09bad Privacy Policy
Your Data, Your Rights, Our Responsibility

Who We Are & Scope of This Policy

This Privacy Policy is issued by 09bad (referred to throughout as "09bad", "we", "us", or "our"), the operator of the online betting and casino platform accessible at https://09bad.io and all associated subdomains and mobile web interfaces.

This Policy applies to all personal data we process in connection with:

• The registration, maintenance, and closure of player accounts on the 09bad platform.
• The use of any betting, gaming, or casino product offered through the platform.
• Deposits and withdrawals processed via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment channels available within the platform.
• Communications between you and the 09bad support team, including live chat, email, and WhatsApp correspondence.
• Your visits to the 09bad website, including pages you view, features you interact with, and technical data collected automatically by our servers.

This Policy does not apply to third-party websites, payment provider portals, or game provider platforms that may be accessed via links within the 09bad interface. Those services operate under their own independent privacy policies, which we encourage you to review separately.

Data We Collect

09bad collects personal data in two ways: data you provide to us directly, and data collected automatically when you use the platform. The categories of data we collect are described in the table below.

We do not knowingly collect or process sensitive special-category data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data used for identification, or health data) except where strictly required by law or where you have provided it voluntarily in the context of a responsible gaming self-exclusion request.

How We Use Your Data

09bad processes your personal data for the following purposes:

• Account Management: To create, maintain, and close your player account; to authenticate your identity at login; and to communicate important account-related information to you.
• KYC & Age Verification: To verify that you meet the minimum age requirement of 21 years, and to confirm your identity in compliance with our anti-money-laundering obligations. This is a condition of continued access to the platform.
• Payment Processing: To initiate and reconcile deposits and withdrawals via your chosen payment method; to verify that withdrawal requests are made to a payment method registered in your name; and to investigate and resolve any payment disputes.
• Platform Operation: To settle bets and casino game outcomes; to calculate and credit bonuses; to provide customer support; and to operate all features of the 09bad platform.
• Security & Fraud Prevention: To detect and prevent unauthorised account access, multi-account abuse, money laundering, match-fixing, and other prohibited conduct as defined in the 09bad Terms & Conditions.
• Responsible Gaming: To monitor account activity for indicators of problem gambling behaviour, to apply deposit limits or cooling-off periods you have requested, and to action self-exclusion requests.
• Platform Analytics & Improvement: To understand how players navigate the platform, which features are most used, and where technical errors occur, so that we can continually improve the quality of the service.
• Legal Compliance: To meet our obligations under applicable financial crime legislation, record-keeping requirements, and any lawful requests from regulatory or law enforcement authorities.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about new features — but only where you have opted in to receive such communications and only via the channels you have authorised. See Section 11 for your marketing preferences options.

Legal Basis for Processing

09bad processes your personal data only where there is a recognised legal basis for doing so. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing your identity data, contact data, financial data, and account activity data is necessary to fulfil our contractual obligations to you as a registered player — specifically, to operate your account and deliver the betting and gaming services you have signed up for.
• Legal Obligation: Processing your identity and financial data for KYC verification, age checks, and anti-money-laundering purposes is required by applicable financial regulations and is not optional.
• Legitimate Interests: Processing technical data and account activity data for security monitoring, fraud prevention, responsible gaming oversight, and platform analytics is carried out on the basis of our legitimate interest in operating a safe, fair, and well-functioning platform. We have assessed that this interest is not overridden by your right to privacy.
• Consent: Processing your data for marketing communications is carried out only on the basis of your explicit opt-in consent, which you may withdraw at any time. See Section 11.

