8c77 Privacy Policy — Your Data, Your Rights

This Privacy Policy ("Policy") describes how 8c77 ("8c77", "we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("you", "your", "Player", "User") who access or use the 8c77 online gaming and sports betting platform, including all associated websites, mobile applications, and related services accessible at https://8c77.io (collectively, the "Platform").

8c77 is committed to maintaining the trust of every player on its Platform — including the hundreds of thousands of players in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, and across Bangladesh who choose 8c77 as their preferred online gaming destination. We take data protection seriously and adhere to internationally recognised best practices in information security and privacy management.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference and govern your use of the 8c77 Platform alongside this Policy.

This Policy is written exclusively in English. In the event of any conflict between this English version and any translation that may be provided for convenience, the English version shall prevail in all respects.

8c77 collects personal data across several categories, depending on how you interact with the Platform. The categories of personal data we may collect include:

8c77 collects personal data through the following channels and mechanisms:

• Direct Provision: Information you provide when creating an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or opting into promotional communications.
• Automated Technologies: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, pixel tags, server logs, and similar tracking technologies. See Section 7 (Cookies & Tracking) for full details.
• Payment Processors: Transaction confirmation data received from bKash, Nagad, Rocket, and Upay when you initiate a deposit or withdrawal. 8c77 does not store full mobile financial account credentials — only the transaction reference and associated mobile number are retained.
• Identity Verification Partners: Where 8c77 uses third-party KYC or identity verification service providers, those providers may supply the results of identity checks (e.g., document authenticity scores, age verification outcomes) to 8c77. The underlying document images are handled by the verification provider in accordance with their own privacy policies.
• Fraud Prevention and Analytics Partners: Aggregated or pseudonymised data may be received from fraud detection services to help 8c77 identify suspicious activity patterns on the Platform.
• Publicly Available Sources: In limited circumstances — for example, during enhanced due diligence on high-value transactions — 8c77 may consult publicly available sources such as sanction lists or public records to verify player identity.

8c77 processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your 8c77 player account, including processing registration, managing your profile, and enabling account login.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, and Upay, to reconcile transaction records, and to investigate disputed or failed transactions.
• Identity Verification (KYC): To verify your identity, age, and eligibility to use the Platform in compliance with our responsible gaming commitments and anti-fraud obligations.
• Anti-Money Laundering (AML): To monitor transactions for suspicious activity, to satisfy our AML obligations, and to report to relevant authorities where legally required.
• Platform Delivery: To deliver the games, betting markets, live casino, and other services available on the Platform, and to provide customer support in relation to those services.
• Personalisation: To tailor the Platform experience to your preferences, including recommending games or promotions relevant to your play history, where you have not opted out of personalisation.
• Marketing Communications: To send promotional offers, bonuses, and tournament announcements via email or SMS, where you have given explicit consent. You may withdraw this consent at any time via your account settings or by contacting support.
• Responsible Gaming: To monitor gaming patterns for signs of problem gambling, to administer responsible gaming tools (deposit limits, self-exclusion, cooling-off periods), and to comply with our responsible gaming policy.
• Security and Fraud Prevention: To detect and prevent cheating, collusion, bonus abuse, account takeover, and other prohibited conduct on the Platform.
• Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the overall performance and user experience of the Platform.
• Legal Compliance: To comply with applicable legal and regulatory obligations, including responding to lawful requests from authorities.

8c77 processes your personal data on the following legal bases, depending on the specific purpose of the processing:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted at registration — including account management, payment processing, and platform service delivery.
• Legal Obligation: Processing required to comply with applicable laws — including KYC verification, AML monitoring, and responding to lawful authority requests.
• Legitimate Interests: Processing carried out for purposes that represent 8c77's legitimate business interests, where those interests are not overridden by your privacy rights — including fraud prevention, platform security, and service improvement analytics.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — including sending marketing communications and applying optional personalisation features. You may withdraw consent at any time by contacting our support team or adjusting your account settings, without affecting the lawfulness of processing based on consent before withdrawal.

8c77 shares personal data with third parties only to the extent necessary to operate the Platform and comply with applicable obligations. The categories of third parties with whom your data may be shared include:

• Payment Service Providers: bKash, Nagad, Rocket, and Upay receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are independent data controllers for their own platforms.
• Game Software Providers: Game studios and RNG engine providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive anonymised session data necessary to deliver their games. These providers do not receive personally identifiable registration data.
• KYC and Identity Verification Providers: Specialist third-party providers engaged by 8c77 to conduct identity document verification and age confirmation as part of our KYC process.
• Fraud Detection and Security Vendors: Third-party security and analytics vendors that assist 8c77 in detecting suspicious activity, preventing account takeover, and maintaining platform integrity.
• Customer Support Platform Providers: Providers of the live chat and ticketing infrastructure used by 8c77's 24/7 support team. Support conversation data is stored on their secure infrastructure.
• Legal and Regulatory Authorities: Where required by applicable law or a lawful authority request, 8c77 will disclose personal data to regulators, law enforcement agencies, or courts. 8c77 will notify you of such disclosures to the extent legally permitted.
• Professional Advisers: Legal, accounting, and auditing firms engaged by 8c77, who are bound by strict confidentiality obligations.

