ba33 Privacy Policy — How We Collect, Use, and Protect Your Data
At ba33, your privacy is a core commitment, not an afterthought. This Privacy Policy explains exactly what personal data we collect from players in Bangladesh, how we use it, who we share it with, and the rights you hold over it at every stage of your account lifecycle.
Six Principles That Govern How ba33 Handles Your Data
These commitments summarise how ba33 approaches personal data. The full legal detail follows in the policy sections below.
Data Collected Minimally
ba33 collects only the personal data that is strictly necessary to operate your account, verify your identity, process payments, and comply with applicable obligations. We do not collect data for its own sake.
Purpose-Limited Use
Your data is used only for the specific purposes stated in this policy at the time of collection. ba33 does not repurpose your personal data for unrelated activities without first notifying you and, where required, obtaining your consent.
Your Rights Are Respected
You have the right to access, correct, and request deletion of your personal data held by ba33. We respond to all verified data rights requests within 14 days of receipt via our support team.
No Data Selling
ba33 does not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances. Your information is never a product. It is processed solely to deliver and improve our Platform services.
Secure Storage
All personal data stored by ba33 is protected using AES-256 encryption at rest and TLS 1.3 in transit. Access to personally identifiable information is restricted to authorised personnel on a strict need-to-know basis.
Defined Retention Periods
ba33 retains your data only for as long as required by the purpose it was collected for or by applicable legal obligations. Once the retention period expires, data is securely deleted or anonymised in line with our data retention schedule.
Table of Contents
1Who We Are
ba33 ("ba33", "we", "us", "our") operates the online betting and casino platform accessible at ba33.io. This Privacy Policy applies to all personal data processed by ba33 in connection with the operation of the Platform, including data collected through the website, mobile browser interface, customer support channels, and promotional communications.
For the purposes of this Privacy Policy, ba33 is the data controller in respect of the personal data it collects directly from players. Where ba33 engages third-party processors to handle data on its behalf (for example, payment gateway providers or identity verification services), those parties act as data processors under binding contractual arrangements.
This Privacy Policy should be read alongside ba33's Terms and Conditions and Responsible Gaming Policy, both of which form part of the agreement between ba33 and each registered player. Defined terms used but not defined in this Privacy Policy have the meanings given to them in the Terms and Conditions.
2Personal Data We Collect
ba33 collects the following categories of personal data from players during the account registration, verification, and ongoing use of the Platform:
2.1 Identity Data
- Full legal name (as it appears on your national identity document)
- Date of birth
- Gender (optional, where voluntarily provided)
- Photograph or likeness (as submitted on KYC documents)
- National ID number, passport number, or driving licence number
2.2 Contact Data
- Registered mobile phone number (used for account access and OTP verification)
- Email address
- City or district of residence (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi)
2.3 Financial Data
- Mobile wallet identifiers associated with bKash, Nagad, or Rocket accounts used for deposits and withdrawals
- Transaction history including deposit amounts, withdrawal amounts, and timestamps
- Account balance information
2.4 Gaming and Behavioural Data
- Game session data including games played, bets placed, wins and losses, session durations
- Sports betting history including markets wagered, odds accepted, and settlement outcomes
- Bonus and promotion redemption history
- Responsible gaming tool usage (deposit limits set, cooling-off periods activated, self-exclusion requests)
2.5 Technical Data
- IP address at the time of account creation and each subsequent login
- Device type, operating system, and browser version
- Device fingerprint identifiers used for fraud detection and duplicate account prevention
- Approximate geographic location derived from IP address
2.6 Communications Data
- Records of live chat conversations with the ba33 support team
- Email correspondence between you and ba33
- Records of any complaints, disputes, or formal enquiries submitted by you
ba33 does not collect credit or debit card numbers, bank account numbers, or any international payment credentials. All payment transactions on the ba33 Platform are processed exclusively through supported Bangladeshi mobile wallet services (bKash, Nagad, Rocket).
3How We Collect Your Data
ba33 collects personal data through the following channels and mechanisms:
3.1 Direct Collection
The majority of personal data held by ba33 is provided directly by you during the account registration process, KYC verification submission, deposit and withdrawal requests, and communications with the support team. You are not required to provide any personal data beyond what is strictly necessary to access the relevant feature of the Platform.
3.2 Automated Collection
When you access or use the ba33 Platform, certain technical and behavioural data is collected automatically through the use of server logs, session tracking technologies, and device fingerprinting systems. This automated collection is necessary for fraud prevention, security monitoring, and Platform performance optimisation.
3.3 Third-Party Sources
Where you submit KYC documentation, ba33 may use the services of a third-party identity verification provider to cross-reference the information you have supplied against official databases. The outcome of such checks (pass, fail, or refer) is recorded in your account file. ba33 does not retain raw third-party database records — only the verification outcome.
3.4 Payment Processors
When you initiate a deposit or withdrawal, your mobile wallet provider (bKash, Nagad, or Rocket) transmits a transaction confirmation to ba33 that includes your registered mobile number and the transaction amount. ba33 uses this data exclusively to credit or debit your Platform wallet and to maintain your transaction history.
4Why We Use Your Personal Data
ba33 processes your personal data for the following specific purposes:
| Purpose | Data Categories Used |
|---|---|
| Account registration and authentication | Identity, Contact, Technical |
| Age and identity verification (KYC) | Identity, Contact, Financial |
| Processing deposits and withdrawals | Financial, Identity |
| Fraud prevention and security monitoring | Technical, Financial, Gaming |
| Responsible gaming programme delivery | Gaming, Identity, Contact |
| Customer support and dispute resolution | Identity, Contact, Communications, Gaming |
| Bonus and promotion administration | Identity, Financial, Gaming |
| Platform analytics and performance improvement | Technical, Gaming (anonymised where possible) |
| Legal and regulatory compliance | All categories as required |
5Legal Bases for Processing
ba33 processes your personal data on the following legal bases:
5.1 Contractual Necessity
The processing of your identity, contact, and financial data is necessary to perform the contract between you and ba33 — specifically to register your account, verify your eligibility to play, process your transactions, and provide access to the games and betting markets on the Platform. Without this processing, ba33 cannot provide its services to you.
5.2 Legal Obligation
ba33 is subject to legal obligations including age verification requirements, anti-money laundering checks, and the duty to cooperate with any lawful authority investigation. Processing your identity data for KYC purposes and retaining transaction records for audit purposes are carried out in fulfilment of these obligations.
5.3 Legitimate Interests
ba33 processes certain technical and behavioural data on the basis of its legitimate interests in operating a secure, fraud-resistant Platform and maintaining the integrity of its games and sports betting markets. These interests have been assessed against your privacy interests and do not override them where data is processed minimally, securely, and for purposes you would reasonably expect.
5.4 Consent
Where ba33 proposes to use your personal data for a purpose that is not strictly necessary for the provision of the Platform's core services — for example, to send you promotional communications about new games or seasonal offers — ba33 will seek your explicit opt-in consent before doing so. You may withdraw consent at any time by contacting the support team, without this affecting the lawfulness of processing carried out before withdrawal.
6Sharing Your Personal Data
ba33 does not sell your personal data to third parties. Your data is shared only in the following limited circumstances:
6.1 Third-Party Service Providers
ba33 engages a small number of carefully selected third-party service providers to assist in delivering the Platform's services. These include identity verification providers, payment processing intermediaries, fraud detection services, and cloud infrastructure providers. All such providers are engaged under binding data processing agreements that restrict them to processing your data only on ba33's instructions and for no independent purpose of their own.
6.2 Game Providers
When you play a game supplied by a third-party studio (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, or Ezugi), certain game session data (including your player ID, stake, and outcome) is transmitted to that provider's systems for game delivery and fairness certification purposes. Game providers do not receive your full name, mobile number, or financial data — only the anonymised player ID and session data necessary to render the game.
6.3 Legal and Regulatory Disclosure
ba33 may disclose your personal data to law enforcement agencies, regulatory authorities, or other competent bodies where required to do so by applicable law, court order, or equivalent legal process. ba33 will, where legally permitted, notify you of such a disclosure request prior to complying.
6.4 Business Transfers
In the event that ba33 undergoes a corporate restructuring, merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to the way your data is processed that result from it, with a minimum of 14 days' notice prior to the transfer taking effect.
Important: ba33 will never share your personal data with third-party marketers, advertising networks, data brokers, or social media platforms for commercial purposes. Your data is not a revenue source.
