ba22 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how ba22 ("ba22", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("Player", "User", "you") who access or use the ba22 online betting and casino platform at https://ba22.io ("Platform"). This Policy forms part of and should be read alongside the ba22 Terms and Conditions.

ba22 operates an English-language online betting and casino service directed at adult players in Bangladesh. We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. By registering an account or otherwise using the ba22 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.

If you do not agree with any part of this Policy, you should not use the ba22 Platform. If you have questions about how ba22 handles your data, please contact us at any time using the details provided in Section 14.

2 Data We Collect

ba22 collects personal data from you in the following categories. We collect only what is reasonably necessary to deliver a safe, fair, and compliant gaming experience.

2.1 Registration and Identity Data

When you register a ba22 account, we collect the following information:

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to verify that you are 21 years of age or older)
• Residential address in Bangladesh (city, district, full street address, and postcode where applicable)
• Mobile phone number registered in Bangladesh
• Email address
• Username and encrypted password chosen at registration

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) obligations, we may collect copies of the following documents:

• Government-issued photo ID — National Identity Card (NID), passport, or driving licence
• Proof of address document — utility bill or bank statement dated within the last three months
• Proof of payment method ownership — confirmation of your bKash, Nagad, Rocket, or Upay account linked to your name and registered number
• Selfie photograph for liveness checks where required by our verification provider

2.3 Financial and Transaction Data

• Deposit amounts, transaction timestamps, and payment method references (bKash wallet number, Nagad number, Rocket number, Upay number, Visa/Mastercard last four digits)
• Withdrawal requests, amounts, destination account identifiers, and processing status
• Bonus and promotion redemption history
• Account balance history

2.4 Betting and Gaming Activity Data

• All bets placed, including sport or game type, selection, stake amount in ৳ BDT, odds, and outcome
• Casino game sessions, including game title, provider name, session duration, wager amounts, and results
• Slot game play history, including game name, spin activity, wins, and session times
• Responsible gaming tool usage — deposit limits set, cooling-off periods requested, self-exclusion applications

2.5 Technical and Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Session login timestamps and duration
• Pages visited on the ba22 Platform and clickstream data
• Referral source (how you arrived at the ba22 website)

2.6 Communication Data

• Live chat transcripts between you and ba22 customer support
• Email correspondence sent to or received from ba22
• Feedback, complaint, or dispute records
• Survey responses or promotional opt-in preferences (where applicable)

3 How We Use Your Data

ba22 uses the personal data we collect for the following purposes. We do not use your data for any purpose that is incompatible with the reasons it was originally collected.

ba22 does not use your personal data to make fully automated decisions that produce significant legal or similarly significant effects on you without human oversight. Where automated processes are used (e.g., fraud-scoring systems), a ba22 compliance team member reviews any consequential outcomes before action is taken.

4 Legal Basis for Processing

ba22 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your ba22 account, accept bets, process deposits and withdrawals in ৳ BDT, and deliver the services you registered to use.
• Legal Obligation: Processing is required for ba22 to comply with applicable legal and regulatory obligations, including anti-money-laundering (AML) requirements, age verification duties, and fraud prevention mandates.
• Legitimate Interests: Processing is necessary for ba22's legitimate business interests, including platform security, fraud detection, responsible gaming monitoring, customer support quality improvement, and aggregate statistical analysis of platform usage — provided such interests do not override your fundamental rights.
• Consent: Where ba22 relies on your consent to process personal data — for example, to send you promotional emails or push notifications about bonuses and seasonal offers (such as BPL, Eid, or Pohela Boishakh promotions) — you may withdraw that consent at any time by contacting support or updating your communication preferences within your ba22 account settings.

5 Data Sharing and Disclosure

ba22 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes under any circumstances. We share personal data only in the following limited and controlled circumstances:

5.1 Payment Processing Partners

To facilitate deposits and withdrawals in ৳ BDT, ba22 shares the minimum necessary payment data with our payment processing partners. This includes bKash, Nagad, Rocket, Upay, and the card network processors supporting Visa and Mastercard transactions. These partners receive only the data required to execute the specific transaction and are contractually prohibited from using it for any other purpose.

5.2 KYC and Identity Verification Providers

ba22 uses third-party KYC verification service providers to authenticate the identity and age of players registering on the Platform. These providers receive copies of identification documents and associated personal details solely for the purpose of performing the verification check on ba22's behalf. They operate under strict data processing agreements.

5.3 Game Content Providers

ba22 integrates games from third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive a session token and anonymised player identifier to enable the game to function correctly within the ba22 Platform. They do not receive your full name, payment details, or contact information.

5.4 Fraud Prevention and Security Services

ba22 may share IP addresses, device fingerprints, and transaction patterns with third-party fraud prevention services to detect and prevent unauthorised access, account takeover, and financial fraud. These disclosures are made on the basis of ba22's legitimate interest in maintaining a secure platform.

5.5 Legal and Regulatory Authorities

ba22 may disclose personal data to law enforcement agencies, government bodies, or regulatory authorities where we are compelled to do so by applicable law, by court order, or where disclosure is necessary to protect the safety, rights, or property of ba22, its players, or the general public. ba22 will notify affected players of such disclosures where legally permitted to do so.

6 Cookies and Tracking Technologies

ba22 uses cookies and similar technologies (such as local storage and session tokens) on the Platform. A cookie is a small text file stored on your device that helps the ba22 Platform function correctly and deliver a personalised experience.

