bat366 Privacy Policy

Information We Collect

bat366 collects personal data that is necessary to operate a safe, compliant, and high-quality online betting and casino platform for players based in Bangladesh. We collect information in three principal ways: information you provide directly during registration or account use, information generated automatically when you interact with the bat366 platform, and information received from trusted third-party partners where applicable.

Information You Provide Directly:

• Registration data: Full legal name, date of birth, gender, email address, mobile number, and username provided when creating a bat366 account.
• Identity verification (KYC) documents: National Identity Card (NID), passport, driving licence, or other government-issued identification; proof of address documents such as utility bills or bank statements; selfie photographs where identity verification requires it.
• Payment information: bKash, Nagad, Rocket, or Upay mobile wallet numbers; bank account details or card details for bank-linked transactions. bat366 retains only the information necessary to process and reconcile transactions — full card numbers are never stored on bat366 servers.
• Support communications: Messages, emails, and chat transcripts exchanged with the bat366 support team at [email protected], including the content of your query and any attachments you provide.
• Responsible gaming submissions: Self-exclusion requests, deposit limit settings, session time preferences, and any disclosures you make when requesting support for problem gambling.

Information Collected Automatically:

• Device and browser data: IP address, browser type and version, operating system, device model, screen resolution, and language settings.
• Usage data: Pages visited on bat366, time and duration of sessions, games played, bet amounts, deposit and withdrawal history, bonus activity, and navigation patterns within the platform.
• Cookies and similar technologies: Session cookies, persistent cookies, and local storage tokens as described in the Cookies section below.
• Geolocation data: General geographic location derived from your IP address, used to verify eligibility and apply appropriate market settings. bat366 does not collect GPS-level precise location data.

How We Use Your Data

bat366 uses the personal data it collects strictly for the purposes set out in this Privacy Policy. We do not use your data for undisclosed purposes, and we do not use it in ways that are incompatible with the reason it was originally collected. The primary purposes for which bat366 processes personal data are as follows:

bat366 will send promotional emails or push notifications only to players who have explicitly opted in to marketing communications during registration or through their account settings. Players may withdraw this consent at any time by updating their communication preferences in their account dashboard or by contacting [email protected]. Withdrawal of consent for marketing communications does not affect the lawfulness of processing carried out before the withdrawal.

bat366 does not engage in automated decision-making or profiling that produces legal or significant effects on individual players without human review. Where algorithmic systems flag an account for fraud review or responsible gaming intervention, a member of the bat366 compliance or support team will review the case before any material action is taken.

Data Sharing & Disclosure

bat366 does not sell your personal data to third parties. We may share limited personal data with carefully selected third-party service providers and partners only where necessary to deliver the bat366 service. All third parties who receive personal data from bat366 are required to handle it in accordance with applicable data protection principles and are prohibited from using it for any purpose beyond the specific service they provide to bat366.

Categories of third parties who may receive your data:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard gateways receive only the transaction data necessary to process your deposit or withdrawal. bat366 shares the minimum data required for each transaction.
• Identity verification providers: Where bat366 uses a third-party KYC verification service to authenticate identity documents, that provider receives your submitted document images solely for verification. Verification providers are contractually prohibited from retaining your data beyond the verification window.
• Game and content providers: Casino game studios and sports data providers (such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, Microgaming, NetEnt) may receive anonymised session tokens to facilitate game play and display personalised game history within the bat366 platform. They do not receive your name, NID, or payment details.
• Analytics and security platforms: bat366 may use server-side analytics tools and fraud-detection services to monitor platform health. Data shared with these tools is pseudonymised where possible and is not used for third-party advertising profiling.
• Legal and regulatory authorities: bat366 may disclose personal data to law enforcement agencies, regulatory bodies, or financial intelligence units where required to do so by applicable law, court order, or for the prevention and detection of serious crime or money laundering. bat366 will inform affected players of such disclosures where legally permitted to do so.

Cookies & Tracking

bat366 uses cookies and similar browser-storage technologies to make the platform function correctly, to maintain your session while you are logged in, and to collect anonymised analytics data that helps us improve the platform experience for Bangladesh players. This section explains the types of cookies bat366 deploys and how you can manage them.

bat366 does not deploy third-party advertising cookies, retargeting pixels, or social media tracking scripts. You will not be tracked across other websites as a result of using bat366.

You may manage or delete cookies at any time via your browser settings. Most modern browsers allow you to block cookies from specific sites, clear all cookies on exit, or set granular cookie preferences. Please note that disabling strictly necessary cookies will prevent you from logging in to your bat366 account. Disabling functional or analytics cookies will not affect your ability to use the core platform but may reduce the quality of your experience.

Data Retention

bat366 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide. These periods may be extended where a legal obligation requires longer retention, or shortened where data is no longer needed and no legal hold applies.

