bagh3 Privacy Policy — How We Collect, Use & Protect Your Data

Welcome to the bagh3 Privacy Policy. bagh3 (referred to throughout this document as "bagh3", "we", "us", or "our") is an online betting and casino platform serving players across Bangladesh, accessible at bagh3.io. We are committed to protecting the privacy and security of all personal data that you provide to us or that we collect when you use our platform.

This Privacy Policy is a legally binding document that explains, in plain English, the categories of personal data we collect from users of the bagh3 platform, the purposes for which that data is used, the parties with whom it may be shared, the safeguards in place to protect it, and the rights you hold as a data subject. It applies to all users of the bagh3 platform, regardless of the method of access — whether through a desktop browser, mobile browser, or any other access point.

By registering an account on bagh3, or by continuing to use the platform after this Privacy Policy has been updated, you acknowledge that you have read and understood this document in its entirety and consent to the data practices described herein. If you do not agree with any part of this Privacy Policy, you must cease using the bagh3 platform immediately.

For the purposes of this Privacy Policy, bagh3 acts as the data controller in respect of all personal data collected from users of the bagh3 platform. As data controller, bagh3 determines the purposes for which personal data is processed and the means by which that processing takes place.

In certain contexts — for example, where payment processing or identity verification is carried out by a third-party service provider — that provider may act as a separate data controller or as a data processor on behalf of bagh3. Where third-party processors are engaged, bagh3 ensures that appropriate data processing agreements are in place to protect user data to the same standard described in this Privacy Policy.

All enquiries, requests, or complaints relating to the processing of your personal data by bagh3 should be directed to our dedicated data privacy contact at [email protected] with the subject line "Privacy Enquiry".

bagh3 collects personal data across several categories, depending on how you interact with the platform. The categories of personal data we may collect are set out in the table below.

bagh3 does not collect special categories of personal data (sometimes called sensitive personal data) such as health information, religious beliefs, or biometric data, except where a user voluntarily discloses health information in the context of a responsible gaming request. Any such information disclosed voluntarily will be handled with the highest level of confidentiality and used solely for the purpose of providing responsible gaming support.

bagh3 collects personal data through the following channels and mechanisms:

• Direct submission by you: Data you voluntarily provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or updating your account settings.
• Automated technical collection: Data collected automatically when you visit or interact with the bagh3 platform, including via cookies, server logs, pixel tags, and similar tracking technologies. See Section 9 (Cookies & Tracking) for full details.
• Third-party payment providers: Transaction confirmation data and payment status updates received from bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard when you initiate a deposit or withdrawal.
• Identity verification providers: Verification outcome data (pass/fail) and risk-scoring data received from our KYC and identity verification partners when you submit documents for account verification.
• Game providers: Game session data and bet settlement data received from third-party game providers including Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, and Spribe in respect of games played on the bagh3 platform.
• Fraud prevention and security services: Device fingerprinting, behavioural analytics, and risk-flag data received from our fraud prevention and account security partners.

bagh3 processes your personal data only where there is a lawful basis for doing so. The primary purposes for which we process personal data, and the corresponding legal basis for each, are set out below.

• Account creation and management — Processing is necessary to perform the contract between you and bagh3, i.e., to provide you with a registered account and access to the platform's services.
• Payment processing (deposits and withdrawals) — Processing is necessary to perform the contract and to comply with our obligations to payment providers and financial institutions.
• Identity verification (KYC) — Processing is necessary for compliance with our legal and regulatory obligations, including anti-money laundering (AML) and age verification requirements.
• Fraud detection and prevention — Processing is necessary for our legitimate interests in protecting the integrity of the platform, safeguarding user accounts, and preventing financial crime.
• Responsible gaming monitoring — Processing is necessary both to perform the contract (providing responsible gaming tools) and to comply with our duty of care obligations.
• Customer support — Processing is necessary to perform the contract and for our legitimate interests in resolving user enquiries and improving service quality.
• Platform improvement and analytics — Processing is based on our legitimate interests in understanding how users interact with the platform in order to optimise and improve the service.
• Promotional communications — Where you have provided explicit consent to receive marketing messages from bagh3, we may process your contact data to send you relevant promotions, offers, and news. You may withdraw this consent at any time by contacting [email protected].

bagh3 does not sell, rent, or trade your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

• Payment processors: We share relevant transaction and identity data with payment service providers (including bKash, Nagad, Rocket, Upay, and banking partners) solely for the purpose of processing your deposits and withdrawals.
• Identity verification providers: We share identity documents and personal details with our KYC and AML compliance partners for the purpose of verifying your identity and age.
• Game providers: We share session and account data with third-party game providers (Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe) to enable you to access and play their games on the bagh3 platform.
• Fraud prevention services: We share device and behavioural data with our fraud detection partners to protect user accounts and the platform from fraudulent activity.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, courts, or regulatory bodies where we are required to do so by law, court order, or in response to a lawful request from a competent authority.
• Professional advisers: We may share data with legal advisers, auditors, or other professional service firms strictly on a need-to-know basis and subject to confidentiality obligations.

bagh3 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The general retention periods we apply are as follows:

• Account and identity data: Retained for the duration of your active account plus a minimum of 5 years following account closure, to comply with AML record-keeping requirements.
• Financial and transaction records: Retained for a minimum of 7 years from the date of each transaction, in accordance with financial record-keeping standards.
• Gameplay and betting history: Retained for the duration of your active account plus 5 years following account closure.
• Customer support communications: Retained for 3 years from the date of the relevant interaction, or longer where the communication relates to an unresolved dispute.
• Technical and usage data (logs): Retained for up to 13 months from collection, after which it is anonymised or deleted.
• Marketing consent records: Retained for the duration of your consent plus 2 years following withdrawal of consent, for evidential purposes.

