bi88 Privacy Policy — Your Data, Protected

1 Introduction

Welcome to the bi88 Privacy Policy. bi88 ("the Company", "we", "us", "our") operates the online casino and sports betting platform accessible at bi88.io, providing services to players primarily based in Bangladesh. The protection of your personal data is a matter of serious importance to us, and this Privacy Policy is designed to be transparent about our data practices so that you can make an informed decision about using our platform.

This Privacy Policy applies to all personal data collected through the bi88 website, mobile web interface, customer support channels (including email), and any other means by which you interact with the Company. It explains:

• What categories of personal data bi88 collects about you.
• The purposes for which that data is collected and processed.
• The legal basis on which we rely to process your data.
• How long we retain your data and how it is secured.
• The rights you have in relation to your personal data and how to exercise them.

This Privacy Policy should be read together with the bi88 Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and the Company.

2 Data Controller

For the purposes of applicable data protection legislation, bi88 acts as the data controller in respect of the personal data you provide when registering for and using the platform. As data controller, bi88 determines the purposes and means by which your personal data is processed.

Where bi88 engages third-party service providers to process data on its behalf (for example, payment processors, identity verification agencies, or IT infrastructure providers), those parties act as data processors operating under contractual obligations that restrict their use of your data to the specific purposes authorised by bi88.

All formal data-related correspondence, subject access requests, and privacy complaints should be directed to the bi88 support team. Contact details are provided in Article 16 of this policy.

3 Personal Data We Collect

bi88 collects the following categories of personal data. The specific data points collected in each category are described in the table below:

4 How We Collect Your Data

bi88 collects personal data through the following channels and mechanisms:

• Direct input by you: When you register an account, complete your profile, submit KYC documents, make a deposit or withdrawal, contact customer support, or respond to a promotional communication, you provide data directly to bi88.
• Automated collection: When you browse the bi88 website or use the platform, our servers automatically collect Technical Data and Usage Data through server logs, cookies, and similar tracking technologies (see Article 8 for details on cookies).
• Third-party sources: bi88 may receive personal data from identity verification providers (to confirm the accuracy of the documents you submit), payment processors (to confirm transaction status), and fraud-detection services (to flag suspicious activity patterns). In all cases, data from these sources is used solely to supplement your profile for the purposes described in this policy.
• Responsible gaming referrals: If you contact a problem-gambling helpline or support organisation that refers you to bi88's self-exclusion service, we may receive limited data from that organisation to process your exclusion request promptly.

5 Legal Basis for Processing

bi88 processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: Processing is necessary to perform the contract between you and bi88 — for example, to create and manage your account, process deposits and withdrawals, and deliver gaming services.
• Legal obligation: Processing is required to comply with anti-money-laundering (AML) regulations, Know Your Customer (KYC) obligations, and other applicable legal requirements, including the retention of financial records for statutory periods.
• Legitimate interests: bi88 has a legitimate interest in processing certain data to detect and prevent fraud, collusion, and other prohibited conduct; to secure its platform against cyberattacks; to conduct analytics that improve the platform's performance and user experience; and to enforce its Terms & Conditions.
• Consent: Where bi88 sends marketing communications or uses non-essential cookies, it does so only on the basis of your explicit consent, which you may withdraw at any time.

6 How We Use Your Data

The personal data collected by bi88 is used for the following specific purposes:

• Account management: Creating, verifying, and maintaining your bi88 account; authenticating your identity on each login; managing account settings and preferences.
• KYC and identity verification: Verifying that you are who you claim to be; confirming that you meet the minimum age requirement of 21 years; screening against sanctions lists and politically exposed persons (PEP) databases as required by AML obligations.
• Transaction processing: Receiving your deposits, processing withdrawal requests, recording transaction histories, and resolving payment disputes.
• Customer support: Responding to your queries, complaints, and requests; maintaining records of support interactions for quality assurance.
• Platform security and fraud prevention: Monitoring account and betting activity for signs of fraud, collusion, bonus abuse, money laundering, or other prohibited conduct; blocking suspicious IP addresses; enforcing account limits.
• Responsible gaming: Monitoring for indicators of problem gambling behaviour; enforcing deposit limits, session limits, and self-exclusion orders; facilitating cooling-off periods.
• Marketing and promotions: Sending promotional emails, bonus notifications, and personalised offers to players who have opted in to marketing communications.
• Platform analytics and improvement: Analysing aggregate usage patterns to improve game selection, website performance, and user interface design. This analysis is conducted on anonymised or pseudonymised data wherever possible.
• Legal and regulatory compliance: Retaining records as required by law; responding to lawful requests from government authorities; enforcing our Terms & Conditions and resolving legal disputes.