7Cookies and Tracking Technologies
ba33 uses a limited set of cookies and similar tracking technologies on the Platform. These are described below:
7.1 Strictly Necessary Cookies
These cookies are essential for the Platform to function correctly. They include session authentication cookies that keep you logged in during your visit, anti-fraud tokens, and load-balancing cookies. These cookies cannot be disabled without impairing your ability to use the Platform.
7.2 Performance and Analytics Cookies
ba33 uses first-party analytics cookies to understand aggregate patterns of Platform usage — for example, which game categories are most frequently accessed and at what times of day. These cookies collect data in an anonymised or pseudonymised form and are not used to identify individual players. No third-party analytics platforms (such as Google Analytics) are used to process individually identifiable ba33 player data.
7.3 Fraud Detection Cookies
Certain cookies and local storage identifiers are used as part of ba33's device fingerprinting and fraud detection systems. These are necessary to identify duplicate accounts, detect unusual login patterns, and protect the integrity of the Platform. They are processed on the basis of ba33's legitimate interest in maintaining a secure Platform.
7.4 Cookie Lifespan
Session cookies are deleted automatically when you close your browser. Persistent cookies used for fraud detection and Platform preferences are retained for a maximum of 12 months from the date of last use, after which they expire automatically.
You may configure your browser to block or delete cookies at any time. Blocking strictly necessary cookies will impair or prevent access to the ba33 Platform. Blocking performance or fraud-detection cookies may result in additional security verification steps being required at login.
8Data Security
ba33 applies a layered security architecture to protect personal data against unauthorised access, accidental loss, destruction, and disclosure. The principal technical and organisational security measures in place include:
- Encryption in transit: All data transmitted between your device and the ba33 Platform is encrypted using TLS 1.3 or later. The ba33.io domain is enforced over HTTPS at all times.
- Encryption at rest: Personal data and KYC documentation stored on ba33 servers is encrypted using AES-256 encryption.
- Access controls: Access to systems holding personally identifiable player data is restricted to authorised ba33 personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication requirements.
- Internal audit logging: All access to personal data by ba33 staff is logged and subject to periodic review. Any access that is not justified by an active support ticket or compliance task is flagged for investigation.
- Penetration testing: The ba33 Platform is subject to regular independent security assessments to identify and remediate vulnerabilities before they can be exploited.
- Incident response: ba33 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights, ba33 will notify affected players without undue delay, describing the nature of the breach, the data involved, and the steps ba33 has taken in response.
No data security system is entirely impenetrable. While ba33 takes all reasonable precautions to protect your data, you also have a role to play: keep your login credentials private, use a strong unique password for your ba33 account, and report any suspected unauthorised access to the support team immediately.
9Data Retention
ba33 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required to comply with applicable legal or regulatory obligations. The following retention periods apply as a general guide:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration and identity data | Duration of account + 5 years post-closure | Legal obligation (AML / record-keeping) |
| KYC documents (NID, passport scans) | Duration of account + 5 years post-closure | Legal obligation (identity verification) |
| Transaction records (deposits, withdrawals) | 7 years from transaction date | Legal obligation (financial records) |
| Game and betting history | 3 years from session date | Legitimate interest (dispute resolution) |
| Support communications | 3 years from last correspondence | Legitimate interest (dispute resolution) |
| Technical and device data (logs) | 12 months from collection | Legitimate interest (security monitoring) |
| Marketing preference records | Until consent is withdrawn + 1 year | Consent |
On expiry of the applicable retention period, personal data is securely and permanently deleted from ba33's live systems. Where complete deletion is not technically possible for specific data sets (for example, data held in encrypted backup archives), ba33 will isolate such data and ensure it is deleted at the earliest technically practicable opportunity and no later than 90 days beyond the standard retention period.
10Your Privacy Rights
As a ba33 player, you hold the following rights with respect to the personal data ba33 holds about you. To exercise any of these rights, contact the ba33 support team via the live chat in your account dashboard or by email at [email protected] (plain text — not a clickable link). ba33 will respond to all verified rights requests within 14 days.
10.1 Right of Access
You have the right to request a copy of the personal data ba33 holds about you, together with information about how it is being used, how long it will be retained, and whether it has been shared with any third party. This is sometimes called a Subject Access Request (SAR). ba33 will provide a structured response in plain English within 14 days of a verified request.
10.2 Right to Rectification
If any personal data ba33 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay. Where a correction affects KYC-verified data, you may be required to submit updated supporting documentation.
