Privacy Policy – How 89bat Collects, Uses, and Protects Your Data

01 Introduction

This Privacy Policy is issued by 89bat ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals ("you", "the Player", "the User") who access or use the 89bat platform at https://89bat.io, including all associated sub-domains, mobile interfaces, and progressive web application variants.

89bat is committed to handling your personal information with transparency, integrity, and care. This Policy sets out, in clear formal language, the categories of personal data we collect, the purposes for which we process it, the legal basis on which we rely, the parties with whom we may share it, and the rights available to you as a data subject.

By registering an account with 89bat or by continuing to use the platform after this Policy has been published or updated, you acknowledge that you have read and understood the practices described herein. If you do not agree with any part of this Privacy Policy, you must discontinue use of the 89bat platform and may request account closure by contacting us at the address set out in Section 14.

This Privacy Policy should be read alongside the 89bat Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference.

02 Personal Data We Collect

89bat collects the following categories of personal data in connection with the operation of the platform:

2.1 Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth
• National ID card number (NID) or passport number
• Copies of identity documents submitted for KYC verification purposes
• Photograph, where contained within submitted identity documents

2.2 Contact Data

• Registered email address
• Mobile phone number (used for account verification and OTP delivery)
• Residential address in Bangladesh, including division, district, and postal code

2.3 Financial Data

• Mobile financial service account numbers (bKash, Nagad, Rocket, Upay)
• Bank account details where bank transfer is used (Dutch-Bangla Bank, BRAC Bank, City Bank, and others)
• Payment card details (Visa, Mastercard) — card numbers are processed via PCI-DSS compliant payment processors and are not stored on 89bat servers
• Deposit and withdrawal transaction history
• Account balance and wagering history

2.4 Technical Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session timestamps, login history, and session duration data
• Unique device identifiers where available
• Cookies and similar tracking technologies (see Section 9 for full details)

2.5 Behavioural and Usage Data

• Games accessed and played, including game titles, providers, and play duration
• Betting activity including markets selected, odds accepted, stakes placed, and outcomes
• Bonus and promotional offer interactions
• Customer support communications and chat logs
• Responsible gaming tool settings applied by the player (deposit limits, self-exclusion requests, etc.)

2.6 Compliance and Due Diligence Data

• Source of funds declarations where requested for enhanced due diligence
• Politically Exposed Person (PEP) status checks
• Adverse media screening results
• Records of any self-exclusion or responsible gaming interactions

03 How We Collect Personal Data

3.1 Directly From You

The majority of personal data 89bat holds is provided directly by you during the course of your use of the platform. This includes data submitted during the account registration process, data provided when completing KYC verification, data entered when making deposits or requesting withdrawals, data communicated to us when contacting customer support, and preferences set within your account dashboard.

3.2 Automatically During Platform Use

Certain technical and behavioural data is collected automatically when you access and interact with the 89bat platform. This includes server log data (IP address, browser type, pages visited, time and date of access), device fingerprint data, and cookie data as described in Section 9 of this Policy.

3.3 From Third Parties

89bat may receive personal data about you from the following categories of third party:

• Identity verification providers: Third-party KYC and document verification services that process the identity documents you submit and return a verification result to 89bat.
• Payment processors: Mobile financial service providers (bKash, Nagad, Rocket, Upay) and banking institutions that share transaction confirmation data necessary to credit your account.
• Fraud prevention and sanctions screening services: Third-party databases used to screen accounts against sanctions lists, PEP registers, and fraud watchlists.
• Analytics providers: Aggregated, anonymised or pseudonymised data from analytics platforms used to understand platform usage patterns.

04 Purposes for Which We Process Your Data

89bat processes personal data only for the specific, legitimate purposes set out in the table below. We do not process personal data for any purpose that is incompatible with the purposes stated at the time of collection.

05 Legal Basis for Processing

89bat processes personal data on the following legal bases:

5.1 Contractual Necessity

The majority of personal data processing by 89bat is necessary for the performance of the contract between 89bat and the player — namely, the Terms & Conditions accepted at registration. Without processing identity, contact, and financial data, 89bat cannot maintain your account, process transactions, or deliver the services you have requested.

