bad8 Privacy Policy

1 Who We Are

bad8 operates the online gambling platform accessible at bad8.io (the "Platform"). References to "bad8", "we", "us", or "our" in this Privacy Policy refer to the operator of the bad8 Platform. bad8 is the data controller in respect of personal data collected through the Platform.

This Privacy Policy applies to all personal data collected from individuals who visit, register on, or otherwise interact with the bad8 Platform, including players located in Bangladesh and other regions where the Platform is lawfully accessible. It applies regardless of the device used to access the Platform — desktop, mobile browser, or any other interface.

This Privacy Policy should be read alongside the bad8 Terms & Conditions and the Responsible Gaming Policy, both of which form part of the agreement between you and bad8.

2 Data We Collect

bad8 collects the following categories of personal data, depending on how you interact with the Platform:

2.1 Registration Data

When you create a bad8 Account, you provide us with your full legal name, date of birth, country of residence, email address, and a chosen username. This data is required to open and maintain your Account. Providing inaccurate registration data is a breach of the bad8 Terms & Conditions.

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, bad8 may request copies of identity documents (such as a Bangladesh National Identity Card, passport, or driver's licence), proof of address, and verification of the payment methods used to fund your Account. KYC data is processed by bad8's compliance team and, where applicable, by authorised third-party identity verification service providers operating under strict data processing agreements.

2.3 Financial and Transaction Data

bad8 records all deposits, withdrawals, bonus transactions, and game wager activity associated with your Account. For mobile banking transactions (bKash, Nagad, Rocket, Upay), we receive confirmation data from the payment provider but do not store full mobile account credentials. For bank transfer transactions (Dutch-Bangla Bank, BRAC Bank, City Bank, and others), we store the account name, bank name, and transaction reference necessary to process and reconcile your payment.

2.4 Usage and Technical Data

When you access the Platform, our servers automatically collect technical data including your IP address, device type, operating system, browser type and version, referral URL, pages visited, session duration, and in-game activity logs. This data is used to ensure Platform security, diagnose technical issues, and analyse aggregate usage patterns to improve the Platform.

2.5 Communications Data

If you contact bad8's customer support team via email or live chat, we retain a record of that correspondence, including the content of messages and any attachments you provide. This data allows bad8 to maintain a consistent service history and resolve disputes accurately.

2.6 Voluntary Survey and Feedback Data

If you participate in optional player surveys, promotions, or feedback programmes, we collect the information you choose to provide in those contexts. Participation in surveys is always voluntary and non-participation has no effect on your Account status.

3 How We Use Your Data

bad8 uses the personal data it collects for the following purposes:

• Account management: Creating, maintaining, and securing your bad8 Account, including verifying your identity, processing login requests, and enforcing account-level restrictions such as self-exclusion or deposit limits.
• Payment processing: Facilitating deposits and withdrawals through supported Bangladeshi payment methods including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank. Transaction data is shared with payment processors solely to complete the relevant financial instruction.
• Regulatory compliance: Meeting our anti-money laundering (AML) obligations, conducting KYC verification, monitoring for suspicious financial activity, and responding to lawful requests from regulatory or law-enforcement authorities.
• Responsible gaming: Monitoring account activity for signs of problem gambling behaviour, applying and enforcing player-requested tools such as deposit limits, cooling-off periods, and self-exclusion, and communicating with players who may be at risk.
• Platform security: Detecting and preventing fraud, collusion, bonus abuse, money laundering, and other prohibited conduct. Technical and usage data is analysed by our security team to identify abnormal activity patterns.
• Customer support: Responding to your enquiries, resolving account disputes, and maintaining a service history to ensure consistency and quality of support interactions.
• Platform improvement: Analysing aggregate usage data (in anonymised or pseudonymised form) to improve Platform performance, game offerings, user experience, and the quality of our customer support service.
• Marketing communications: Sending you promotional offers, bonus notifications, and updates about new games or features — but only where you have given valid marketing consent. See Section 10 for full details on how to manage your marketing preferences.

bad8 does not use your personal data for automated individual decision-making that produces significant legal or similarly significant effects on you, unless we have your explicit consent or are required to do so by applicable law.

