55bat Privacy Policy — Your Data, Protected

1. Introduction

55bat is committed to protecting the personal data of every player who uses our platform. We recognise that privacy is a fundamental right, and we build our data practices around the principle that your information belongs to you. This Privacy Policy is intended to be clear, specific, and honest about our data handling — written in plain English so that every Bangladesh-based player can understand exactly what happens to their information when they use 55bat.

This policy applies to all data collected through the 55bat website at 55bat.io, through any mobile application we may make available, through our customer support channels (including live chat, email, and WhatsApp), and through any promotional communications we send to registered players. It covers data collected from the point of first visiting our website, through registration, through active play, and following account closure.

55bat operates under an international gaming licence. As part of our licensing obligations, we are required to maintain robust data protection practices, conduct Know Your Customer (KYC) verification, and implement Anti-Money Laundering (AML) controls. These obligations necessarily involve the collection and processing of personal data. Where we are required by law to process your data, we will always inform you of that legal obligation and process only the minimum data necessary to fulfil it.

2. Personal Data We Collect

55bat collects personal data in several distinct categories. The specific data points we collect depend on how you interact with our platform and what services you use.

2.1 Registration Data

When you create a 55bat account, we collect the following information:

• Full legal name (as it appears on your government-issued ID)
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile phone number (used for account verification and 2FA)
• Preferred username and encrypted password
• Residential address (city, district, and postal area within Bangladesh)
• Preferred currency (Bangladeshi Taka / BDT)

2.2 KYC Verification Data

To comply with our anti-money laundering obligations and to protect all players from identity fraud, we collect the following identity documents during KYC verification:

• Bangladesh National Identity Card (NID) — front and back scan or photograph
• Valid passport (biographical data page) if NID is unavailable
• Proof of residential address: utility bill, bank statement, or official government document issued within the last three months
• Proof of payment method: screenshot or confirmation of your registered bKash, Nagad, Rocket, Upay, or bank account showing your name and account number
• Selfie photograph holding your ID document (requested in some verification tiers)

2.3 Payment & Transaction Data

When you make deposits or request withdrawals, we collect and store the following financial data:

• Payment method type (e.g., bKash, Nagad, Visa)
• Registered mobile number associated with your bKash or Nagad account
• Transaction reference numbers and timestamps
• Deposit and withdrawal amounts in BDT
• Account balance history and wagering history

55bat does not store full card numbers, CVV codes, or bKash PINs. Payment card data is tokenised by our payment processor and we receive only a masked reference.

2.4 Usage & Behavioural Data

As you use the 55bat platform, we automatically collect data about your interactions with our services:

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Session start and end times and session duration
• Pages visited, games played, bets placed, and features used
• Betting patterns and game preferences (used for responsible gaming monitoring and personalisation)
• Error logs and crash reports

2.5 Communications Data

When you contact 55bat's support team or respond to our promotional communications, we collect:

• Content of live chat conversations, email correspondence, and WhatsApp messages
• Support ticket history and resolution notes
• Survey and feedback responses (where you voluntarily participate)
• Records of promotional email opens, clicks, and opt-out actions

3. How We Collect Your Data

55bat collects personal data through the following channels:

Collection Method	Examples
Directly from you	Registration form, KYC document upload, payment initiation, live chat, email, WhatsApp, survey participation
Automatically via technology	Cookies, server logs, session tracking, device fingerprinting, IP detection
From payment providers	Transaction confirmation and status updates from bKash, Nagad, Rocket, Upay, Visa, Mastercard processors
From identity verification services	Results of automated document verification checks conducted by our third-party KYC provider
From fraud prevention services	Risk scores, device reputation data, and IP reputation signals from our fraud monitoring partners
From game providers	Game session data, round results, and RTP statistics from licensed game studios such as Pragmatic Play, Evolution Gaming, and Ezugi

4. How We Use Your Personal Data

55bat uses your personal data for the following clearly defined purposes:

4.1 Account Operation

We use your registration and identity data to create and maintain your player account, authenticate your identity when you log in, enforce the single-account policy, and restore account access if your credentials are lost. This processing is essential to the contract between you and 55bat — without it, we cannot provide you with a platform account.

4.2 Age Verification & KYC Compliance

We use your date of birth and government-issued identity documents to verify that you meet the 21+ age requirement and to fulfil our KYC and AML obligations under our gaming licence. This processing is legally required. We cannot waive it regardless of your preferences.