5.2 Legal Obligation

89bat is required by applicable law to process certain categories of personal data. This includes anti-money laundering (AML) obligations requiring customer due diligence, age verification obligations requiring the collection and retention of identity documents, and record-keeping obligations requiring the retention of transaction data for defined minimum periods.

5.3 Legitimate Interests

89bat processes certain data on the basis of its legitimate interests where those interests are not overridden by your rights and interests. Legitimate interest processing includes: fraud and abuse detection, platform security monitoring, responsible gaming analytics, and aggregate platform performance analysis.

5.4 Consent

Where 89bat processes personal data on the basis of consent — for example, for the delivery of direct marketing communications — that consent is collected separately, explicitly, and with clear information about its purpose. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. To withdraw consent for marketing communications, update your preferences in your account dashboard or contact our support team.

06 Data Sharing and Disclosure

89bat does not sell, rent, trade, or otherwise transfer your personal data to third parties for commercial or marketing purposes. Personal data may be shared with the following categories of recipient, strictly for the purposes described in this Policy:

6.1 Service Providers and Data Processors

89bat engages third-party service providers who process personal data on our behalf under written data processing agreements that impose obligations equivalent to those in this Policy. These providers include identity verification platforms, payment processing infrastructure, customer support tooling, fraud detection services, and platform analytics services.

6.2 Game Content Providers

Third-party game studios including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe, and others may receive limited technical identifiers (e.g., an anonymised player session token) necessary to deliver their games within the 89bat platform. These providers do not receive your name, NID, financial account details, or contact information.

6.3 Payment Service Providers

To process deposits and withdrawals, 89bat must share necessary financial reference data with relevant mobile financial service providers (bKash, Nagad, Rocket, Upay) and banking institutions. This sharing is strictly limited to the transaction details required to execute or verify the specific payment.

6.4 Legal and Regulatory Authorities

89bat may be required to disclose personal data to law enforcement agencies, regulatory bodies, or other governmental authorities where required by applicable law, court order, or to protect the rights, property, or safety of 89bat, its players, or third parties. 89bat will make reasonable efforts to notify you of such disclosure unless legally prohibited from doing so.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of the 89bat platform, personal data held by 89bat may be transferred to the acquiring entity. You will be notified in advance of any such transfer, and the acquiring entity will be required to honour the commitments made in this Privacy Policy.

07 Data Retention

89bat retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 89bat's internal data destruction procedures. Anonymised or aggregated data that no longer identifies you may be retained indefinitely for analytical and business intelligence purposes.

08 Security Measures

89bat takes the security of your personal data seriously and implements a comprehensive set of technical and organisational security measures to protect it against unauthorised access, disclosure, alteration, or destruction.

8.1 Technical Safeguards

• All data transmitted between your device and the 89bat platform is encrypted using 256-bit SSL/TLS encryption
• Account passwords are stored using industry-standard one-way cryptographic hashing — they are never stored in, or accessible as, plaintext
• Payment card details are processed exclusively through PCI-DSS Level 1 compliant payment processors and are never stored on 89bat servers
• Database access is restricted via role-based access controls, ensuring that only authorised personnel and systems can access personal data
• Multi-factor authentication is enforced for all internal administrative systems that can access player data
• Regular automated and manual security vulnerability assessments are conducted on all platform components

8.2 Organisational Safeguards

• Access to personal data is granted on a strict need-to-know basis
• All staff with access to personal data are subject to confidentiality obligations and receive data protection training
• 89bat maintains a documented data breach response procedure, including notification timelines
• Third-party vendors with access to personal data are subject to security due diligence assessments prior to engagement

8.3 Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 89bat will notify affected players without undue delay after becoming aware of the breach. Notification will be provided via the email address registered to your account and will include a description of the nature of the breach, the categories of data affected, and the steps being taken to address it.

09 Cookies & Tracking Technologies

89bat uses cookies and similar tracking technologies on the platform to enable core functionality, improve the user experience, and support analytics. By continuing to use the 89bat platform, you consent to the use of cookies as described in this section.

