da77 Privacy Policy — How We Handle Your Personal Data

1. Introduction

da77 ("da77", "we", "us", "our") operates the online betting and casino platform accessible at https://da77.io and all associated subdomains and mobile interfaces (collectively, the "Platform"). This Privacy Policy describes how we collect, process, store, share, and protect the personal data of players and visitors ("you", "your") who use the Platform.

da77 is the data controller responsible for your personal data. We are committed to handling your personal information with transparency, integrity, and in accordance with applicable data protection principles. Our Platform is designed specifically for the Bangladesh market, and all data practices described in this Policy are implemented with Bangladeshi players in mind.

This Privacy Policy should be read alongside the da77 Terms & Conditions, which form the primary agreement governing your use of the Platform. The Terms & Conditions are incorporated into this Policy by reference. In the event of any conflict between this Policy and the Terms & Conditions on data-related matters, this Privacy Policy shall take precedence.

If you are under the age of 21, you are not permitted to use the da77 Platform. da77 does not knowingly collect personal data from individuals under the age of 21. See Section 10 for our full Children's Privacy statement.

2. Data We Collect

da77 collects personal data from you in three primary ways: data you provide directly, data generated automatically through your use of the Platform, and data received from authorised third parties. The following table summarises the categories of personal data we collect and the primary context in which each category is gathered.

2.1 Data You Provide Directly

When you register a da77 account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you actively provide us with personal data. It is your responsibility to ensure that all data you provide is accurate, current, and complete. Providing false or misleading personal data is a breach of the da77 Terms & Conditions.

2.2 Automatically Collected Data

When you visit the da77 Platform, certain technical and usage data is collected automatically through cookies, web beacons, log files, and similar tracking technologies. This data is used primarily to maintain Platform security, optimise user experience, detect fraud, and ensure the integrity of our gaming systems. Please see Section 6 for full details of our cookie practices.

2.3 Data from Third Parties

da77 may receive personal data about you from authorised third-party sources, including payment service providers (such as bKash, Nagad, and Rocket) confirming transaction details, identity verification services used for KYC compliance, fraud prevention and anti-money-laundering screening services, and game technology providers where relevant to your gaming activity on the Platform.

3. How We Use Your Data

da77 uses the personal data we collect for the following defined purposes. We do not use your personal data for any purpose that is incompatible with those listed below without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

• Account Management: Creating, maintaining, and securing your da77 player account, including password reset, account recovery, and account status communications;
• Service Delivery: Processing your bets, crediting winnings, managing deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other accepted payment channels, and delivering all gaming services available on the Platform;
• Identity & Age Verification (KYC): Verifying that you are who you claim to be and that you are at least 21 years of age, in compliance with da77's legal and responsible gaming obligations;
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, money laundering, identity theft, unauthorised account access, and other illegal or prohibited activities on the Platform;
• Responsible Gaming Compliance: Monitoring gaming patterns to identify potential problem gambling behaviour, administering self-exclusion and deposit limit tools, and flagging accounts for responsible gaming review where warranted;
• Customer Support: Responding to your queries, complaints, and requests submitted via email or live chat, and maintaining records of support interactions for quality assurance purposes;
• Platform Improvement: Analysing aggregated usage data to improve the functionality, design, and content of the da77 Platform, and to develop new features and products for Bangladeshi players;
• Marketing & Promotions: Sending you promotional offers, bonus notifications, and personalised recommendations where you have opted in to receive such communications. You may withdraw marketing consent at any time — see Section 12;
• Legal Compliance: Meeting da77's obligations under applicable law, including anti-money-laundering regulations, data protection requirements, and responding to lawful requests from competent authorities.

4. Legal Basis for Processing

da77 processes your personal data on the following legal bases, depending on the category of data and the purpose of processing:

• Contractual Necessity: Processing that is required to perform the contract between you and da77 — including account creation, payment processing, bet settlement, and KYC verification — is carried out on the basis of contractual necessity;
• Legal Obligation: Processing carried out to comply with da77's legal obligations under applicable law — including anti-money-laundering checks, age verification, and responding to lawful authority requests — is carried out on the basis of legal obligation;
• Legitimate Interests: Processing carried out for fraud prevention, Platform security, responsible gaming monitoring, and internal analytics is carried out on the basis of da77's legitimate interests, provided those interests are not overridden by your privacy rights;
• Consent: Processing carried out for marketing communications, non-essential cookies, and any other discretionary data use is carried out only where you have given your explicit, informed, and freely withdrawable consent. You may withdraw consent at any time without prejudice to the lawfulness of processing carried out before withdrawal.

