aa77 Privacy Policy

1 Who We Are

aa77 is an online gaming and sports betting platform accessible at aa77.io, serving registered adult members in Bangladesh. References in this Privacy Policy to "aa77", "we", "us", or "our" refer to the aa77 platform and its operating entity. References to "you", "your", or "the user" refer to any individual who accesses, registers on, or otherwise interacts with the aa77 platform.

aa77 acts as the data controller for all personal information collected through the platform. This means we determine the purposes for which personal data is processed and are responsible for ensuring that processing is carried out lawfully, fairly, and transparently. If you have any questions about how your data is handled, you may contact us at the details provided in Section 14.

2 Information We Collect

aa77 collects personal information through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and from third-party service providers involved in identity verification and payment processing. The categories of data we collect are described below.

2.1 Registration & Identity Data

• Full legal name
• Date of birth (used to verify you are 21 years of age or older)
• Residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna)
• Email address
• Mobile phone number
• Username and hashed password

2.2 KYC Verification Documents

• National Identity Card (NID) number and scanned copy
• Passport (where provided as alternative identification)
• Proof of address documentation (e.g., utility bill, bank statement)
• Selfie photograph for liveness verification, where required

2.3 Financial & Transaction Data

• Mobile financial service account numbers (bKash, Nagad, Rocket, or Upay) used for deposits and withdrawals — stored only as masked references, not in full
• Deposit and withdrawal amounts in BDT (Bangladeshi Taka)
• Transaction timestamps and reference numbers
• Bonus credits applied and wagering activity associated with those credits

2.4 Gaming Activity Data

• Games played, bet amounts, outcomes, and session durations
• Sports betting markets accessed and wagers placed
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

2.5 Technical & Device Data

• IP address and approximate geographic location derived from IP
• Browser type, version, and operating system
• Device identifiers (mobile device ID where applicable)
• Pages visited, time spent on each page, and clickstream data
• Referral source (how you arrived at aa77.io)

2.6 Communications Data

• Records of support interactions via live chat or email, including timestamps and content
• Feedback and complaints submitted through the platform
• Responses to surveys or promotions, where you have voluntarily participated

3 How We Use Your Information

aa77 uses the personal data we collect for the following specific purposes:

aa77 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

4 Legal Basis for Processing

aa77 processes your personal data on the following legal grounds, depending on the specific processing activity:

• Performance of a contract: The majority of processing described in Section 3 is necessary to perform the contract we have with you when you register an account — specifically, to provide gaming services, process payments, verify your identity, and handle your support requests.
• Legal obligation: Certain processing activities are required by applicable law — particularly KYC verification and the retention of transaction records in connection with anti-money laundering obligations. aa77 cannot waive these requirements regardless of user preferences.
• Legitimate interests: aa77 relies on legitimate interests as a legal basis for fraud prevention, platform security monitoring, and aggregated analytics used to improve the service. In each case, we have assessed that our legitimate interest in conducting this processing does not override your fundamental privacy rights.
• Consent: Where processing is not otherwise justified under the grounds above — particularly for direct marketing communications — aa77 relies on your freely given, specific, and informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5 Cookies & Tracking Technologies

aa77 uses cookies and similar tracking technologies on the platform to support essential site functionality, enhance your experience, and gather anonymised analytics data. The categories of cookies we use are as follows:

• Strictly necessary cookies: These are required for the platform to function. They manage your login session, remember your account preferences, and ensure security tokens are valid. You cannot opt out of strictly necessary cookies without impairing your ability to use the platform.
• Functional cookies: These remember your chosen settings — such as your preferred language, game view, or responsible gaming tool configurations — so you do not need to re-enter them every time you visit.
• Analytics cookies: We use anonymised analytics tools to understand how users navigate the platform — which pages are most visited, where users drop off, and how performance can be improved. This data is aggregated and does not identify you personally.
• Security cookies: These detect unusual login patterns, rapid repeated requests, or other indicators of automated or fraudulent access, helping protect your account and the platform as a whole.

Most browsers allow you to manage or block cookies through their settings. Please note that blocking strictly necessary cookies will affect the core functionality of the aa77 platform, including your ability to log in and play.

6 Data Sharing & Third Parties

aa77 does not sell, rent, or share your personal data with third parties for their own commercial or marketing purposes. We share data only in the following limited circumstances, and only to the extent necessary for each purpose:

• KYC and identity verification providers: aa77 uses trusted third-party identity verification services to cross-check the documents you submit during account registration. These providers process your KYC data solely on aa77's behalf and under strict contractual data processing agreements.
• Payment processing partners: When you make a deposit or request a withdrawal, the relevant transaction data is shared with your chosen mobile financial service provider — bKash, Nagad, Rocket, or Upay. Each provider handles this data under their own privacy policy, which we encourage you to review.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Red Tiger, and Spribe receive limited technical data (such as a pseudonymous player identifier and session token) necessary to deliver their game content within the aa77 platform. They do not receive your full personal profile.
• Fraud prevention and security services: Aggregated and pseudonymised data may be shared with anti-fraud platforms that help aa77 detect and prevent money laundering, account takeover attempts, and other malicious activity.
• Legal and regulatory authorities: aa77 will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by a valid legal obligation or court order. We will notify affected users where we are legally permitted to do so.
• Professional advisers: aa77 may share data on a confidential basis with legal counsel, auditors, or other professional advisers where necessary in connection with the operation of the business.

All third-party data processors engaged by aa77 are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with aa77's documented instructions.

7 International Data Transfers

aa77 is an online platform serving users in Bangladesh. Some of the third-party service providers we work with — including game studios and identity verification partners — may be located in countries outside Bangladesh. Where personal data is transferred to recipients in other jurisdictions, aa77 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this policy.

