bad8 Privacy Policy

Section 1

Introduction & Scope

This Privacy Policy ("Policy") is published by bad8, the operator of the online gaming and sports betting platform accessible at https://bad8.club ("bad8", "we", "us", "our"). It explains how bad8 collects, uses, stores, shares, and protects the personal data of all individuals ("Player", "User", "you") who interact with the bad8 website, mobile interface, customer support channels, or any other service offered under the bad8 brand.

This Policy applies to all personal data processed in connection with your use of the bad8 platform, regardless of the device or browser you use to access it. It covers data collected directly from you (for example, when you register an account or contact support), data collected automatically through your use of the platform (for example, log files and cookies), and data received from third-party partners such as payment processors and identity verification providers.

bad8 serves players primarily based in Bangladesh. Where this Policy references applicable law, it encompasses both the general principles of internationally recognised data protection frameworks and any applicable Bangladeshi legislation governing the handling of personal information. bad8 is committed to processing your data lawfully, fairly, and transparently at all times.

This Policy should be read alongside the bad8 Terms & Conditions and Responsible Gaming Policy, which form part of the overall agreement between you and bad8. In the event of any conflict between this Policy and any other document, this Privacy Policy shall govern in respect of data protection matters.

Section 2

Personal Data We Collect

bad8 collects personal data through several distinct channels. The categories of data we collect, and the channel through which each is typically obtained, are set out below.

Data You Provide Directly

• Registration data: Full legal name, date of birth, residential address (including city and district — e.g., Dhaka, Chittagong, Sylhet, Khulna), email address, and mobile phone number.
• Identity verification (KYC) documents: National Identity Card (NID) number and scan, passport, driving licence, or other government-issued photo ID; utility bills or bank statements used as proof of address.
• Payment information: Mobile Financial Service account identifiers (bKash, Nagad, Rocket, Upay wallet numbers) and bank account details (account number, branch, bank name) used for deposits and withdrawals. bad8 does not store full card numbers or CVV codes.
• Account credentials: Username and hashed password. bad8 never stores passwords in plain text.
• Communications data: Any information you voluntarily provide when contacting bad8 customer support via email ([email protected]), live chat, or any other support channel, including the content of your messages and any attachments.
• Preference and profile data: Game preferences, self-imposed deposit limits, session reminders, and responsible gaming elections you make within your account settings.

Data Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device model, screen resolution, and language settings.
• Usage and behavioural data: Pages visited, games played, bets placed, session duration, navigation path through the site, click patterns, and feature interactions.
• Transaction logs: A complete record of all deposits, withdrawals, wagers, game outcomes, bonus activations, and balance adjustments associated with your account.
• Location data: Approximate geographic location inferred from your IP address, used for fraud detection and jurisdiction compliance purposes. bad8 does not collect precise GPS location data unless explicitly granted by your device permissions.

Data Received from Third Parties

• Payment processor data: Transaction confirmation, transaction reference numbers, and basic payment account identifiers shared by bKash, Nagad, Rocket, Upay, and banking partners to confirm deposit and withdrawal status.
• Identity verification partner data: Verification status results (confirmed / not confirmed) and risk flags returned by third-party KYC and anti-money laundering (AML) screening services.
• Fraud and security intelligence: Risk scoring and device fingerprint data from fraud-prevention partners, used to detect account takeover, multi-accounting, and bot activity.

Section 3

Legal Basis for Processing

bad8 processes your personal data on the following legal bases, depending on the specific processing activity:

Where bad8 relies on legitimate interests as the legal basis for processing, we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms. Where bad8 relies on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Section 4

How We Use Your Data

bad8 uses the personal data it collects strictly for the purposes described in this Policy. We do not sell your personal data to third parties. The primary purposes for which we process your data are set out below:

Platform Operation and Account Management

Your registration data and account credentials are used to create, maintain, and secure your bad8 account. This includes authenticating your identity when you log in, displaying your account balance and transaction history, applying your responsible gaming preferences, and communicating important account updates and security alerts to you.