9.1 Types of Cookies Used

9.2 Managing Cookies

You may control non-essential cookies through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or receive notifications when cookies are set. Please note that disabling strictly necessary cookies will impair the functionality of the 89bat platform, including the ability to maintain a logged-in session. Instructions for managing cookies in common browsers are available in the Help section of each browser.

10 Your Data Subject Rights

Subject to applicable law and any overriding legal obligations that may require 89bat to retain or continue processing certain data, you have the following rights in relation to your personal data held by 89bat:

10.1 Right of Access

You have the right to request a copy of the personal data that 89bat holds about you. Access requests will be fulfilled within thirty (30) calendar days of receipt of a verified request. The first copy is provided free of charge; subsequent requests within a twelve-month period may incur a reasonable administrative fee.

10.2 Right to Rectification

If you believe that any personal data held by 89bat is inaccurate or incomplete, you have the right to request its correction. For identity data changes, updated supporting documentation may be required. Rectification requests will be actioned within fourteen (14) calendar days.

10.3 Right to Erasure

You may request the deletion of your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal basis for processing; or the data has been unlawfully processed. Note that 89bat may be required to retain certain data for the minimum periods described in Section 7 regardless of an erasure request, particularly where legal or regulatory obligations apply.

10.4 Right to Restriction of Processing

You may request that 89bat restricts the processing of your personal data in certain circumstances, such as while the accuracy of data is being contested or while an objection to processing is being considered.

10.5 Right to Data Portability

Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another service provider where technically feasible.

10.6 Right to Object

You have the right to object to processing of your personal data where that processing is based on legitimate interests. 89bat will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

10.7 Rights Related to Automated Decision-Making

Where 89bat makes decisions that have a significant legal or similarly significant effect on you through solely automated processing — for example, automated account suspension triggered by fraud detection systems — you have the right to request human review of that decision and to contest the outcome by contacting our support team.

11 Children's Privacy

The 89bat platform is strictly intended for persons aged 21 years or older. 89bat does not knowingly collect personal data from individuals under the age of 21. All account registrations are subject to age verification as part of the KYC process.

If 89bat becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, that data will be deleted immediately, the associated account will be closed, and any deposits will be returned to the originating payment source.

If you are the parent or guardian of a minor and believe that your child has provided personal data to 89bat, please contact us immediately at the address provided in Section 14. We take underage gambling prevention extremely seriously and will act promptly on any such notification.

12 Third-Party Services and Links

The 89bat platform may contain references to third-party game providers, payment service partners, and other external services. This Privacy Policy applies exclusively to personal data processed by 89bat. It does not extend to the privacy practices of third-party service providers, payment processors, or game studios.

Each third-party provider with whom 89bat shares data under Section 6 operates under its own privacy policy and data protection obligations. 89bat selects service providers that meet appropriate data protection standards, but bears no responsibility for the independent privacy practices of those parties in respect of data processed outside the 89bat platform.

Where 89bat's platform integrates game content from studios such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, or Spribe, those studios process game session data under their own terms. 89bat ensures contractually that such data sharing is limited to the minimum necessary for game delivery and does not include sensitive personal or financial data.

13 Amendments to This Privacy Policy

89bat reserves the right to amend or update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. The effective date at the top of this Policy indicates when the current version came into force.

Where material changes are made to this Privacy Policy, 89bat will notify registered players via their registered email address and/or via a prominent notice on the platform no fewer than seven (7) days before the changes take effect. Non-material changes (such as clarifications, grammatical corrections, or formatting adjustments) may be made without advance notice.

Your continued use of the 89bat platform following the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you should discontinue use of the platform and may request account closure under Section 9.2 of the Terms & Conditions.

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which 89bat processes your personal data, please contact our dedicated privacy support team. All privacy-related enquiries are handled in English and responded to within five (5) business days during normal Bangladesh Standard Time (BST, UTC+6) operating hours.

When submitting a data subject rights request (Section 10), please include your registered email address and a brief description of your request so that we may verify your identity and route your request to the appropriate team promptly.

If you believe that 89bat has not adequately addressed your privacy concern, you have the right to escalate your complaint to the appropriate data protection authority in your jurisdiction. 89bat will cooperate fully with any such authority in the investigation of a complaint.