6.1 Types of Cookies We Use

ba22 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts. You may disable non-essential cookies through your browser settings. Note that disabling essential cookies will impair your ability to use the ba22 Platform, as session management depends on them.

7 Data Retention

ba22 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Active Accounts: Personal data associated with an active ba22 account is retained for the full duration of the account relationship.
• Closed Accounts: Following account closure, ba22 retains core identity, KYC, and financial transaction records for a minimum of five (5) years to comply with anti-money-laundering and financial record-keeping obligations.
• Customer Support Records: Live chat transcripts and email correspondence are retained for up to three (3) years from the date of the last interaction, unless a longer period is required for an ongoing dispute or legal proceeding.
• Marketing Preferences: Opt-in records for promotional communications are retained for the life of the account and for one (1) year following account closure as evidence of consent.
• Technical/Device Data: Log files and IP address records are retained for up to twelve (12) months for security and fraud-investigation purposes, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, ba22 will securely delete or anonymise your personal data so that it can no longer be associated with you as an individual.

8 Data Security

ba22 applies comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our current security controls include:

• SSL/TLS encryption on all data transmitted between your browser or device and the ba22 Platform
• AES-256 encryption for sensitive data fields stored in ba22's databases (including password hashes and payment reference numbers)
• Role-based access controls that restrict ba22 staff access to personal data to only those with a legitimate business need
• Regular independent security assessments and penetration testing of the ba22 Platform
• Multi-factor authentication (MFA) required for ba22 staff accessing internal administrative systems
• Automated monitoring for unusual login patterns or suspicious transaction activity on player accounts

Despite these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that poses a risk to your rights and freedoms, ba22 is committed to notifying you without undue delay after becoming aware of the incident, and to taking immediate steps to contain and remediate the breach.

9 Your Privacy Rights

As a ba22 player, you have the following rights in respect of your personal data held by ba22. To exercise any of these rights, please contact us using the details in Section 14. ba22 will respond to all valid requests within thirty (30) days of receipt.

• Right of Access: You may request a copy of all personal data ba22 holds about you, along with information about how and why it is being used.
• Right to Rectification: If any personal data ba22 holds about you is inaccurate or incomplete, you have the right to request that we correct it without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing was unlawful. Note that this right may be limited by ba22's legal retention obligations (see Section 7).
• Right to Restrict Processing: In certain circumstances, you may request that ba22 temporarily suspend processing of your personal data — for example, while we investigate a dispute about data accuracy.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that ba22 provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing based on ba22's legitimate interests, including profiling, and to withdraw consent for marketing communications at any time.
• Right to Withdraw Consent: Where ba22 relies on your consent to process personal data (e.g., for promotional emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

10 Children's Privacy

The ba22 Platform is strictly intended for adults aged 21 years and above. ba22 does not knowingly collect personal data from anyone under the age of 21. Age verification checks are applied during the registration process and at key points in the player lifecycle (such as first withdrawal request) to enforce this requirement.

If ba22 discovers or is notified that personal data has been collected from a person under 21 years of age, we will take immediate action to suspend the account, delete the collected data, and void any associated transactions. If you are a parent or guardian and believe your child has registered on the ba22 Platform, please contact us immediately at [email protected] so we can investigate and act without delay.

11 International Data Transfers

ba22 operates a platform designed primarily for players based in Bangladesh. However, some of our third-party service providers — including KYC verification partners, game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, and fraud prevention services — may process personal data on servers located outside Bangladesh.

Where personal data is transferred internationally, ba22 takes reasonable steps to ensure that your data receives a level of protection consistent with the standards described in this Policy. This includes entering into appropriate data processing agreements with all third-party providers that receive personal data on ba22's behalf, and selecting providers that maintain recognised security certifications and operate under stringent internal data governance frameworks.

By using the ba22 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Bangladesh as described above. ba22 will always ensure that such transfers are conducted with appropriate safeguards in place to protect your information.

12 Third-Party Links

The ba22 Platform may contain references to third-party game providers, payment method partners, and sports content. While ba22 integrates services from providers such as Pragmatic Play, Evolution Gaming, bKash, Nagad, and others, ba22 does not control the privacy practices of these third-party entities in respect of their own platforms and websites.

This Privacy Policy applies solely to personal data processed by ba22 in connection with the ba22 Platform at https://ba22.io. ba22 accepts no responsibility or liability for the privacy practices, data handling procedures, or content of any third-party platforms. We encourage you to review the privacy policies of any third-party service you use independently of ba22.

13 Updates to This Policy

ba22 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or the services we offer. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page
• Display a prominent notice on the ba22 Platform informing registered players of the change
• Where the changes are significant, send a notification to the email address associated with your ba22 account

Your continued use of the ba22 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should cease using the Platform and may request account closure by contacting ba22 support.

We recommend reviewing this Privacy Policy periodically to stay informed about how ba22 protects your personal data. The most current version will always be accessible at https://ba22.io/privacy-policy.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way ba22 handles your personal data, please reach out to our support team using any of the following channels:

• Live Chat: Available 24/7 directly on the ba22 Platform — the fastest way to get a response
• Email: [email protected] — for formal data rights requests and privacy enquiries
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)

When submitting a data rights request by email, please include your registered ba22 username and a clear description of your request so that our team can verify your identity and process your enquiry as efficiently as possible. ba22 is committed to responding to all privacy-related correspondence within thirty (30) calendar days of receipt.