When personal data is no longer required, bagh3 will securely delete or anonymise it. Where immediate deletion is not technically feasible (for example, data stored in backup archives), the data will be isolated and protected from further processing until it can be securely deleted.

bagh3 takes the security of your personal data seriously. We implement a comprehensive range of technical and organisational security measures to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

• 256-Bit SSL Encryption: All data transmitted between your browser or device and the bagh3 platform is encrypted using industry-standard 256-bit Secure Socket Layer (SSL) technology. This ensures that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Password Security: User passwords are never stored in plain text. bagh3 applies strong one-way cryptographic hashing algorithms to all passwords stored in our systems.
• Two-Factor Authentication (2FA): bagh3 supports and strongly recommends the use of two-factor authentication for all user accounts. With 2FA enabled, access to your account requires both your password and a one-time code sent to your registered mobile number.
• Access Controls: Internal access to personal data is restricted to authorised bagh3 personnel who require it to perform their job functions. Role-based access controls and audit logging are applied to all systems that process personal data.
• Regular Security Audits: bagh3 conducts regular internal security reviews and works with external security specialists to identify and address potential vulnerabilities in our platform infrastructure.
• Secure Data Centres: All personal data processed by bagh3 is stored on secure servers with physical access controls, redundant backups, and 24/7 monitoring.

bagh3 uses cookies and similar tracking technologies to operate the platform efficiently, remember your preferences, maintain your login session, and understand how users interact with the site. The following types of cookies may be placed on your device when you visit bagh3.io.

bagh3 does not use third-party advertising cookies or tracking pixels for the purpose of delivering targeted advertising outside the bagh3 platform. Strictly necessary cookies cannot be disabled, as they are required for the platform to function. You may adjust your browser settings to refuse or delete functional and analytics cookies, but doing so may affect certain features of the platform.

As a user of the bagh3 platform, you hold the following rights in respect of your personal data. bagh3 is committed to honouring these rights promptly and without undue burden to you.

• Right of Access: You have the right to request a copy of all personal data that bagh3 holds about you. We will provide this within 30 days of a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update most account information directly through your account settings; for other corrections, contact our support team.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. Note that this right is subject to limitations where bagh3 is required to retain data under applicable law (for example, AML and financial record-keeping obligations).
• Right to Restrict Processing: You have the right to request that bagh3 temporarily restricts its processing of your personal data while the accuracy of that data or the lawfulness of its processing is under dispute.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to bagh3 in a structured, commonly used, machine-readable format, and to request that it be transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on bagh3's legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact bagh3 by emailing [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and provide a full response within 30 days. Where requests are complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension.

The bagh3 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain the personal data of any individual under the age of 21. Age verification is a mandatory step in the bagh3 account registration and KYC process, and we employ multiple layers of age-screening to prevent access by minors.

Where bagh3 has reasonable grounds to suspect that a registered user is under the age of 21, the account will be immediately suspended pending age verification. If verification confirms that the user is under 21, the account will be permanently closed, all funds will be returned to the originating payment method after deducting any bonuses received, and all personal data associated with the account will be deleted in accordance with our retention policy.

If you are a parent or guardian and believe that a person under the age of 21 in your care has registered on the bagh3 platform, please contact our support team immediately at [email protected]. We will investigate and take appropriate action within 24 hours of receiving your report.

The bagh3 platform integrates with a number of third-party service providers to deliver its full range of features. While bagh3 takes care to select reputable partners and to ensure appropriate data processing agreements are in place, please be aware that each third-party provider operates under its own privacy policy in respect of data that passes through their systems.

Third-party service providers currently integrated with the bagh3 platform include, but are not limited to:

• Payment providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, Mastercard — for the processing of deposits and withdrawals.
• Game content providers: Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, Spribe — for the delivery of casino games and live dealer tables available on the bagh3 platform.
• Identity and KYC providers: Third-party identity verification services used to validate user-submitted documents and confirm age eligibility.
• Analytics providers: Web and app analytics platforms used to collect aggregated and anonymised usage data for platform optimisation purposes. No personally identifiable information is shared with analytics providers beyond what is technically necessary.

bagh3 is not responsible for the data practices of third-party providers once data has passed to their systems in the course of legitimate processing. Users are encouraged to review the privacy policies of relevant payment providers and game studios independently.

bagh3 reserves the right to update or amend this Privacy Policy at any time. We will provide advance notice of material changes by publishing a prominent notice on the bagh3.io platform and, where technically feasible, by emailing affected users at their registered email address no less than 7 days before the revised policy takes effect.

The version number and effective date shown at the top of this document and in the Table of Contents sidebar reflect the most current version of this Privacy Policy. We encourage you to review this page periodically to stay informed about how bagh3 is protecting your personal data.

Non-material changes — such as corrections to typographical errors, clarifications that do not alter the substance of our data practices, or updates to third-party provider names — may take effect immediately upon publication without advance notice. Your continued use of the bagh3 platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy.

If you have questions or concerns about any changes to this Privacy Policy, you are encouraged to contact our support team at [email protected] before the changes take effect. Previous versions of this Privacy Policy may be requested from the bagh3 support team for reference purposes.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bagh3, please reach out to our dedicated privacy and data team using the contact details below.

Email: [email protected]

Subject Line for Privacy Requests: Please use "Privacy Enquiry" or "Data Rights Request" as the email subject line to ensure your message is directed to the correct team and handled promptly.

Support Hours: Our support team is available 24 hours a day, 7 days a week, 365 days a year, including all Bangladesh public holidays (Eid, Pohela Boishakh, Victory Day on 16 December, Independence Day on 26 March).

Response Time: Privacy and data rights enquiries are acknowledged within 5 business days. Full responses to data access, rectification, erasure, and portability requests are provided within 30 days of identity verification.