8c77 uses cookies and similar tracking technologies on the Platform to enhance functionality, maintain session integrity, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without preventing you from using the Platform.
• Functional Cookies: Enable the Platform to remember your preferences such as language settings, preferred game view, and session timeout preferences. Disabling functional cookies may limit Platform functionality.
• Analytics Cookies: Collect anonymised or pseudonymised data about how players use the Platform — pages visited, session duration, feature engagement, and error rates — to help 8c77 improve the Platform experience. These cookies do not identify you personally.
• Marketing and Personalisation Cookies: Used to deliver promotional content and personalised game recommendations relevant to your play history, where you have consented to personalisation. You may opt out of these cookies via your account settings.

Most web browsers allow you to control cookies through browser settings. Blocking all cookies will prevent some features of the Platform from functioning correctly. For specific instructions on managing cookies in your browser, consult your browser's help documentation.

8c77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account Data: Retained for the duration of your account's active status, plus a minimum of 5 years following account closure to satisfy AML record-keeping requirements.
• Transaction Records: Deposit and withdrawal records are retained for a minimum of 5 years from the date of each transaction in accordance with financial record-keeping obligations.
• KYC Documents: Identity documents submitted during verification are retained for the duration of the account relationship plus 5 years following account closure. Copies held by third-party verification providers are subject to their own retention policies.
• Communications Data: Live chat transcripts and email correspondence are retained for up to 3 years from the date of each interaction, unless the communication relates to an ongoing dispute, in which case it is retained until the dispute is finally resolved.
• Technical and Usage Data: Server logs and session data are retained for up to 12 months in standard form, after which they may be retained in aggregated and anonymised form indefinitely for analytics purposes.
• Self-Exclusion Records: Records of self-exclusion requests are retained indefinitely to prevent re-registration by self-excluded individuals, in accordance with responsible gaming best practice.
• Marketing Preference Records: Consent and opt-out records are retained for the duration of the account relationship plus 3 years to evidence compliance with marketing consent obligations.

When personal data is no longer required under the applicable retention period, it is securely deleted or irreversibly anonymised in accordance with 8c77's data disposal procedures.

Subject to applicable law, you have the following rights in relation to the personal data that 8c77 holds about you. To exercise any of these rights, contact our support team at [email protected]. We will respond to all valid rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data 8c77 holds about you, along with information about how that data is processed. 8c77 will provide this information in a commonly used, machine-readable format upon request.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by 8c77 be corrected or completed. For minor updates such as email address changes, you may update your information directly via your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to 8c77's legal obligations to retain certain data (e.g., AML records). Erasure requests that conflict with mandatory retention obligations will be addressed on a category-by-category basis.
• Right to Restriction: You have the right to request that 8c77 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
• Right to Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used format, or to request that it be transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to processing based on 8c77's legitimate interests. 8c77 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications, personalisation), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

8c77 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• TLS/SSL Encryption: All data transmitted between your browser or mobile device and the 8c77 Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. The 8c77 Platform enforces HTTPS across all pages and endpoints.
• Data Encryption at Rest: Sensitive personal data stored in 8c77's databases — including identity documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within 8c77's systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of access required to perform their job functions. All privileged access is logged and audited.
• Password Security: Player account passwords are stored exclusively in hashed form using a strong one-way cryptographic hashing algorithm. 8c77 staff cannot view your plain-text password and will never ask you for it.
• Two-Factor Authentication: 8c77 supports two-factor authentication (2FA) for player accounts and enforces 2FA for all internal staff system access.
• Penetration Testing: 8c77's infrastructure is subject to regular security assessments and penetration testing by qualified third-party security professionals to identify and remediate vulnerabilities.
• Incident Response: 8c77 maintains a documented data breach incident response plan. In the event of a data breach that poses a risk to player rights, affected players will be notified without undue delay.

While 8c77 takes all reasonable steps to protect your personal data, no system is entirely immune from security risks. You play an important role in protecting your own data by maintaining the confidentiality of your account credentials and using a strong, unique password for your 8c77 account.

The 8c77 Platform is strictly prohibited for individuals under the age of 21. 8c77 does not knowingly collect or process personal data of individuals under the age of 21. Age verification is conducted as part of the KYC process at the withdrawal stage and may be requested at any point during the account lifecycle.

Parents and guardians who have reason to believe that a minor in their care has registered an account or accessed the 8c77 Platform should contact our support team immediately at [email protected] so that the account can be investigated and closed without delay. 8c77 also recommends the use of parental control software to prevent minors from accessing online gaming platforms.

8c77 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or the services offered on the Platform. When material changes are made, registered players will be notified via the email address on file or via an in-platform notification. The "Last Updated" date at the top of this Policy will be revised accordingly.

We encourage you to review this Policy periodically to stay informed about how 8c77 protects your personal data. Continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms.