ball8 Privacy Policy —
Your Data, Handled with Care

1 Who We Are

1.1 ball8 ("we", "us", "our") operates the online casino, sports betting, and card gaming platform accessible at ball8.io (the "Platform"). ball8 is the data controller responsible for the personal data collected and processed through the Platform.

1.2 The Platform is directed at adult players (aged 21 and above) located in Bangladesh. All services are delivered in English. For the purposes of this Privacy Policy, references to "you" or "your" mean any individual who accesses the Platform, registers an account, or otherwise interacts with our services.

1.3 Our designated data privacy contact can be reached at: [email protected]. Privacy-related queries and data rights requests submitted to this address are handled by our dedicated privacy team and acknowledged within 24 hours (Bangladesh Standard Time, UTC+6).

2 Data We Collect

ball8 collects personal data in the following categories. We collect only the data that is necessary for the purposes described in Section 4.

2.1 Identity and Contact Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (used for mandatory age verification — 21+ only)
• Residential address, including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or otherwise) and postal code
• Email address used for account registration and communications
• Mobile phone number associated with your bKash, Nagad, or Rocket mobile financial service account
• Copies of identity documents submitted for KYC verification (National Identity Card, passport, or driving licence)

2.2 Account and Transaction Data

• Account username and encrypted password hash
• Account registration date and time
• Wallet balance history, deposit records, and withdrawal records denominated in BDT
• Payment method identifiers (e.g., bKash account number — stored in masked form only; full payment credentials are never stored on ball8 servers)
• Bonus claims, wagering history, and promotion participation records
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

2.3 Gaming and Betting Activity Data

• Game session logs including game titles played, stakes placed, and outcomes
• Sports betting wager records including market selected, odds accepted, stake, and settlement result
• Pool Rummy and card game hand histories
• In-platform communication logs (e.g., live chat with support agents)

2.4 Technical and Device Data

• IP address at the time of each login and each transaction
• Device type, operating system, and browser type and version
• Session duration and navigation path within the Platform
• Cookie identifiers and similar tracking technology data (see Section 7)
• Geolocation data derived from IP address (country and city level only — precise GPS location is not collected)

2.5 Communications Data

• Content and metadata of emails, live chat messages, and support tickets exchanged with the ball8 support team
• Survey responses and player feedback submissions
• Marketing communication preferences and opt-in or opt-out records

The table below summarises the primary data categories and their principal collection purpose:

3 How We Collect Data

3.1 Directly from you: The majority of personal data ball8 holds is provided directly by you during account registration, KYC submission, deposit and withdrawal requests, support interactions, and survey or feedback submissions.

3.2 Automatically through your use of the Platform: Technical and device data (IP address, browser type, session logs, cookie identifiers) is collected automatically as you navigate the Platform. This collection is inherent to the operation of any web-based service and does not require affirmative action on your part.

3.3 From third-party service providers: ball8 may receive supplementary data from identity verification providers engaged to assist with KYC compliance, and from payment processors (bKash, Nagad, Rocket, Upay) who confirm the status and outcome of payment transactions. Data received from these third parties is limited to what is strictly necessary for the purpose of the engagement.

3.4 From fraud prevention and security services: To protect the integrity of the Platform and the safety of all players, ball8 may receive risk-scoring data from automated fraud detection systems. This data is used solely for account security purposes.

4 How We Use Your Data

ball8 uses personal data for the following purposes:

• Account management: Creating and maintaining your account, verifying your identity and age, managing your wallet balance, and processing deposits and withdrawals via bKash, Nagad, Rocket, and Upay.
• Service delivery: Providing access to casino games, cricket betting markets, sports wagering, Pool Rummy tables, and all other Platform features you elect to use.
• KYC and compliance: Verifying that you meet the minimum age requirement (21+), confirming your identity before processing withdrawals, and fulfilling obligations under applicable anti-money-laundering and fraud-prevention frameworks.
• Responsible gaming: Monitoring account activity to identify patterns consistent with problem gambling, enforcing player-set deposit and session limits, administering self-exclusion requests, and proactively reaching out to players who may need support.
• Customer support: Responding to your queries, complaints, and support requests via live chat and email, maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Security and fraud prevention: Detecting and preventing unauthorised access, bonus abuse, collusion, money laundering, and other prohibited activities as defined in ball8's Terms & Conditions.
• Platform improvement: Analysing aggregated, anonymised usage data to improve game selection, site navigation, and the overall player experience. Individual players are not identified in this analysis.
• Marketing communications: Sending promotional emails, bonus notifications, and platform updates to players who have opted in to receive such communications. Players may withdraw this consent at any time by using the unsubscribe link in any marketing email or by contacting support.
• Legal compliance: Retaining records as required by applicable law and responding to lawful requests from competent authorities.