7 Data Sharing & Third Parties

bi88 does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own marketing purposes under any circumstances. Data may be shared with the following categories of third party, but only to the extent strictly necessary:

• Payment service providers: bKash, Nagad, Rocket, Upay, and card processing partners receive the minimum data necessary to authenticate and complete your financial transactions. These providers operate under their own privacy policies and regulatory obligations.
• Identity verification agencies: Third-party KYC and AML screening providers receive the identity documents and data you submit for verification purposes. They are contractually prohibited from using this data for any purpose other than verification on behalf of bi88.
• IT and infrastructure providers: Cloud hosting providers, database administrators, and cybersecurity firms that support the operation of the bi88 platform may process personal data in their capacity as data processors under strict contractual controls.
• Game studios and content providers: Where technically necessary for the delivery of live casino or slot content (e.g., Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi), limited session-level data such as your player ID and bet history within a session may be transmitted to the relevant studio's systems. No personal identity data is shared with game studios beyond what is strictly required for game delivery.
• Legal and regulatory authorities: bi88 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, or where disclosure is necessary to protect the rights, property, or safety of the Company, its players, or third parties.
• Professional advisers: Lawyers, auditors, and insurers may receive personal data where necessary in connection with their professional services to bi88, subject to confidentiality obligations.

8 Cookies & Tracking Technologies

bi88 uses cookies and similar technologies (such as pixel tags and local storage) to operate the platform, enhance your experience, and collect analytics data. The following categories of cookie are used:

• Strictly necessary cookies: These are essential for the platform to function. They maintain your login session, remember your language and regional settings, and enable secure transactions. These cookies cannot be disabled without preventing core platform functionality.
• Functional cookies: These remember preferences you have set (such as responsible gaming limits you have configured) so that they persist across sessions.
• Analytics cookies: These collect anonymised data about how players navigate the bi88 website — which pages are visited most frequently, where users drop off, and how long sessions typically last. This data is used solely to improve platform performance and user experience.
• Security cookies: These help detect and prevent fraudulent activity, bot traffic, and credential-stuffing attacks by analysing behavioural signals associated with your session.

bi88 does not use advertising or retargeting cookies. No cross-site tracking is conducted for the purpose of displaying advertisements on third-party websites.

You can manage or disable cookies through your browser's settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in or conducting transactions on the platform.

9 Data Retention

bi88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and reporting requirements. The following retention guidelines apply:

• Active account data: Retained for the duration of your registered account plus a minimum of five years following account closure, to comply with AML record-keeping obligations.
• Transaction and financial records: Retained for a minimum of seven years in accordance with financial record-keeping requirements applicable to online payment platforms operating in Bangladesh.
• KYC and identity documents: Retained for a minimum of five years from the date of the last transaction or account closure, whichever is later.
• Customer support communications: Retained for three years from the date of the interaction, unless the communication is part of an ongoing dispute or regulatory inquiry.
• Marketing preference records: Retained until you withdraw consent, plus one year to demonstrate compliance with the opt-out request.
• Self-exclusion records: Permanently retained to ensure that self-excluded players cannot re-register. This is a responsible gaming requirement and cannot be overridden by a request for erasure.
• Technical and usage data (server logs): Retained for 90 days for security and debugging purposes, then anonymised or deleted.

Where data is no longer needed and no legal retention obligation applies, bi88 will securely delete or irreversibly anonymise it.

10 International Data Transfers

bi88 primarily stores and processes personal data on servers located in jurisdictions with appropriate data protection standards. In some cases, data may be transferred to or accessed from countries outside Bangladesh — for example, when game content is streamed from a studio's servers in another country, or when a cloud infrastructure provider processes data in a different region.

Where such transfers occur, bi88 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses in agreements with data processors that obligate them to maintain data protection standards equivalent to those applied by bi88.
• Use of service providers that are certified under recognised data security frameworks.
• Data minimisation — ensuring that only the minimum data necessary is transmitted outside Bangladesh, and that it is transmitted in encrypted form.

If you have questions about the countries to which your data may be transferred, you may contact the bi88 support team using the details in Article 16.

11 Security Measures

bi88 takes the security of your personal data seriously and has implemented a range of technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:

• SSL/TLS encryption: All data transmitted between your device and bi88 servers is encrypted using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser's address bar when using the platform.
• Password hashing: Your account password is never stored in plain text. It is processed through a one-way cryptographic hashing algorithm so that even bi88 staff cannot read your password.
• Access controls: Access to personal data within bi88's internal systems is restricted on a need-to-know basis. Staff with access to sensitive data are subject to confidentiality obligations and regular security training.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their bi88 accounts for an additional layer of login security.
• Intrusion detection: bi88's platform is monitored around the clock for signs of unauthorised access, data exfiltration attempts, and other cybersecurity threats.
• Regular security audits: The platform undergoes periodic penetration testing and vulnerability assessments by qualified security professionals.