4.3 Payment Processing

We use your payment method details and transaction history to process deposit and withdrawal requests, detect duplicate or suspicious transactions, prevent payment fraud, and reconcile our accounts. Payment data is shared with our payment processor partners strictly to the extent necessary to complete your transaction.

4.4 Responsible Gaming Monitoring

We use your behavioural and usage data — including session duration, wagering frequency, deposit patterns, and betting volume — to monitor for signs of problem gambling and to power the responsible gaming tools available in your account settings (deposit limits, session limits, self-exclusion). This processing serves both our contractual obligations to you and our duty of care as a licensed gaming operator.

4.5 Customer Support

We use your communications data and account history to investigate and resolve complaints, answer queries, and provide technical support. Support interactions are logged and retained for quality assurance and dispute resolution purposes.

4.6 Fraud Prevention & Platform Security

We use device data, IP addresses, behavioural patterns, and transaction history to detect and prevent fraud, money laundering, multi-accounting, bot activity, and other prohibited conduct described in our Terms & Conditions. This processing protects the integrity of the platform and the interests of all players.

4.7 Marketing Communications

Where you have given explicit consent, we use your email address and mobile number to send you promotional communications about bonuses, new games, sports betting opportunities, and seasonal offers relevant to the Bangladesh market (for example, Eid promotions, BPL cricket season offers, and Pohela Boishakh campaigns). You can withdraw your marketing consent at any time — see Section 13 for details.

4.8 Platform Improvement

We use aggregated and anonymised usage data to analyse platform performance, identify areas for improvement, test new features, and optimise the user experience. Where data is fully anonymised (i.e., it cannot be linked back to any individual), it falls outside the scope of this Privacy Policy.

5. Legal Basis for Processing

55bat processes personal data on the basis of one or more of the following legal grounds:

Legal Basis	When We Rely on It
Contractual necessity	Processing required to create and operate your account, process payments, and deliver our betting and casino services to you
Legal obligation	Age verification, KYC/AML compliance, fraud reporting, data retention as required by our gaming licence
Legitimate interests	Fraud prevention, platform security, responsible gaming monitoring, abuse detection, internal analytics, and customer support quality assurance — where these do not override your fundamental rights
Consent	Marketing communications by email or SMS/WhatsApp; non-essential cookies and tracking technologies. You may withdraw consent at any time without affecting prior processing.

6. Sharing Your Personal Data

55bat does not sell your personal data. We share it only with the categories of third-party recipients listed below, and only to the extent necessary for the specific purpose described.

6.1 Payment Processors

We share your payment method reference, transaction amount, and transaction ID with our authorised payment processors — including bKash, Nagad, Rocket, Upay, and card processing partners — solely to initiate and confirm your deposit or withdrawal transactions. These processors are contractually bound to use your data only for the payment processing purpose and not for any secondary use.

6.2 Identity Verification Providers

We share your KYC documents (NID, passport, proof of address) with a licensed third-party identity verification service to conduct automated and, where necessary, manual document authentication. Our KYC provider is contractually bound by data protection obligations equivalent to those in this Privacy Policy.

6.3 Game Providers

To load and run casino games, we share a pseudonymous player session token with our game providers (Pragmatic Play, Evolution Gaming, Ezugi, Netent, Microgaming, Spribe, and others). These tokens allow the game to track your bet and return results without exposing your full name, email address, or payment details to the game studio.

6.4 Fraud & Security Services

We share IP addresses, device fingerprints, and behavioural signals with our fraud prevention and platform security partners to detect and block bot activity, multi-accounting, and payment fraud. No directly identifying personal data (name, NID number) is shared with these services.

6.5 Legal & Regulatory Disclosure

55bat may be required to disclose personal data to law enforcement authorities, regulatory bodies, or courts where required by applicable law, court order, or our gaming licence obligations. We will notify you of any such disclosure where we are legally permitted to do so.

7. Cookies & Tracking Technologies

55bat uses cookies and similar tracking technologies on the 55bat.io website. A cookie is a small text file stored on your device by your web browser when you visit a website. Cookies allow us to recognise your device, maintain your session, and collect usage analytics.