5 Legal Bases for Processing

5.1 ball8 processes personal data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing your identity data, transaction data, and gaming activity data is necessary to perform the contract between ball8 and you (i.e., to operate your account and deliver the services you have requested).
• Legal obligation: Processing for KYC verification, age verification, anti-money-laundering checks, and retention of transaction records is required to comply with applicable legal and regulatory requirements.
• Legitimate interests: Processing technical and device data for security monitoring, fraud prevention, and platform optimisation is carried out on the basis of ball8's legitimate interest in protecting its platform and its players, provided that interest is not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications is carried out only where you have given your express consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Sharing Your Data

6.1 ball8 does not sell, rent, or trade personal data to any third party for commercial or marketing purposes. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

6.1 Payment Service Providers

To process your deposits and withdrawals, ball8 shares necessary transaction data with your chosen payment provider (bKash, Nagad, Rocket, or Upay). Each of these providers operates under its own privacy policy and applicable financial services regulations. Data shared is limited to what is required to execute and confirm the transaction.

6.2 Identity Verification Providers

To fulfil KYC obligations, ball8 may share identity documents and personal details with third-party identity verification service providers. These providers are contractually required to maintain data security standards equivalent to those described in this policy and to use the data solely for the purpose of identity verification.

6.3 Fraud Prevention and Security Services

ball8 may share technical data (such as IP addresses and device fingerprints) with fraud detection services to identify and prevent prohibited activity on the Platform. This sharing is carried out on the basis of ball8's legitimate interest in maintaining a safe and fair gaming environment.

6.4 Legal and Regulatory Authorities

ball8 may disclose personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or other binding legal process. In such cases, ball8 will disclose only the data specifically requested and will, where legally permissible, notify the affected player of the disclosure.

6.5 Business Transfers

In the event that ball8 undergoes a merger, acquisition, or transfer of substantially all of its assets, personal data held by ball8 may be transferred to the successor entity. Affected players will be notified in advance of any such transfer, and the successor entity will be bound to honour the commitments made in this Privacy Policy.

7 Cookies & Tracking Technologies

7.1 ball8 uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate the Platform efficiently and to improve your experience. Cookies are small text files stored on your device by your browser.

7.2 The following categories of cookies are used on the Platform:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens that keep you logged in during your visit and security cookies that protect your account from cross-site request forgery attacks. These cookies cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings and responsible gaming tool configurations so you do not need to re-enter them on each visit.
• Analytics cookies: Used in aggregated, anonymised form to understand how players navigate the Platform, which games are most popular, and where technical issues may arise. This data helps ball8 improve the Platform experience.
• Marketing cookies: Used only where you have consented to receive marketing communications. These cookies help ball8 present relevant promotional content based on your platform activity.

7.3 You may manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will impair or prevent your use of the Platform. Disabling functional or analytics cookies will reduce the quality of your experience but will not prevent access.

8 Data Security

8.1 ball8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and ball8's servers
• Encrypted storage of sensitive personal data at rest, including identity documents and password hashes
• Role-based access controls ensuring that only authorised ball8 personnel can access personal data, and only to the extent required for their specific role
• Regular security audits and vulnerability assessments of the Platform infrastructure
• Intrusion detection systems and real-time monitoring of unusual access patterns
• Secure data centres with physical access controls

8.2 Notwithstanding the above, no internet-based platform can guarantee absolute security against all possible threats. Players are encouraged to take their own security precautions, including using a strong, unique password for their ball8 account and enabling two-factor authentication (2FA) where available.

