baba8 Privacy Policy

1 Introduction

baba8 ("we", "us", "our") operates the online casino and sports betting platform accessible at https://baba8.io (the "Platform"). We are committed to protecting the privacy and personal data of every individual who interacts with our Platform, whether as a registered player, a visitor browsing our game lobby, or a person contacting our support team.

This Privacy Policy describes in plain, straightforward English what personal data we collect, the purposes for which we collect and use that data, the legal bases on which we rely to process it, the parties with whom we may share it, and the rights you have over your own information. We encourage all baba8 players based in Bangladesh to read this document in full before registering an Account.

This Privacy Policy forms part of the baba8 Terms & Conditions. By registering an Account or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein.

2 Definitions

The following definitions apply throughout this Privacy Policy. Where context requires, singular terms include the plural and vice versa.

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including but not limited to name, date of birth, email address, mobile number, payment method details, device identifiers, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, deletion, and destruction.
• "Data Controller" means baba8, which determines the purposes and means of Processing Personal Data collected via the Platform.
• "Data Processor" means a third party that Processes Personal Data on behalf of baba8, such as a payment processor or cloud hosting provider, under a contractual obligation to baba8.
• "Player" means any individual who has registered a baba8 Account or is using the Platform in any capacity.
• "KYC Data" means identity and age verification documents and information submitted by a Player as part of the Know Your Customer process.
• "Cookies" means small text files placed on a Player's device by the Platform for the purposes described in Section 8 of this Policy.
• "BST" means Bangladesh Standard Time, UTC+6, the reference time zone for all Platform operations and data retention schedules.

3 Data We Collect

3.1 Registration Data

When you create a baba8 Account, we collect the following information: your full legal name, date of birth, residential address (including city — for example, Dhaka, Chittagong, Sylhet, or Khulna), email address, and mobile phone number. You also create a username and password at the time of registration.

3.2 KYC Verification Data

To comply with our age verification and anti-money laundering (AML) obligations, we collect copies of government-issued photo identification (National ID card, passport, or driving licence), proof of address documents (utility bills, bank statements, or official government correspondence), and proof of ownership of the payment method used for deposits (for example, a screenshot of your registered bKash or Nagad account showing your name and mobile number).

3.3 Financial Data

We collect transaction records associated with your Account, including deposit amounts, withdrawal requests, payment method identifiers (mobile wallet numbers, bank account references — but never full card numbers in plaintext), transaction timestamps, and your Account balance history. We do not store full payment card numbers on our servers; card transactions are tokenised by the relevant payment processor.

3.4 Gameplay & Betting Data

We record all game sessions, bets placed, stakes, outcomes, bonus activations, wagering progress, and session durations associated with your Account. This data is used for account management, dispute resolution, responsible gaming monitoring, and game provider settlement.

3.5 Technical & Device Data

We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device type and identifiers, screen resolution, time zone, referring URL, pages visited, and session duration. This data is collected via server logs and cookies as described in Section 8.

3.6 Communications Data

We retain records of all communications between you and baba8, including live chat transcripts, support ticket content, email correspondence, and any responsible gaming communications. These records are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

3.7 Responsible Gaming Data

Where you use baba8's responsible gaming tools — including deposit limits, loss limits, session time limits, cool-off periods, or self-exclusion — we record the parameters you set and the dates on which those settings were applied or modified. This data is treated with the highest level of confidentiality.

4 How We Collect Data

baba8 collects Personal Data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact support, or update your account settings;
• Automatically via the Platform — through server logs, session tracking, and cookies when you access the baba8 website or mobile-optimised interface;
• From payment providers — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard may share transaction confirmation data with us to verify deposits and facilitate withdrawals;
• From Game Providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other game studios share game session data (stakes, outcomes, session IDs) with us for account settlement and dispute resolution;
• From fraud prevention and identity verification services — we may use third-party KYC and AML screening services that cross-reference submitted documents against identity databases to verify authenticity and detect financial crime;
• From publicly available sources — in limited circumstances related to AML compliance, we may reference publicly available information (for example, sanctions lists or politically exposed persons databases) to fulfil our obligations.

5 How We Use Your Data

baba8 uses the Personal Data we collect for the following purposes:

6 Legal Basis for Processing

baba8 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity — Processing that is required to perform our contract with you as a registered player, including account management, payment processing, and delivering the games and betting services you request;
• Legal obligation — Processing that is required to comply with applicable law, including KYC/AML obligations, age verification requirements, and responses to lawful requests from regulatory or law enforcement authorities;
• Legitimate interests — Processing that serves baba8's legitimate business interests, such as fraud prevention, platform security, responsible gaming monitoring, and improving our services, provided that those interests are not overridden by your fundamental rights and freedoms;
• Consent — Where we rely on consent as the legal basis (for example, sending you promotional communications about bonuses, seasonal offers, or new games), you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent to marketing communications, update your preferences in your account settings or contact support.

7 Data Sharing & Disclosure

7.1 Sharing with Game Providers

To deliver the games available on the Platform, baba8 shares necessary session data (account identifiers, stake amounts, session tokens) with our Game Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers act as Data Processors under contractual arrangements that require them to handle your data solely for the purpose of delivering their games to baba8 players and to maintain appropriate security standards.

7.2 Sharing with Payment Processors

To process deposits and withdrawals, baba8 shares necessary financial and identity data with approved payment providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Each payment provider processes your data under their own privacy policy and applicable financial regulations.