• Active account data (name, email, contact details, transaction history): Retained for the duration of your active account relationship with bat366 and for a period of five (5) years following account closure, to satisfy record-keeping obligations applicable to online financial services platforms.
• KYC documents (NID copies, address verification): Retained for five (5) years from the date of verification or account closure, whichever is later, in accordance with anti-money-laundering record-keeping requirements.
• Transaction records (deposit and withdrawal history): Retained for five (5) years from the date of each transaction. This includes transaction amounts in BDT, payment methods used, timestamps, and processing statuses.
• Support communications: Retained for three (3) years from the date of the communication, unless the subject matter requires a longer retention period (for example, a dispute that remains unresolved or has been escalated).
• Marketing consent records: Retained for the duration of your account and for two (2) years following account closure or withdrawal of consent, to maintain a record of your communication preferences.
• Analytics data: Anonymised aggregated analytics data does not contain personal identifiers and is retained indefinitely for platform improvement purposes. Where analytics data retains any pseudonymous identifiers, those identifiers are deleted within twelve (12) months.
• Self-exclusion records: Retained for the duration of the exclusion period and for a minimum of five (5) years thereafter. This is necessary to enforce re-registration restrictions and to protect players who have requested self-exclusion.

When data reaches the end of its retention period and no legal hold applies, bat366 securely deletes or anonymises it in a manner that prevents reconstruction. Secure deletion applies to both electronic records and any physical copies of documents.

Data Security

bat366 implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. While no online platform can guarantee absolute security against all threats, bat366 maintains industry-standard safeguards appropriate to the nature of the personal data we hold and the risks associated with online betting platforms serving the Bangladesh market.

• Transport layer security: All communications between your browser and the bat366 platform are encrypted using TLS 1.3, the current industry gold standard for web encryption. Older, insecure protocol versions (SSLv3, TLS 1.0, TLS 1.1) are disabled on bat366 servers.
• Data at rest encryption: Personal data stored in bat366 databases is encrypted at rest using AES-256. Database access is restricted to authorised internal systems and personnel only.
• Access controls: bat366 staff access to personal data is governed by a strict role-based access control (RBAC) policy. Only personnel whose job function requires access to specific data categories are granted that access. All staff access is logged and auditable.
• Password security: bat366 stores player passwords using a secure one-way hashing algorithm with salting. Plain-text passwords are never stored or transmitted by bat366's systems.
• Intrusion detection: bat366 deploys network-level and application-level intrusion detection systems (IDS) to identify and respond to anomalous access attempts in real time.
• Penetration testing: bat366 conducts periodic security assessments, including vulnerability scanning and penetration testing, to identify and remediate security weaknesses before they can be exploited.
• Incident response: In the event of a data security incident that affects player personal data, bat366 will notify affected players at the registered email address within a reasonable timeframe after the breach is confirmed, and will take immediate remediation steps.

Your Rights as a Data Subject

As a player whose personal data is processed by bat366, you hold a number of rights in respect of that data. bat366 is committed to honouring these rights promptly and without unnecessary barriers. To exercise any of the rights described below, contact the bat366 data team at [email protected] with the subject line "Data Rights Request" and the specific right you wish to exercise. bat366 will acknowledge your request within three (3) business days and aim to fulfil it within thirty (30) calendar days.

• Right of access: You have the right to request a copy of the personal data bat366 holds about you, including the categories of data held, the purposes for which it is processed, and the parties with whom it has been shared. bat366 will provide this information in a structured, readable format.
• Right to rectification: If any personal data bat366 holds about you is inaccurate or incomplete, you have the right to request correction. For example, if your name was recorded incorrectly during registration, you may request a correction by submitting a valid identity document confirming the correct information.
• Right to erasure ("right to be forgotten"): You may request that bat366 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where the data has been unlawfully processed. This right is subject to bat366's legal obligations — data that must be retained under anti-money-laundering or transaction record-keeping requirements cannot be erased before the applicable retention period has expired.
• Right to restriction of processing: You may request that bat366 restrict processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved, or where you have objected to processing and bat366 is assessing whether its legitimate interests override your objection.
• Right to data portability: Where bat366 processes your personal data on the basis of your consent or contractual necessity, and the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (for example, JSON or CSV) and to transmit it to another controller.
• Right to object: You have the right to object to processing of your personal data for direct marketing purposes at any time, without providing a reason. You may also object to processing based on bat366's legitimate interests, in which case bat366 will assess whether its interests are overridden by your interests, rights, and freedoms.
• Right to withdraw consent: Where bat366 processes data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

Policy Updates & Contact

bat366 reviews this Privacy Policy periodically and updates it when necessary to reflect changes in our data practices, changes in applicable law, or the introduction of new platform features that involve personal data processing. When a material change is made to this policy, bat366 will notify registered players via the email address on file at least seven (7) days before the updated policy takes effect. The effective date at the top of this document will be updated to reflect the date the current version entered into force.

Your continued use of the bat366 platform after the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with a material change to this policy, you should close your account before the updated policy takes effect. Account closure instructions are available on the Responsible Gaming page or by contacting the support team.

The current version of this Privacy Policy is always accessible at bat366.net/privacy-policy. Previous versions are available on request by contacting [email protected].