8.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ball8 will notify affected players without undue delay via the email address held on their account, and will take immediate steps to contain and remediate the breach.

9 Data Retention

9.1 ball8 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, as set out in the following retention schedule:

• Account and identity data: Retained for the duration of your active account relationship with ball8, plus a minimum of 5 years following account closure to comply with applicable anti-money-laundering record-keeping requirements.
• Transaction and wallet records: Retained for a minimum of 5 years from the date of each transaction to satisfy financial record-keeping obligations.
• KYC documents: Retained for the duration of the account relationship plus 5 years post-closure. Copies are stored in encrypted form.
• Gaming and betting activity logs: Retained for 2 years from the date of activity for responsible gaming monitoring and dispute resolution purposes, then anonymised.
• Support communications: Retained for 2 years from the date of the last communication in a given thread, then deleted.
• Marketing consent records: Retained for the duration of your active consent plus 1 year after withdrawal of consent, to demonstrate compliance with consent obligations.
• Technical and device data: Retained for up to 12 months from collection, then deleted or anonymised for aggregate analytics.

9.2 Where personal data is no longer required, ball8 will either securely delete it or anonymise it such that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical purposes.

10 Your Data Rights

10.1 As a ball8 player, you have the following rights with respect to your personal data. These rights are summarised in the grid above and described in detail below:

• Right of access: You may request a copy of all personal data ball8 holds about you. We will provide this in a commonly used format within 30 days of a verified request, free of charge.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. Corrections to account data can often be made directly through the account dashboard.
• Right to erasure ("right to be forgotten"): You may request deletion of personal data that is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing. Please note that this right is subject to legal retention obligations — we may be required to retain certain data regardless of an erasure request.
• Right to restriction of processing: You may ask us to pause processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or while an objection request is assessed.
• Right to data portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to a different service provider.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease direct marketing immediately upon receiving your objection.
• Rights related to automated decision-making: If any decision that significantly affects you is made solely by automated means, you have the right to request human review of that decision.

10.2 To exercise any of the above rights, contact ball8's privacy team at: [email protected]. We will acknowledge your request within 24 hours and provide a substantive response within 30 days. In complex cases, we may extend this period by a further 30 days with prior notice.

10.3 We may need to verify your identity before processing a data rights request to ensure that we do not disclose or modify another person's data. You may be asked to provide a copy of your identity document as part of this verification.

11 Children's Privacy

11.1 The ball8 Platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If we discover or are notified that we have inadvertently collected personal data from a person under 21, we will immediately suspend the relevant account, delete all associated personal data, and return any deposited funds to the original payment method.

11.2 If you are a parent or guardian and believe that your child has registered an account on ball8, please contact our support team immediately at [email protected] so that we can take prompt action.

12 Third-Party Links

12.1 The ball8 Platform does not contain links to third-party websites as a general practice. In the limited circumstances where a reference to a third-party service is made (for example, a payment provider's own help documentation), ball8 is not responsible for the privacy practices of that third party. Players who navigate to any third-party website do so at their own discretion and should review the relevant privacy policy of that site directly.

13 Policy Updates

13.1 ball8 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. The effective date at the top of this page will be updated with each revision.

13.2 Where a change is material — meaning it significantly affects the nature, scope, or purpose of data processing — ball8 will notify all registered players via the email address held on their account at least 14 days before the change takes effect. This gives players adequate time to review the updated policy and, if they do not agree, to contact support to close their account before the new terms apply.

13.3 For minor or administrative updates (such as clarifications of existing practices, corrections of typographical errors, or adjustments to contact details), notification by email is not required. The updated policy will be published on this page and the effective date revised accordingly.

14 Contact Us

14.1 For any questions, concerns, or requests relating to this Privacy Policy or to the personal data ball8 holds about you, please contact our privacy team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via your logged-in account dashboard
• Response Time: Acknowledgement within 24 hours (Bangladesh Standard Time, UTC+6); substantive response within 30 days

14.2 If you are not satisfied with ball8's response to a privacy concern, you may have the right to escalate your complaint to a relevant supervisory authority in your jurisdiction.