These safeguards may include contractual clauses requiring the recipient to maintain appropriate security standards, or reliance on the recipient's membership of an internationally recognised data protection framework. If you have questions about a specific data transfer, please contact us using the details in Section 14.

8 Data Retention

aa77 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as set out in this policy, or as required by applicable law. The general retention periods we apply are as follows:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity logs: Retained for up to two (2) years from the date of each session for operational and responsible gaming monitoring purposes.
• Customer support communications: Retained for up to three (3) years from the date of each interaction.
• Marketing consent records: Retained for as long as the consent is active, plus one (1) year following withdrawal, to demonstrate that communications were sent on a valid lawful basis.
• Technical and device data: Retained in anonymised or aggregated form for up to twelve (12) months for analytics purposes.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data must be retained beyond the standard period due to an ongoing legal dispute, regulatory investigation, or statutory obligation, we will retain only the data that is directly relevant to that matter until the matter is resolved.

9 Your Rights

As a user of the aa77 platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 14. We will respond to all valid requests in English within 30 days.

• Right of access: You have the right to request a copy of the personal data aa77 holds about you, along with information about how it is used and with whom it has been shared.
• Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain information directly within your account settings.
• Right to erasure ("right to be forgotten"): You may request that aa77 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing has been unlawful. This right is subject to overriding legal obligations — for example, we cannot delete transaction records that we are legally required to retain.
• Right to restriction of processing: In certain circumstances, you may request that aa77 restrict the processing of your personal data — for example, while the accuracy of data is being contested, or where you have objected to processing and a determination is pending.
• Right to data portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive a structured, machine-readable copy of the personal data you have provided to aa77.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. You also have the right to object to the use of your data for direct marketing purposes at any time, with immediate effect.
• Rights related to automated decision-making: aa77 may use automated processes to assess certain account-level risk factors (such as fraud indicators). You have the right to request human review of any significant decision made about you by an automated process.

10 Children & Minors

aa77 is strictly an adult platform. Access to all features of the platform — including free-play modes — is restricted to individuals aged 21 years and above. aa77 does not knowingly collect personal data from anyone under the age of 21.

All accounts are subject to mandatory KYC verification before real-money play or withdrawals are permitted. If aa77 discovers or has reasonable grounds to believe that an account has been registered by a person under the age of 21, that account will be immediately suspended, any balance will be reviewed in accordance with aa77's Terms & Conditions, and all associated personal data will be securely deleted unless legal obligations require otherwise.

If you are a parent or guardian and believe that a minor in your care has registered an account on aa77, please contact our support team immediately at [email protected]. We will investigate promptly and take appropriate action.

11 Security Measures

aa77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption on all data in transit between your browser or device and the aa77 platform.
• Secure credential storage using industry-standard one-way hashing algorithms — your password is never stored in plain text on aa77's systems.
• Two-factor authentication (2FA) available on all accounts and strongly recommended for all users.
• Role-based access controls that restrict access to personal data to only those aa77 staff members who require it to perform their job functions.
• Regular security audits and penetration testing conducted by qualified security professionals to identify and remediate vulnerabilities.
• Automated anomaly detection systems that flag unusual login attempts, rapid repeated transactions, and other indicators of account compromise.
• Isolated payment data handling — aa77 does not store complete mobile financial service account numbers. Payment data is handled directly by the relevant provider (bKash, Nagad, Rocket, or Upay) over encrypted channels.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, aa77 will notify affected users without undue delay and take all necessary steps to contain the breach and mitigate its impact.

12 Marketing Communications

aa77 may send you promotional emails about new games, special offers, seasonal promotions (including Eid, Pohela Boishakh, and Victory Day offers), and platform updates. We will only send marketing communications to your registered email address where you have provided explicit opt-in consent at the time of registration or subsequently through your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link included at the bottom of every marketing email we send.
• Updating your communication preferences in your aa77 account settings.
• Contacting our support team at [email protected] with a request to unsubscribe.

Withdrawal of consent for marketing communications will not affect your ability to use the aa77 platform or receive essential service-related notifications — such as account security alerts, KYC status updates, and withdrawal confirmations — which are sent on the basis of contract performance rather than marketing consent.

aa77 does not send marketing communications via SMS, WhatsApp, or any other channel without separate explicit consent for that specific channel. If you receive unsolicited messages claiming to be from aa77 through any channel, please report them to [email protected] immediately.

13 Changes to This Policy

aa77 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we provide. When a material change is made, we will:

• Update the effective date displayed at the top of this page.
• Display a prominent notification on the aa77 platform for a period of at least 14 days following the change.
• Where practicable, send an email notification to the address registered to your account.

Your continued use of the aa77 platform after the effective date of any amended version of this policy constitutes your acceptance of the changes. If you do not agree with a material change to this policy, you should cease using the platform and contact support to close your account and withdraw any verified cash balance.

Minor updates — such as typographical corrections, formatting improvements, or clarifications that do not substantively alter the meaning of any provision — may be made without prior notification, although the effective date will always be updated to reflect the most recent revision.

14 Contact & Data Requests

If you have any questions about this Privacy Policy, wish to exercise any of the data rights described in Section 9, or want to report a potential privacy concern, please contact aa77 through the following channels:

• Live Chat: Available on the aa77 platform 24 hours a day, 7 days a week. Average response time is under 5 minutes.
• Email (plain text — not a link): [email protected] — all privacy-related requests are acknowledged within 48 hours (BST) and fully resolved within 30 days.
• Support Language: All communications are handled in English.
• Support Hours: 24/7 · Bangladesh Standard Time (BST, UTC+6).