10.3 Right to Erasure
You have the right to request that ba33 delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. ba33 will comply with erasure requests except where retention is required to fulfil a legal obligation or to exercise or defend a legal claim.
10.4 Right to Restriction of Processing
You have the right to request that ba33 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified. Data subject to a restriction will be stored but not otherwise processed without your consent, except where processing is necessary for legal claims or to protect the rights of another person.
10.5 Right to Object
Where ba33 processes your personal data on the basis of its legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. ba33 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for the establishment, exercise, or defence of legal claims.
10.6 Right to Withdraw Consent
Where ba33 relies on your consent as the legal basis for processing (for example, for promotional communications), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal date. To withdraw consent, contact the support team via live chat or email.
ba33 will not charge any fee for processing a data rights request unless the request is manifestly unfounded or excessive. In such cases, ba33 may charge a reasonable administrative fee or decline to act on the request, with written reasons provided to you.
11Children and Minors
The ba33 Platform is strictly for adults aged 21 years and above. ba33 does not knowingly collect personal data from any person under the age of 21. If you are under 21, you must not register an account, deposit funds, or access any game or betting feature on the Platform.
ba33 employs age verification as a mandatory step in the KYC process, requiring all players to submit government-issued proof of age before withdrawals are permitted. Any account found to belong to a person under the age of 21 will be immediately closed, all funds will be frozen and returned to the originating payment method, and the account data will be securely deleted in accordance with applicable obligations.
If you are a parent or guardian and believe that a person under the age of 21 in your care has registered a ba33 account, please contact our support team immediately via the live chat service or by email. ba33 will investigate all such reports as a priority and take immediate remedial action.
21+ Only: ba33 fully supports parental control software tools that can be used to restrict access to gambling websites. Players with children in their household are encouraged to use such tools to prevent underage access to the ba33 Platform.
12Third-Party Services and External Links
The ba33 Platform incorporates games and services provided by third-party studio partners, including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. These providers operate their own data processing environments for game delivery and fairness certification. ba33 has conducted due diligence on all active provider relationships and maintains contractual protections to limit the scope of data each provider may access.
ba33's payment infrastructure relies on the APIs of bKash, Nagad, and Rocket. When you initiate a payment transaction, you are also subject to the privacy terms of your chosen mobile wallet provider. ba33 encourages you to review the privacy policies of those providers separately, as ba33 is not responsible for the data practices of independent third parties.
ba33 does not display third-party advertising on its Platform and does not embed third-party social media trackers, pixel tags, or advertising SDK code on any page of the website. All analytics and performance monitoring is conducted using ba33's own first-party systems.
13Amendments to This Privacy Policy
ba33 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, changes in our data processing practices, or improvements to the way we explain our practices to you. The effective date at the top of this page will be updated whenever a change is made.
Where a change is material — meaning it significantly affects how we collect, use, or share your personal data — ba33 will notify you via your registered mobile number or email address at least 7 days before the change takes effect, giving you the opportunity to review the updated policy and, where the change affects processing based on consent, to withdraw that consent if you do not agree.
Minor clarifications, typographical corrections, or updates that do not change the substantive effect of any provision may be made without prior individual notice. The updated policy will take effect immediately upon publication for such minor changes.
We encourage you to review this Privacy Policy periodically to stay informed about how ba33 is protecting your data. Your continued use of the Platform after the effective date of any update constitutes your acknowledgment of the revised policy.
14How to Contact Us
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about the way ba33 handles your personal data, please get in touch using the contact details below:
- Live Chat: Available 24/7 via your ba33 account dashboard — the fastest way to reach our support team.
- Email: [email protected] (plain text — not a clickable link). Include "Privacy Enquiry" in your subject line.
- Response Time: ba33 aims to acknowledge all privacy enquiries within 4 hours (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 14 calendar days.
When contacting ba33 about a data rights request, please include your registered mobile number and the nature of your request. ba33 may need to verify your identity before acting on the request to ensure that personal data is not disclosed to, or acted upon at the request of, an unauthorised person.
All privacy communications with ba33 are conducted in English. Our support team is available around the clock to address your data protection concerns promptly and professionally.
Ready to Experience ba33?
Now that you know how ba33 protects your personal data, explore our full range of games and betting markets — cricket, slots, Aviator, Rummy, and live casino — all in one secure platform built for Bangladesh players.