5. Sharing Your Data

da77 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Your personal data may be shared with third parties only in the following specific circumstances, and only to the minimum extent necessary for the relevant purpose:

5.1 Payment Service Providers

To process your deposits and withdrawals, da77 shares necessary financial and identity data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. These providers are authorised to use your data only to process the specific transaction requested and are bound by their own data protection policies.

5.2 Identity Verification Services

da77 uses authorised third-party identity verification and KYC service providers to verify your identity and age as required by our responsible gaming and compliance obligations. These providers process your identity documents and personal data under strict contractual data processing agreements with da77.

5.3 Game Technology Providers

Certain games on the da77 Platform are powered by third-party technology providers including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe. These providers may receive limited technical data (such as session tokens and game outcomes) necessary to deliver their game services. They are prohibited from using this data for any purpose other than providing the contracted service.

5.4 Fraud Prevention & AML Screening

da77 may share personal data with fraud prevention agencies, anti-money-laundering screening services, and law enforcement or regulatory authorities where required by applicable law or where da77 has reasonable grounds to suspect fraudulent or criminal activity. Such sharing is carried out on the basis of legal obligation or legitimate interest.

5.5 Professional Advisers

da77 may share personal data with legal advisers, auditors, and accountants where necessary for the provision of professional services to da77, subject to appropriate confidentiality obligations.

5.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of da77's business, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any material change to the way your data is processed as a result.

6. Cookies & Tracking Technologies

da77 uses cookies and similar tracking technologies (including web beacons and pixel tags) to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They maintain your login session, enable secure transactions, and support core security features. These cookies cannot be disabled without significantly impairing Platform functionality;
• Performance & Analytics Cookies: These cookies collect anonymised data about how visitors use the Platform — including which pages are most visited, how long sessions last, and where errors occur — enabling da77 to improve Platform performance. These cookies require your consent;
• Functional Cookies: These cookies remember your preferences (such as language settings, notification preferences, and responsible gaming configurations) to provide a more personalised experience. These cookies require your consent;
• Security & Fraud Detection Cookies: These cookies assist da77 in identifying and preventing fraudulent activity, account takeover attempts, and bot-driven abuse of the Platform. They are classified as strictly necessary for security purposes.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary cookies may prevent you from accessing certain features of the da77 Platform. da77 does not use advertising or cross-site tracking cookies.

7. Data Security

da77 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the da77 Platform;
• AES-256 encryption for sensitive personal and financial data stored at rest on da77 servers;
• Multi-factor authentication options for player account access;
• Role-based access controls restricting access to personal data to authorised personnel only, on a need-to-know basis;
• Automated intrusion detection and real-time security monitoring systems;
• Regular penetration testing and security audits conducted by qualified information security professionals;
• Secure data destruction procedures for personal data that has reached the end of its retention period.

While da77 takes all reasonable and industry-standard precautions to secure your personal data, no data transmission over the internet or method of electronic storage is completely infallible. In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, da77 will notify affected players without undue delay in accordance with applicable data protection obligations.

8. Data Retention

da77 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, to meet our legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following retention periods apply to the primary categories of data held by da77:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five years following account closure, to comply with anti-money-laundering and responsible gaming record-keeping obligations;
• Financial Transaction Data: Retained for a minimum of five years from the date of the transaction, consistent with standard financial record-keeping requirements;
• Gaming Activity Data: Retained for the duration of your active account plus three years following account closure, for responsible gaming monitoring, dispute resolution, and platform integrity purposes;
• Customer Support Communications: Retained for three years from the date of the relevant interaction, for quality assurance and dispute resolution purposes;
• Technical and Usage Data (Logs): Retained for a maximum of 12 months, after which they are deleted or anonymised;
• Marketing Preferences: Retained until you withdraw your marketing consent or request deletion of your account, whichever is sooner.

At the end of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with you as an individual. Anonymised, aggregated data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

9. Your Data Rights

As a da77 player, you hold the following rights in relation to the personal data we process about you. To exercise any of these rights, please contact us at [email protected] with a clear description of your request and sufficient identifying information to allow us to verify your identity. We will respond to all verified data requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of the personal data da77 holds about you, together with information about how it is being processed. This is sometimes referred to as a Subject Access Request (SAR);
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by da77 be corrected or updated without undue delay;
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. This right is subject to overriding legal retention obligations — da77 may be required to retain certain data (e.g., financial transaction records) regardless of a deletion request;
• Right to Restrict Processing: You have the right to request that da77 restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested;
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of legitimate interests, including profiling. You also have an unconditional right to object to processing for direct marketing purposes at any time;
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. Children's Privacy

da77 is an adult-only platform. Access to and use of the da77 Platform is strictly restricted to individuals who are 21 years of age or older. da77 does not knowingly collect, process, or retain personal data from any individual under the age of 21.