4 Legal Basis for Processing

bad8 processes your personal data on the following legal grounds:

5 Sharing Your Data

bad8 does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances and only to the minimum extent necessary:

• Payment service providers: Mobile banking operators (bKash, Nagad, Rocket, Upay) and banking partners (Dutch-Bangla Bank, BRAC Bank, City Bank, and others) receive transaction data required to process deposits and withdrawals. These providers operate under their own privacy frameworks and are independent data controllers in respect of the data they handle within their own systems.
• KYC and identity verification partners: Where bad8 uses a third-party service to assist with identity document verification, that partner receives only the specific data required to complete the verification check and operates under a data processing agreement with bad8.
• Game providers: When you launch a game hosted by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), a session token and the minimum necessary Account data is shared with the provider's game server to initiate and authenticate your game session. Game providers do not receive your full personal profile or financial data beyond what is required for session management.
• Regulatory and law-enforcement authorities: bad8 may disclose personal data to government bodies, regulators, or law-enforcement agencies where required to do so by applicable law, court order, or regulatory directive. bad8 will, where legally permissible, notify the affected player of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bad8's business, player data may be transferred to the acquiring entity as part of that transaction. Players will be notified via the email address on their Account before their data is transferred to a new controller, and will have the opportunity to close their Account if they do not wish their data to be transferred.

All third-party service providers who process personal data on bad8's behalf are required to maintain appropriate technical and organisational security measures and to process data only in accordance with bad8's instructions.

6 Cookies and Tracking Technologies

bad8 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: These cookies are required for the Platform to function correctly. They maintain your login session, remember your Account preferences, and ensure that security features operate as intended. These cookies cannot be disabled without rendering parts of the Platform non-functional.
• Performance and analytics cookies: bad8 uses first-party analytics tools to collect aggregated, anonymised data about how players navigate the Platform — which pages are visited most frequently, where players encounter errors, and how long sessions typically last. This data is used solely to improve the Platform experience and is not linked to individual player identities in any reports.
• Functionality cookies: These cookies remember your Platform preferences such as language settings (English), display preferences, and whether you have dismissed certain notifications. They improve your experience by reducing the need to reconfigure settings on each visit.

bad8 does not use third-party advertising cookies or cross-site tracking pixels. We do not share cookie-derived data with advertising networks or social media platforms.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in to the Platform and use Account features. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

7 Data Security

bad8 implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure:

• Transport encryption: All data transmitted between your device and bad8.io is encrypted using TLS 1.2 or higher (commonly referred to as 256-bit SSL encryption). This applies to login sessions, game sessions, payment flows, and customer support interactions.
• Password hashing: Player passwords are never stored in plain text. They are processed through a modern cryptographic hashing algorithm with unique salts per user, ensuring that even in the unlikely event of a data breach, plaintext passwords are not exposed.
• Access controls: Internal access to personal data is restricted to authorised bad8 staff and contractors who require it to perform their specific job functions. Access rights are reviewed periodically and revoked immediately upon role change or termination.
• Infrastructure security: bad8's Platform is hosted on infrastructure that employs firewalls, intrusion detection systems, and regular security patching. Penetration testing is conducted periodically by qualified security professionals.
• Incident response: bad8 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to player rights, affected players will be notified promptly with details of the nature of the breach and the remediation steps taken.

8 Data Retention

bad8 retains personal data for the period necessary to fulfil the purpose for which it was collected, subject to the following specific retention guidelines:

• Active Account data: While your Account remains active, bad8 retains all Account, transaction, and game-activity data in full. This data is necessary to operate your Account, process transactions, and maintain an accurate service history.
• Post-closure retention: Following Account closure (whether initiated by you or by bad8), bad8 retains core Account and transaction records for a period of five (5) years from the closure date. This retention period is necessary to meet anti-money laundering record-keeping obligations, to resolve any disputes that may arise after closure, and to support regulatory audits.
• KYC documents: Identity verification documents submitted as part of the KYC process are retained for the same five-year post-closure period for AML compliance purposes. After this period, KYC documents are securely deleted.
• Customer support records: Correspondence with bad8's customer support team is retained for three (3) years from the date of the last interaction, or for the post-closure retention period if the Account is closed, whichever is longer.
• Marketing consent records: Records of marketing consent (including the date and method of consent) are retained for as long as you are a registered player and for one (1) year after Account closure, to demonstrate compliance with consent requirements.
• Technical and usage logs: Server and access logs containing IP addresses and session data are retained for a maximum of thirteen (13) months, after which they are deleted or anonymised.