7.1 Categories of Cookies We Use

Cookie Type	Purpose	Can Be Disabled?
Strictly Necessary	Session authentication, CSRF protection, load balancing, login state persistence. Without these, the platform cannot function.	No — essential to platform operation
Functional	Remembering your language preference, preferred sports markets, and UI layout choices.	Yes — disabling may reduce personalisation
Analytics	Aggregated, anonymised data on page visits, session duration, and feature usage to help us improve the platform.	Yes — opt out via cookie settings
Fraud Prevention	Device fingerprinting and IP reputation signals used to detect bot activity and unauthorised access attempts.	No — required for platform security

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling functional or analytics cookies will not affect your ability to place bets or access games, but may affect the personalised experience features of the platform.

8. Data Security

55bat employs a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser and our servers is encrypted using TLS 1.3, the current industry standard for web encryption.
• AES-256 Encryption at Rest: Sensitive data stored on our servers — including KYC documents, payment records, and identity information — is encrypted using AES-256 encryption.
• Access Controls: Player data is accessible only to authorised 55bat personnel whose job role requires access. All staff with access to personal data undergo background checks and receive data protection training.
• Two-Factor Authentication: Player accounts support two-factor authentication (2FA) via SMS OTP. We strongly encourage all players to enable 2FA in their account security settings.
• Intrusion Detection: Our platform is monitored 24/7 by automated intrusion detection systems. Anomalous access patterns trigger immediate security alerts.
• Penetration Testing: 55bat conducts regular third-party penetration testing and security audits of our platform infrastructure.

9. Your Data Subject Rights

As a player whose personal data is processed by 55bat, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days of receiving your request.

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how we use it, who we share it with, and how long we retain it. We will provide this information in a commonly used, machine-readable format (JSON or CSV) upon request.

9.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Minor corrections (e.g., email address updates) can be made directly through your account settings. Corrections to identity data (name, date of birth) require submission of updated KYC documents.

9.3 Right to Erasure

You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. Please note that 55bat is legally required to retain certain data (KYC records, transaction history) for a minimum period under our gaming licence obligations. Erasure requests that conflict with these legal retention obligations will be partially fulfilled: data that can be erased will be, and data that must be retained will be clearly identified along with the legal reason for retention.

9.4 Right to Restriction

You have the right to request that we restrict (pause) the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have disputed. During a restriction period, we will continue to store your data but will not actively process it beyond what is legally required.

9.5 Right to Data Portability

You have the right to receive the personal data you provided to 55bat in a structured, commonly used, machine-readable format, and to request that we transmit it directly to another controller where technically feasible. This right applies to data processed on the basis of your consent or a contract between you and 55bat.

9.6 Right to Object

You have the right to object to processing of your personal data that is based on our legitimate interests, including profiling. You also have an absolute right to object to processing of your personal data for direct marketing purposes at any time, with immediate effect.

9.7 Rights Related to Automated Decision-Making

55bat uses automated processes in certain areas of platform operation — including fraud scoring, KYC document verification, and responsible gaming risk assessment. Where these automated processes produce decisions that significantly affect you (such as account suspension or withdrawal restriction), you have the right to request human review of that decision. To request a review, contact our Compliance team at [email protected] with the subject line "Automated Decision Review".

10. Data Retention Periods

55bat retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable law or our gaming licence obligations. The following table sets out our standard retention periods by data category:

Data Category	Retention Period	Reason
Account registration data	Duration of account + 5 years after closure	Dispute resolution, legal claims, gaming licence requirement
KYC identity documents	7 years from date of submission	AML regulatory obligation
Transaction history	7 years from transaction date	Financial record-keeping, AML obligation
Betting & game history	5 years from date of activity	Dispute resolution, responsible gaming review
Customer support records	3 years from last interaction	Quality assurance, dispute resolution
Marketing consent records	Duration of consent + 2 years after withdrawal	Proof of lawful basis for marketing
Server logs & access logs	12 months from creation	Security monitoring, fraud investigation
Analytics data (anonymised)	Indefinite (no personal data linkage)	Platform improvement — outside scope of this policy

At the end of the applicable retention period, personal data is securely deleted or permanently anonymised. Deletion is carried out using industry-standard data sanitisation methods that prevent recovery of the deleted information.

11. International Data Transfers

55bat operates servers and infrastructure in multiple jurisdictions to ensure platform availability and redundancy for Bangladesh-based players. As a result, your personal data may be transferred to and processed in countries outside Bangladesh. These countries may have data protection laws that differ from those applicable in Bangladesh.