Data Sharing & Third Parties

09bad does not sell, rent, or trade your personal data to any third party. We share your data only in the following limited and controlled circumstances:

• Payment Processors: We share necessary financial and identity data with bKash, Nagad, Rocket, Upay, and other payment service providers to process your transactions. Each of these providers operates under its own regulated privacy framework and is bound by contractual data protection obligations when handling data shared by 09bad.
• KYC & Identity Verification Providers: We may use a third-party identity verification service to assist with document checking and age verification as part of the KYC process. Such providers receive only the data necessary to complete the verification and are prohibited from using it for any other purpose.
• Game Content Providers: Live casino and slot game providers such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive a session token or anonymised player identifier to facilitate game play. These providers do not receive your full identity data.
• Analytics & Platform Performance Tools: We use server-side analytics tools to monitor platform performance and error rates. These tools process technical and usage data in aggregated or pseudonymised form and are configured to avoid transferring personally identifiable information to third-party servers.
• Law Enforcement & Regulatory Authorities: We will disclose personal data to law enforcement or regulatory bodies where required to do so by law, court order, or applicable regulatory obligation, or where we have a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or harm to a person.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the 09bad business, player data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

Cookies & Tracking Technologies

The 09bad platform uses cookies and similar browser-based storage mechanisms to deliver a functional, personalised, and secure user experience. The types of cookies we use are described below:

• Essential / Session Cookies: These cookies are strictly necessary to operate the platform. They maintain your login session, remember your account preferences, and ensure that the platform behaves correctly across page navigations. Disabling these cookies will prevent the platform from functioning properly.
• Security Cookies: Short-lived cookies used to support CSRF (cross-site request forgery) protection and other security mechanisms that prevent unauthorised actions being taken on your account without your knowledge.
• Analytics Cookies: We use server-side and privacy-preserving analytics tools to understand how players interact with the platform — for example, which pages are visited most, where errors occur, and how long sessions last on average. This data is processed in aggregated form and does not identify individual players by name.
• Preference Cookies: Cookies that remember your display preferences, such as your chosen language or notification settings, so that you do not need to re-configure them on every visit.

09bad does not use third-party advertising cookies, retargeting pixels, social media tracking scripts, or any cookie technology that tracks your behaviour on websites outside of the 09bad platform.

You may manage or delete cookies through your browser settings at any time. Please note that disabling essential cookies will impair the functionality of your account and may prevent you from logging in or placing bets.

Data Retention

09bad retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention periods we apply are as follows:

• Account Data (active accounts): Retained for the duration of your account's existence on the platform.
• Account Data (closed accounts): Retained for a minimum of five (5) years following account closure, in accordance with anti-money-laundering record-keeping requirements applicable to financial services platforms.
• Transaction & Betting Records: Retained for a minimum of five (5) years from the date of each transaction, as required for financial audit and regulatory compliance purposes.
• KYC & Identity Verification Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Support Communications: Retained for three (3) years from the date of the last communication, unless the communication forms part of an ongoing legal matter, in which case retention continues for the duration of that matter.
• Technical & Log Data: Retained for up to twelve (12) months from collection, after which it is deleted or irreversibly anonymised.
• Marketing Consent Records: Retained for the duration of your consent plus three (3) years, to evidence compliance with our marketing obligations.

Once the applicable retention period expires and no overriding legal obligation requires further retention, your data is securely deleted or irreversibly anonymised.

Data Security

09bad implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include but are not limited to:

• Encryption in Transit: All communications between your browser or device and the 09bad platform are secured using TLS 1.3, the current industry standard for transport-layer encryption.
• Encryption at Rest: Sensitive stored data, including password hashes, payment method identifiers, and identity document details, is encrypted at rest using strong encryption algorithms.
• Access Controls: Access to player data within 09bad's internal systems is restricted on a role-based, need-to-know basis. Staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• Intrusion Detection: 09bad operates automated monitoring systems designed to detect and alert on unusual access patterns, potential account takeover attempts, and other indicators of malicious activity.
• Penetration Testing: The 09bad platform undergoes periodic security assessments conducted by independent security professionals. Identified vulnerabilities are prioritised and remediated promptly.
• Incident Response: In the event of a security breach that affects player personal data, 09bad will assess the scope and severity of the breach within 72 hours and notify affected players promptly where there is a material risk to their rights or interests.