7.3 Sharing with KYC and AML Service Providers

baba8 uses reputable third-party identity verification and AML screening services to fulfil our legal obligations. These providers act as Data Processors and are contractually required to use your data only for the verification purposes specified by baba8.

7.4 Sharing with Cloud and Hosting Providers

baba8's Platform infrastructure is hosted on secure cloud servers. Our hosting providers act as Data Processors and do not have independent access to the content of your data beyond what is technically necessary to provide hosting services.

7.5 Disclosure to Authorities

baba8 may disclose Personal Data to law enforcement agencies, regulatory bodies, or other government authorities where required to do so by applicable law, court order, or lawful regulatory request. We will notify affected players of such disclosures where permitted to do so by law.

7.6 No Sale of Personal Data

baba8 does not sell, rent, trade, or otherwise transfer your Personal Data to unaffiliated third parties for their own marketing, advertising, or commercial purposes. Any third-party data sharing is limited strictly to the categories described above and is governed by appropriate data processing agreements.

8 Cookies & Tracking

8.1 What Are Cookies

Cookies are small text files stored on your device by your browser when you visit the baba8 Platform. They enable the Platform to recognise your device across sessions, maintain your login state, and remember your preferences. Cookies do not contain executable code and cannot access other files on your device.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies — Essential to the operation of the Platform. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional Cookies — Remember your preferences such as language settings, display options, and responsible gaming settings so that you do not need to re-enter them on every visit.
• Analytics Cookies — Used to understand how players use the Platform — which pages are visited most frequently, where players encounter errors, and how navigation flows work. This data is aggregated and anonymised wherever possible. We use this data solely to improve Platform performance and user experience.
• Fraud Prevention Cookies — Used in conjunction with our fraud and AML monitoring systems to detect unusual access patterns, duplicate account attempts, and suspicious activity.

8.3 Managing Cookies

You can control or delete cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use core Platform features including logging in and placing bets. Instructions for managing cookies in major browsers are available from each browser's help documentation. baba8 does not currently respond to "Do Not Track" browser signals.

9 Data Retention

baba8 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, or to resolve disputes and enforce our agreements. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to any individual.

10 Data Security

baba8 applies a layered approach to data security, combining technical, organisational, and procedural controls to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction.

10.1 Technical Measures

• 256-bit SSL/TLS encryption on all data transmitted between your device and the baba8 Platform;
• One-way cryptographic hashing for all stored account passwords — your password is never stored in readable form;
• Payment card tokenisation — full card numbers are processed by PCI-DSS-compliant payment processors and never stored on baba8's servers;
• Role-based access controls — internal access to Personal Data is restricted to staff members who require it to perform their specific job function;
• Intrusion detection and monitoring systems — our infrastructure is continuously monitored for anomalous access patterns and potential security incidents;
• Regular security audits and penetration testing by independent security professionals.

10.2 Organisational Measures

All baba8 staff who handle Personal Data receive regular data protection training. Access credentials are subject to periodic review and rotation. A clear data breach response procedure is in place, and in the event of a significant breach affecting player data, affected players will be notified promptly.

11 Your Rights

As a baba8 player, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team using the details in Section 15. We will respond to verified requests within a reasonable timeframe.

• Right of Access — You have the right to request a copy of the Personal Data we hold about you, together with information about how that data is being used.
• Right to Rectification — If any of the Personal Data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For basic account details (email, mobile number, address), you can update information directly in your account settings or by contacting support.
• Right to Erasure — In certain circumstances, you have the right to request the deletion of your Personal Data. Note that this right is subject to our overriding legal obligations: we cannot delete data that we are required to retain under AML, tax, or regulatory law for the retention periods specified in Section 9.
• Right to Restriction — In certain circumstances, you have the right to request that we restrict the Processing of your Personal Data (for example, while a rectification request is being assessed).
• Right to Data Portability — You have the right to receive a copy of the Personal Data you have provided to us in a structured, commonly used, machine-readable format.
• Right to Object — You have the right to object to Processing based on legitimate interests, including profiling for responsible gaming purposes. Where you object, we will cease Processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent — Where Processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior Processing.

12 Children & Minors

The baba8 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. If we discover or are made aware that a Player is under 21 years of age, we will immediately suspend the Account, void any winnings, return any deposits made, and permanently delete the associated Personal Data to the extent permitted by our legal obligations.

If you are a parent or guardian and believe that a minor under your care has registered a baba8 Account, please contact [email protected] (plain text) immediately. We take underage access extremely seriously and will act on all credible reports with urgency.

13 Third-Party Links

The baba8 Platform may contain references to third-party game providers, payment methods, or other services. While game provider interfaces are embedded within the Platform under contractual arrangements, any third-party website you navigate to independently operates under its own privacy policy, which baba8 does not control. baba8 is not responsible for the privacy practices of third-party websites and encourages all players to review the privacy policies of any third-party service they use.

14 Policy Updates

baba8 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Material changes will be communicated to registered players via a notice displayed prominently on the Platform and, where practicable, via email to the registered address on the Account.

The effective date of the current version of this Privacy Policy is stated at the top of this document. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with a material change, you should cease using the Platform and request Account closure before the effective date of the change.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way baba8 handles your Personal Data, please contact our support team using the details below. All data protection queries are handled in English, 24 hours a day, 7 days a week, 365 days a year, all times Bangladesh Standard Time (BST, UTC+6).

Email (plain text — not a clickable link): [email protected]

Live Chat: Available from your Account dashboard — average response time under 2 minutes.