At the end of the applicable retention period, personal data is either securely deleted from bad8's systems or rendered permanently anonymous such that it can no longer be attributed to any individual player.

9 Your Rights

As a bad8 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact bad8's support team at [email protected] with the subject line "DATA RIGHTS REQUEST". We will respond within 30 days of receiving a valid request.

• Right of access: You have the right to request a copy of the personal data bad8 holds about you, together with information about how it is used and with whom it has been shared. We will provide this information in a clear, structured format.
• Right to rectification: If any personal data bad8 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For name or date-of-birth corrections, we may require documentary evidence to verify the requested change.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where: the data is no longer necessary for the purpose for which it was collected; you have withdrawn consent and there is no other legal basis for processing; or the data has been unlawfully processed. Note that this right does not apply where bad8 is required by law to retain the data (for example, KYC and transaction records required under AML obligations).
• Right to restriction of processing: You may request that bad8 restrict the processing of your personal data in certain circumstances — for example, while we are verifying the accuracy of data you have contested, or where you have objected to processing and we are considering that objection.
• Right to data portability: Where we process your data on the basis of consent or contract, and the processing is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes, which we will action immediately upon receipt of your objection.
• Right to withdraw consent: Where processing is based on your consent (principally marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

bad8 will not charge a fee for responding to a data rights request unless the request is manifestly unfounded or excessive. In such cases, bad8 will notify you of the applicable fee before proceeding.

10 Marketing Communications

bad8 may send you promotional communications — including bonus offers, free spin notifications, reload promotions, and information about new game releases — by email or in-platform notification, but only where you have provided valid marketing consent.

Marketing consent is collected during Account registration via a clearly labelled opt-in checkbox. The checkbox is unchecked by default; consent is only recorded when you actively check it.

You may withdraw marketing consent at any time by:

• Updating your notification preferences in your Account settings page.
• Clicking the unsubscribe link included in any marketing email sent by bad8.
• Emailing [email protected] with the subject line "UNSUBSCRIBE".

Withdrawal of marketing consent takes effect within 5 business days. Please note that withdrawal of marketing consent does not affect transactional communications — bad8 will continue to send you Account-related emails such as deposit confirmations, withdrawal notifications, password reset emails, and important policy updates regardless of your marketing preference, as these communications are necessary for the operation of your Account.

11 Children and Minors

The bad8 Platform is strictly for adults aged 21 years and over. bad8 does not knowingly collect personal data from individuals under the age of 21. Any Account found to belong to a person under 21 years of age will be closed immediately and all associated balances will be forfeited in accordance with bad8's Terms & Conditions and applicable legal obligations.

If a parent or guardian believes that their child has registered on the bad8 Platform, they should contact [email protected] immediately. bad8 will investigate the matter and take appropriate action, including permanently closing the Account and deleting all associated personal data.

bad8 actively employs age verification measures during the registration process and may request additional documentary proof of age at any stage. We are committed to preventing underage gambling and take our responsibilities in this area with the utmost seriousness.

12 Changes to This Privacy Policy

bad8 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, bad8 will notify registered players via the email address associated with their Account and/or through a prominent notice displayed on the Platform, at least 7 days before the revised policy takes effect.

The version number and effective date displayed at the top of this document reflect the most recent revision. We encourage you to review this Privacy Policy periodically so that you remain informed about how bad8 protects your personal data.

Your continued use of the Platform after the effective date of any amendment to this Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the revised Privacy Policy, you must stop using the Platform and request Account closure before the effective date.

13 Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how bad8 handles your personal data, please contact our team using the details below:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data rights requests: DATA RIGHTS REQUEST
• Subject line for unsubscribe requests: UNSUBSCRIBE
• Subject line for data breach reports: DATA SECURITY CONCERN
• Support hours: 24 hours a day, 7 days a week, 365 days a year
• Response target: Data rights requests responded to within 30 days; general privacy enquiries within 4 hours via email

bad8 is committed to resolving privacy concerns fairly and promptly. If you feel your concern has not been adequately addressed after contacting our support team, you may escalate the matter to bad8's senior compliance team by requesting escalation in your follow-up email.