Your Rights as a Data Subject

As a player on the 09bad platform, you have the following rights in relation to your personal data. These rights may be exercised by contacting us at [email protected] with the subject line "DATA RIGHTS REQUEST":

• Right of Access: You have the right to request a copy of the personal data that 09bad holds about you. We will provide this information within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic contact details directly within your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no overriding legal obligation requires us to retain it. Note that we are required to retain certain records for regulatory purposes even after account closure, as described in Section 7.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances — for example, while you dispute the accuracy of data we hold, or where you have objected to processing and we are assessing that objection.
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format, so that you can transfer it to another service if you wish.
• Right to Object: You have the right to object to the processing of your data where we rely on our legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We aim to respond to all data rights requests within 30 calendar days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

Children & Age Verification

The 09bad platform is strictly for adults. The minimum age to register an account or place any bet is 21 years. We do not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of the account registration process and again at the point of the first withdrawal request. Where we discover or have reasonable grounds to believe that an account is held by a person under 21, we will immediately suspend the account, void any associated wagers and balances, and delete the personal data of the minor as promptly as our legal obligations permit.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account on the 09bad platform, please contact us immediately at [email protected]. We will investigate and take appropriate action within 24 hours of receiving your notification.

Marketing Communications

09bad may send you promotional communications about new games, bonus offers, seasonal promotions (such as BPL season offers, Eid specials, or Pohela Boishakh promotions), and platform updates. We will only send you marketing communications where you have explicitly opted in to receive them.

Marketing communications may be delivered via email or SMS to the contact details registered on your account. We will never send unsolicited marketing communications to contact details you have not provided to us.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link included in every marketing email we send.
• Updating your communication preferences in the Notifications section of your account settings.
• Contacting support at [email protected] with the subject line "UNSUBSCRIBE".

Opting out of marketing communications does not affect the delivery of transactional and account-related communications, such as deposit confirmations, withdrawal notifications, and security alerts, which are sent regardless of your marketing preferences because they are necessary to operate your account.

International Data Transfers

09bad primarily processes and stores player data on servers located within secure data centres. Where it is necessary to transfer personal data to a third-party service provider or technology partner located outside Bangladesh — for example, a KYC verification provider or a game platform operated by an international game studio — we ensure that appropriate safeguards are in place to protect the data during and after the transfer.

Such safeguards include contractual data processing agreements that bind the recipient to data protection standards consistent with those described in this Privacy Policy, and in particular prohibit the recipient from using the transferred data for any purpose other than delivering the specific service for which the transfer was made.

Changes to This Policy

09bad reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. When we make material changes — that is, changes that affect the nature of the data we collect, the purposes for which we use it, or the rights available to you — we will provide advance notice of at least seven (7) days before the new version takes effect.

Notice will be delivered via email to your registered address and/or via an in-platform notification when you next log in. The updated policy will also be published on this page with a revised "Last Updated" date at the top of the document.

Your continued use of the 09bad platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with any material change, you may close your account by contacting support prior to the effective date of the change.

Contact & Data Enquiries

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about the way 09bad handles your personal data, please contact us through any of the following channels:

• Email: [email protected] — For data rights requests, use the subject line "DATA RIGHTS REQUEST". For privacy concerns, use "PRIVACY ENQUIRY".
• Live Chat: Available 24/7 through your logged-in account on the 09bad platform.
• WhatsApp: +880 1800 090909 — Available during Bangladesh Standard Time (BST, UTC+6) support hours.

We aim to acknowledge all privacy-related enquiries within one (1) business day and to provide a substantive response within 30 calendar days. If your enquiry or request is particularly complex, we may require up to 60 calendar days in total, and we will keep you informed of progress throughout.

All contact details above are provided as plain text for informational purposes only. Email and phone contacts on the 09bad platform are not clickable links — they are displayed as text to be used at your discretion through your preferred communication application.