Payment Processing and Financial Compliance

Your payment information and transaction data are used to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer partners. bad8 is also required by anti-money laundering (AML) obligations to monitor transaction patterns and to report suspicious activity to the relevant authorities where required by law. Your financial data is never used for any purpose unrelated to your account transactions or legal compliance obligations.

Identity Verification and Fraud Prevention

KYC documents and identity data are used exclusively to verify that you meet the eligibility requirements set out in the bad8 Terms & Conditions — specifically that you are aged 18 or above, that you are the legitimate account holder, and that the funds you use are sourced legitimately. Fraud detection data (IP addresses, device fingerprints, behavioural patterns) is used to identify and prevent account takeover, multi-accounting, bot activity, and bonus abuse.

Responsible Gaming

bad8 uses your gameplay data, session duration, and wagering patterns to support responsible gaming obligations — including identifying players who may be showing signs of problem gambling behaviour. Where such indicators are detected, bad8 may proactively reach out to offer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion. See the Responsible Gaming page for full details.

Customer Support

Communications data provided when you contact bad8 support is used to resolve your query, to maintain a record of interactions for quality assurance and training purposes, and to improve the overall support experience. Support communications are retained for a period consistent with the data retention schedule described in Section 7.

Marketing and Promotions (With Consent)

Where you have given explicit consent to receive promotional communications, bad8 may use your email address and general gaming preferences to send you information about bonuses, seasonal promotions (for example, Eid al-Fitr, Pohela Boishakh, BPL and IPL season offers), and platform news. You may withdraw marketing consent at any time by updating your preferences in your account settings or by contacting support at [email protected]. Withdrawal of marketing consent does not affect essential account communications.

Section 5

Cookies & Tracking Technologies

bad8 uses cookies and similar tracking technologies to operate the platform, improve user experience, and support security functions. A cookie is a small text file placed on your device by a web server when you visit a website. The cookies used on bad8 fall into the following categories:

Managing Your Cookie Preferences

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to alert you when a cookie is being set. Please be aware that disabling strictly necessary cookies will prevent you from logging in and using the bad8 platform. Disabling functional or analytical cookies may result in a reduced or degraded experience but will not prevent core platform access.

bad8 does not use third-party advertising or targeting cookies. We do not participate in cross-site behavioural advertising networks, and we do not share cookie-derived data with advertising platforms.

Section 6

Data Sharing & Third Parties

bad8 does not share your personal data with third parties except in the circumstances described below. All third parties with whom bad8 shares data are contractually required to handle that data securely, to use it only for the stated purpose, and to comply with applicable data protection standards.

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive only the minimum data necessary to process your deposit or withdrawal transaction (for example, your account identifier and transaction amount). These partners operate under their own privacy policies and regulatory obligations.
• Identity verification providers: Third-party KYC and AML screening services receive your identity documents and personal details solely for the purpose of verifying your identity and screening against financial crime watchlists. These providers are bound by strict confidentiality agreements.
• Game content providers: Studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive your anonymised player session identifier (but not your name, address, or payment details) in order to deliver game content and record game outcomes. These providers operate under their own data processing agreements.
• Platform infrastructure and security providers: Cloud hosting, content delivery, and fraud-detection vendors who provide the technical infrastructure on which bad8 operates. These vendors act as data processors under written agreements and may not use your data for their own purposes.
• Legal and regulatory authorities: bad8 may disclose your personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies where required to do so by applicable law, a court order, or a lawful government request. bad8 will notify you of any such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of bad8's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to the terms under which your data is processed.

Section 7

Data Retention & Security

How Long We Keep Your Data

bad8 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

When a retention period expires, personal data is either securely deleted or permanently anonymised so that it can no longer be linked to an individual. Anonymised aggregate data (for example, statistical reporting on platform usage) may be retained indefinitely.

