargeting advertisements to players through third-party ad networks.
07 Data Retention
ba678 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal and regulatory retention obligations. The following general retention periods apply:
- Active Account Data: Retained for the duration of your active account relationship with ba678 plus a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
- KYC & Identity Documents: Retained for a minimum of five (5) years from the date of the last transaction on the account, in line with financial crime prevention obligations.
- Transaction Records: Retained for seven (7) years to support financial reporting, tax compliance, and audit requirements.
- Customer Support Communications: Retained for three (3) years from the date of last interaction, to support dispute resolution and service quality review.
- Technical & Usage Logs: Retained for up to twelve (12) months on active systems, then archived or deleted depending on operational needs.
- Marketing Consent Records: Retained for the duration of consent plus two (2) years after withdrawal of consent, as evidence that marketing was conducted on a lawful basis.
At the end of each applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.
08 Data Security
ba678 implements a layered technical and organisational security framework designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. The key security measures in place include:
- 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and ba678.io is encrypted using industry-standard TLS 1.2 or higher. The padlock icon visible in your browser address bar confirms this encryption is active.
- Encrypted Data Storage: Sensitive fields in ba678's database — including password hashes, identity document references, and financial account identifiers — are stored using strong encryption at rest.
- Access Controls: ba678 systems apply role-based access controls so that staff can only access personal data to the extent required by their specific job function. Access to production data is logged and audited.
- Two-Factor Authentication (2FA): Administrative access to ba678's backend systems requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their player accounts for additional security.
- Penetration Testing: ba678 commissions regular independent security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
- Incident Response: ba678 maintains a documented data breach response procedure. In the event of a security incident that compromises personal data, affected players will be notified promptly with details of the incident and the steps ba678 is taking to mitigate impact.
While ba678 applies robust technical security, no online system can guarantee complete immunity from security threats. You are responsible for maintaining the confidentiality of your own login credentials. Do not share your password with anyone, and contact ba678 support immediately if you believe your account has been compromised.
09 Your Rights Over Your Data
ba678 respects your rights in relation to the personal data we hold about you. The following rights are available to all registered players:
Your Data Rights at a Glance
Every ba678 account holder has the following rights over their personal data. Submit any data request to [email protected] with the subject line "Data Rights Request".
Right of Access
Request a copy of all personal data ba678 holds about you, along with details of how it is being processed.
Right to Rectification
Request correction of any inaccurate or incomplete personal data we hold about you. Identity changes may require supporting documentation.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purpose it was collected. Legal retention obligations may limit this right.
Right to Restriction
Request that ba678 restricts processing of your data in certain circumstances, such as while the accuracy of the data is under dispute.
Right to Portability
Receive a copy of your personal data in a structured, machine-readable format where processing is based on consent or contract performance.
Right to Object
Object to processing of your data where ba678 relies on legitimate interest as its legal basis, including profiling for platform analytics purposes.
ba678 will respond to data rights requests within 30 days of receipt. Where a request is complex or ba678 receives a high volume of requests simultaneously, this period may be extended by a further 30 days with prior notice. ba678 will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive.
10 Children & Minors
ba678 operates exclusively as an adult gambling platform. The minimum age to register and use ba678 is 21 years. ba678 does not knowingly collect personal data from any individual under the age of 21, and it is a fundamental condition of account registration that you confirm you meet this minimum age requirement.
If ba678 discovers or is informed that personal data has been collected from a person under 21, we will promptly close the relevant account, delete the associated personal data to the extent not required to be retained for AML or legal purposes, and return any deposited funds to the payment source. Any bonus winnings accrued on an underage account will be void and forfeited.
If you are a parent or guardian and believe that a person under 21 in your care has registered on ba678, please contact our support team immediately at [email protected]. We will investigate and take appropriate action as a matter of priority.
11 Third-Party Services & Links
The ba678 platform integrates with third-party game technology providers, payment processors, and analytics services as described in Section 5 of this policy. Each of these third-party services operates under its own privacy policy and terms of service. ba678 is not responsible for the data practices of third-party game providers, payment processors, or any other external service once data leaves the ba678 platform environment under the third party's independent control.
ba678.io does not contain outbound links to third-party websites. However, if you independently navigate to any external website from your browser, ba678 has no control over and assumes no responsibility for the privacy practices or content of that site.
ba678 performs due diligence on all third-party service providers before engagement and requires all data processors to execute data processing agreements that mandate compliance with appropriate security and privacy standards consistent with this policy.
12 Changes to This Privacy Policy
ba678 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The effective date shown at the top of this document will be updated whenever a material change is made.
Where changes are material — meaning they significantly alter the way ba678 processes your personal data or affect your rights — ba678 will notify registered account holders via the email address on file before the revised policy takes effect. The notification will summarise the key changes and provide a link to the updated policy in full.
Your continued use of the ba678 platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using ba678 and may request account closure by contacting support at [email protected].
13 Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way ba678 processes your personal data, please contact our dedicated privacy support team using the following details:
- Email: [email protected] — use the subject line "Privacy Enquiry" for fastest routing.
- Live Chat: Available 24 hours a day, 7 days a week via the ba678.io platform. Our support team can handle general privacy queries directly; complex data rights requests will be escalated to the privacy team.
- Response Time: ba678 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 10 business days (Bangladesh Standard Time, UTC+6).
For formal data rights requests — including access requests, erasure requests, and portability requests — please email [email protected] with the subject line "Data Rights Request" and include your registered username and a description of the specific right you wish to exercise. You may be asked to verify your identity before ba678 processes a data rights request.
Our Privacy Commitments
Six foundational principles that guide how ba678 treats every player's personal data — every day, across every interaction.
256-bit SSL Encryption
All data transmitted between your device and ba678.io is protected by industry-standard 256-bit TLS encryption. Your personal and financial information travels securely from the moment you connect.
No Data Selling
ba678 does not sell, rent, or trade your personal data to any third party for marketing or commercial gain. Your information is shared only where strictly necessary to deliver platform services or meet legal obligations.
Full Data Rights
Every ba678 player holds the right to access, correct, export, restrict, or erase their personal data. All data rights requests receive a substantive response within 30 days of receipt.
Defined Retention Limits
ba678 retains personal data only for as long as legally required or operationally necessary. Clear retention periods are defined for every data category, after which data is securely deleted or anonymised.
No Ad Tracking
ba678 does not use third-party advertising cookies or retargeting networks. Analytics data collected on-platform is anonymised and aggregated — never used to build individual advertising profiles.
24/7 Privacy Support
Our support team is available around the clock via live chat to answer privacy questions. Formal data rights requests submitted to [email protected] are handled by our dedicated privacy team within defined response windows.
Ready to Play on a Platform You Can Trust?
ba678 protects your data with the same rigour it applies to securing your funds. Explore our full game library, check out our latest promotions, or review our other policy pages for complete transparency.
Gambling involves financial risk. Play responsibly. For our full terms visit Terms & Conditions.