Despite these measures, no internet-connected platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bi88 will notify affected players without undue delay in accordance with applicable legal obligations.

12 Your Data Rights

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data bi88 holds about you:

• Right of access: You may request a copy of the personal data bi88 holds about you (commonly known as a Subject Access Request or SAR). We will provide this information within a reasonable period of receiving your verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. Please update your account details directly in the platform settings, or contact support for changes that cannot be made self-service.
• Right to erasure: In certain circumstances, you may request that we delete the personal data we hold about you. This right is not absolute — we may be required to retain certain data to comply with legal obligations (for example, AML record-keeping requirements). Where erasure is not possible in full, we will inform you of what data must be retained and why.
• Right to restriction of processing: You may ask bi88 to restrict the processing of your data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on bi88's legitimate interests. We will consider your objection and cease processing unless we have compelling legitimate grounds that override your interests, or the processing is necessary for the establishment or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, please contact the bi88 support team at the email address provided in Article 16. For security purposes, we will need to verify your identity before acting on any request. We aim to respond to all verified requests within 30 days.

13 Children & Age Verification

bi88 strictly prohibits the use of its platform by anyone under the age of 21. The Company considers the protection of younger individuals from exposure to gambling services to be a fundamental obligation, and takes a zero-tolerance approach to underage gambling.

The following measures are in place to enforce the minimum age requirement:

• All new registrants are required to confirm that they are 21 years of age or older during the registration process.
• KYC verification, which is required before any withdrawal is processed, includes mandatory confirmation of date of birth against a government-issued photo ID document.
• Where bi88 has reasonable grounds to suspect that an account holder may be under the age of 21, the account will be immediately suspended pending age verification. Any winnings accrued during the period of suspected underage use may be withheld pending investigation.
• No marketing communications are directed at individuals who have not confirmed their age through the registration and KYC process.

bi88 does not knowingly collect or process personal data relating to children under the age of 18. If you become aware that a minor has registered an account or provided personal data to bi88, please contact support immediately so that the account can be closed and the data deleted.

14 Responsible Gaming & Data

Certain personal data collected by bi88 serves a dual purpose: it is processed both as part of normal account management and as an input into the Company's responsible gaming monitoring systems. This article explains how data is used specifically in the responsible gaming context.

bi88 analyses Usage Data, Financial Data, and Account Data to identify behavioural patterns that may indicate problem gambling — such as rapidly escalating deposit amounts, unusually long session durations, attempts to circumvent deposit limits, or a high frequency of loss-chasing behaviour. Where such patterns are detected, bi88 may:

• Display a responsible gaming alert to the player during their session.
• Proactively reach out via email to offer information about responsible gaming tools.
• Apply temporary deposit restrictions pending a welfare check.
• Refer the player to external support resources.

Self-exclusion data (including the duration and scope of any exclusion, and the reason if provided) is retained permanently and is never deleted, as its ongoing availability is essential to enforcing exclusion orders and preventing problem gamblers from re-registering. This represents an overriding public interest that takes precedence over a data erasure request.

For more detailed information on responsible gaming tools and support resources, please visit the bi88 Responsible Gaming page.

15 Changes to This Privacy Policy

bi88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, we will notify registered players by email and/or by displaying a prominent notice on the bi88 platform prior to the changes taking effect.

The date at the top of this policy indicates when it was last revised. We encourage you to review this page periodically to stay informed about how we protect your data. Your continued use of the bi88 platform following the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

If you do not agree with any material change to this policy, you are entitled to close your account and withdraw any remaining balance in accordance with the process described in the bi88 Terms & Conditions.

16 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the personal data bi88 holds about you — including Subject Access Requests, rectification requests, erasure requests, and marketing opt-out requests — please contact the bi88 Data Support team. The contact email is provided below as plain text and is not a clickable link:

Support Email: [email protected]

Please use the subject line " Privacy Request" so that your message is routed to the correct team. We aim to acknowledge all privacy-related correspondence within 2 business days and to provide a substantive response within 30 calendar days of receiving a verified request.

If you are not satisfied with bi88's handling of your privacy request or complaint, you may escalate the matter through any applicable dispute resolution mechanism described in the bi88 Terms & Conditions.