During the registration process, da77 requires all applicants to confirm that they are at least 21 years of age and to provide a date of birth. Where da77 has reasonable grounds to believe that a registered player is under the age of 21, the account will be suspended immediately, all pending withdrawals will be withheld, and a mandatory age verification process will be initiated. If the age verification process confirms that the player is under 21, the account will be permanently closed, all funds will be returned to the payment source (less any amounts already paid out in error), and the matter may be reported to relevant authorities.

If you are a parent or guardian and believe that your child has registered an account on da77 and provided personal data without your consent, please contact us immediately at [email protected]. We will take immediate action to close the account and delete any associated personal data.

11. International Data Transfers

da77 is operated for the Bangladesh market. The majority of personal data processing takes place on infrastructure located within or serving the Bangladesh and South Asia region. However, certain third-party service providers — particularly game technology providers and cloud infrastructure operators — may process data on servers located outside Bangladesh.

Where personal data is transferred outside Bangladesh to a third-party processor, da77 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which applies within Bangladesh. Safeguards may include binding contractual data processing agreements incorporating standard data protection clauses, data transfer impact assessments, and technical security measures appropriate to the risk profile of the transfer.

da77 does not knowingly transfer personal data to jurisdictions with inadequate data protection standards without implementing the contractual safeguards described above. If you would like further information about the specific safeguards applied to international transfers of your personal data, please contact us at [email protected].

12. Marketing Communications

da77 may contact you with promotional offers, bonus notifications, tournament announcements, and other marketing communications where you have explicitly opted in to receive such communications at the time of account registration or subsequently through your account preferences.

Marketing communications from da77 may be delivered via email and/or SMS to the contact details registered on your account. da77 will never share your contact details with third parties for the purpose of third-party marketing without your explicit separate consent.

You may opt out of marketing communications from da77 at any time by:

• Clicking the "unsubscribe" link included in any da77 marketing email;
• Updating your communication preferences in your da77 account settings; or
• Contacting the da77 support team at [email protected] with a written opt-out request.

Opt-out requests will be processed within 5 business days. Please note that opting out of marketing communications does not affect da77's ability to send you transactional and service-related messages (such as deposit confirmations, withdrawal notifications, and account security alerts), which are sent on the basis of contractual necessity and cannot be unsubscribed from while your account remains active.

da77 will not send marketing communications to any player whose account is subject to an active self-exclusion period. All marketing is suspended automatically upon activation of self-exclusion.

13. Third-Party Links

The da77 Platform may contain references to third-party services, including payment method providers such as bKash, Nagad, and Rocket. Where such references involve links to external websites or applications, please be aware that those external platforms have their own privacy policies that operate independently of this Privacy Policy.

da77 is not responsible for the privacy practices or the content of any third-party websites or applications. We recommend that you review the privacy policy of any third-party platform before providing your personal data to that platform. da77's Privacy Policy applies solely to data collected and processed by da77 in connection with your use of the da77 Platform at https://da77.io.

14. Updates to This Privacy Policy

da77 reserves the right to update, amend, or replace this Privacy Policy at any time. When we make a material change to the Policy, we will:

• Publish the updated Privacy Policy on this page with a revised effective date clearly displayed at the top;
• Send an email notification to all registered da77 players at least 14 days before the updated Policy takes effect, summarising the key changes;
• Where required by applicable law, seek fresh consent from players whose data processing activities are materially affected by the change.

Your continued use of the da77 Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material change to the Privacy Policy, you have the right to close your da77 account and request deletion of your personal data (subject to legally mandated retention periods) before the updated Policy takes effect.

We encourage you to review this Privacy Policy periodically to stay informed about how da77 protects your personal data. Minor updates — such as corrections of typographical errors or clarifications that do not alter the substance of the Policy — may be made without prior notice, though the effective date will always be updated to reflect the date of the most recent revision.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or about how da77 handles your personal data, please contact our Data Support team using the details below. We are committed to addressing all privacy-related enquiries promptly and professionally.

Data Support Team — da77
Website: https://da77.io
Email: [email protected]
Support Hours: Monday to Sunday, 09:00 – 23:00 Bangladesh Standard Time (BST, UTC+6)

When contacting us about a data rights request or privacy concern, please include your registered username or email address and a clear description of your request or concern so that we can respond efficiently. We will acknowledge receipt of all privacy enquiries within 3 business days and aim to provide a full substantive response within 30 calendar days.

If you are not satisfied with our response to a privacy concern, you may have the right to escalate your complaint to a relevant data protection authority in accordance with applicable law. da77 will cooperate fully with any such regulatory enquiry.