When we transfer your personal data internationally, we implement appropriate safeguards to ensure that your data receives an equivalent level of protection regardless of where it is processed. These safeguards include:

• Standard Contractual Clauses (SCCs): Where personal data is transferred to a third-party processor in a country without an equivalent data protection framework, we require that processor to enter into Standard Contractual Clauses that impose data protection obligations equivalent to those in this Privacy Policy.
• Data Processing Agreements: All third-party processors who handle 55bat player data — including payment processors, game providers, and KYC providers — are required to sign a Data Processing Agreement (DPA) that specifies the purpose, scope, duration, and security requirements of their data processing on our behalf.
• Adequacy Assessments: Before transferring personal data to a new jurisdiction or new third-party processor, 55bat conducts a Transfer Impact Assessment to evaluate the legal and security environment in the destination country and to confirm that adequate protections are in place.

12. Children's Privacy

The 55bat platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes a mandatory date-of-birth verification step, and our KYC process verifies age against government-issued identity documents.

If 55bat becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, delete all associated personal data, and reverse any transactions associated with that account. If you are a parent or guardian and believe that your child has registered an account on 55bat, please contact us immediately at [email protected] so that we can take prompt remedial action.

55bat also supports the national responsible gaming framework and encourages parents to use internet filtering tools to prevent minors from accessing online gambling websites. If you are concerned about a young person's access to gambling content, please contact our responsible gaming support team.

13. Marketing Communications

55bat sends promotional communications — including bonus offers, new game announcements, sports betting promotions, and seasonal campaigns relevant to the Bangladesh market — only to players who have given explicit consent to receive them. Consent is obtained at the point of registration via a clearly labelled, unticked opt-in checkbox. We do not use pre-ticked boxes or inferred consent for marketing purposes.

13.1 Types of Marketing We Send

• Deposit bonus and free bet promotions
• New game launch announcements (slots, live casino, sports)
• Cricket season promotions — BPL, IPL, T20 World Cup, Bangladesh Tigers matches
• Seasonal offers for Eid, Pohela Boishakh, Victory Day (December 16), and other Bangladesh cultural occasions
• Loyalty programme and VIP tier updates
• Responsible gaming reminders and account activity summaries

13.2 How to Opt Out

You may withdraw your marketing consent at any time using any of the following methods:

• Click the "Unsubscribe" link at the bottom of any promotional email from 55bat
• Log in to your 55bat account, navigate to Account Settings > Notifications, and disable promotional communications
• Contact our support team by email at [email protected] with the subject line "Marketing Opt-Out"

Opt-out requests are processed within 5 business days. Withdrawing marketing consent does not affect your ability to use 55bat's platform or services, and it does not affect any other processing of your personal data that is based on a different legal ground (e.g., contractual necessity or legal obligation).

14. Third-Party Links

The 55bat website may contain links to third-party websites, partner pages, or external resources. These links are provided for informational purposes only. 55bat does not control the content, privacy practices, or data handling procedures of any third-party website, and this Privacy Policy does not apply to any website that we do not operate.

We encourage you to review the privacy policy of any third-party website you visit before submitting any personal data. 55bat accepts no responsibility or liability for the privacy practices of third-party websites, even where a link to that website appears on 55bat.io.

15. Changes to This Privacy Policy

55bat reviews this Privacy Policy on a regular basis to ensure that it accurately reflects our current data processing practices and remains compliant with our legal obligations. We may update this Privacy Policy from time to time for the following reasons:

• Changes to the services we offer or the way we deliver them
• Introduction of new data processing activities or new third-party partners
• Changes in applicable law or regulatory guidance
• Corrections of factual errors or clarifications of existing language

When we make material changes to this Privacy Policy — that is, changes that meaningfully affect your rights or the way we process your personal data — we will notify you at least 14 days before the changes take effect. Notification will be delivered via email to your registered address and via an in-platform banner on 55bat.io. For minor, non-material changes (such as typographical corrections), we will update the "Effective Date" at the top of this document without issuing a separate notification.

Your continued use of the 55bat platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with a material change to this Privacy Policy, you have the right to close your account and request deletion of your personal data before the changes take effect, subject to our legal retention obligations described in Section 10.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 55bat handles your personal data, please contact our Data Protection team using the details below. All contact details are provided as plain text — please copy them manually.

We aim to respond to all privacy-related enquiries within 5 business days and to resolve all formal data subject rights requests (Section 9) within 30 calendar days. If your request is complex or involves a large volume of data, we may extend the response period by a further 30 days — in which case we will notify you of the extension and the reason for it within the initial 30-day window.