How We Secure Your Data

bad8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• TLS/SSL encryption: All data transmitted between your browser and the bad8 platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. The padlock icon in your browser confirms an active SSL-secured connection.
• Password hashing: Account passwords are stored exclusively as cryptographically hashed values using modern hashing algorithms. bad8 staff cannot view or retrieve your password in plain text.
• Access controls: Personal data is accessible only to bad8 staff who require it to perform their specific job function. Access is governed by role-based permissions and is logged and audited on a regular basis.
• Data segregation: Personal data and financial data are stored in logically segregated environments with independent access controls.
• Intrusion detection: bad8's infrastructure is monitored continuously for security anomalies, intrusion attempts, and suspicious activity patterns. Security incidents are responded to in accordance with a documented incident response procedure.
• KYC document security: Identity documents submitted for KYC verification are stored in an encrypted document management system. They are never transmitted via unencrypted channels and are never shared beyond the verification workflow.

Section 8

Your Privacy Rights

As a player on the bad8 platform, you hold a number of rights in relation to the personal data bad8 holds about you. bad8 is committed to honouring these rights promptly and without undue delay. The rights available to you are described below:

• Right of access: You have the right to request a copy of the personal data bad8 holds about you, together with information about how that data is being used. This is sometimes called a Subject Access Request (SAR). bad8 will respond to verified SARs within 30 days.
• Right to rectification: If any personal data bad8 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account details directly through your account profile settings; for KYC document corrections, please contact support.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data. Please note that this right is subject to exceptions — bad8 may be required to retain certain data for legal, regulatory, or anti-money laundering compliance purposes even after account closure. Where erasure is not possible in full, bad8 will explain which data must be retained and why.
• Right to restriction of processing: In certain circumstances (for example, where you contest the accuracy of data or have objected to processing pending verification of legitimate grounds), you may request that bad8 restrict its processing of your data to storage only.
• Right to object: You have the right to object to the processing of your personal data where bad8 relies on legitimate interests as the legal basis, or where processing is for direct marketing purposes. Where you object to marketing, bad8 will cease marketing communications immediately.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time via your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
• Right to data portability: Where processing is carried out by automated means and is based on your consent or a contract, you may request that bad8 provide your personal data in a structured, commonly used, machine-readable format.

How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request in English to [email protected], clearly stating which right you wish to exercise and providing sufficient information to allow bad8 to verify your identity before processing the request. bad8 will respond within 30 days of receiving a verified request. In cases of complexity or high volume, this period may be extended by a further 30 days, in which case bad8 will notify you and explain the reason for the extension.

bad8 will not charge a fee for processing a privacy rights request unless the request is manifestly unfounded or excessive. In such cases, bad8 reserves the right to charge a reasonable administrative fee or to decline to action the request, providing written reasons for that decision.

Section 9

Policy Updates & Contact

Updates to This Policy

bad8 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or our platform's features and services. When material changes are made — particularly those that affect how your personal data is used or shared — bad8 will notify registered players via the email address on their account at least 7 days before the changes take effect. Minor clarifications may be published without advance notice.

The "Last Updated" date at the top of this page will always reflect when the most recent revision was published. We encourage you to review this Policy periodically to stay informed about how bad8 protects your personal data. Your continued use of the bad8 platform after an updated Policy has taken effect constitutes your acceptance of the revised terms.

Contact the bad8 Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or to bad8's handling of your personal data, please contact our support team in English at [email protected]. Our team is available 24 hours a day, 7 days a week, and privacy and data protection queries are treated as a priority. Please include "Privacy Request" in the subject line of your email to ensure your query is routed to the appropriate team member promptly.

bad8 takes all privacy concerns seriously and will acknowledge receipt of your query within 48 hours and provide a substantive response within 30 days. If you are dissatisfied with bad8's response to a privacy concern, you may have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.