baau88 Privacy Policy

3.1 Contractual Necessity. The majority of the data processing activities described in Section 2 are necessary for baau88 to perform the contract it has with you as a registered player — namely, the provision of online gaming and sports betting services. Without this processing, baau88 would be unable to create your account, accept deposits, pay out winnings, or provide customer support.

3.2 Legal Obligation. Certain processing activities are required by applicable law, including KYC identity verification, transaction record-keeping for anti-money-laundering compliance, and data retention for regulatory audit purposes. baau88 must carry out this processing regardless of individual player preferences.

3.3 Legitimate Interests. baau88 relies on legitimate interests as the legal basis for fraud detection, platform security monitoring, and the use of anonymised analytics data to improve the service. In each case, baau88 has assessed that its legitimate interest in secure and efficient platform operations is not overridden by your privacy rights, given the limited intrusiveness of the processing and the direct benefit to all players of a safer platform.

3.4 Consent. Marketing communications are sent only where you have given explicit, informed consent. You may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent for marketing does not affect your ability to use the baau88 platform or any other aspect of your account.

4.1 Payment Processors. To process your deposits and withdrawals, baau88 shares the minimum necessary financial data with our certified payment partners including the operators of bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. Each payment partner processes your data under their own privacy policy and in compliance with applicable financial regulations.

4.2 KYC and Identity Verification Providers. baau88 uses third-party identity verification services to validate the KYC documents you submit. These providers receive copies of your identity documents and return a verification outcome to baau88. They are contractually prohibited from using your data for any purpose other than identity verification on behalf of baau88.

4.3 Game and Technology Providers. Casino games on baau88 are supplied by independent studios including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive a player session token and account identifier to authenticate your game session. They do not receive your full personal profile, payment details, or KYC documents.

4.4 Fraud Detection and Security Partners. baau88 works with specialist fraud detection and cybersecurity companies that process technical data — including IP addresses and device fingerprints — on our behalf to identify and prevent fraudulent activity. These partners act as data processors and are bound by contractual data protection obligations.

4.5 Legal and Regulatory Disclosure. baau88 may be required to disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where required by applicable law or in response to a lawful request. We will notify you of such a disclosure where we are legally permitted to do so.

4.6 No International Data Transfers Without Safeguards. Where personal data is transferred outside Bangladesh to a jurisdiction with different data protection standards, baau88 implements appropriate safeguards — such as standard contractual clauses or equivalent contractual protections — to ensure your data receives an equivalent level of protection.

8.1 Encryption in Transit. All data transmitted between your device and baau88 servers is encrypted using TLS 1.3 (Transport Layer Security), which provides 256-bit AES encryption. This ensures that your login credentials, payment details, personal information, and game session data cannot be intercepted by third parties during transmission between your browser and our platform.

8.2 Encryption at Rest. Sensitive personal data stored on baau88 servers — including KYC documents, identity records, and financial transaction data — is encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management system with strict access controls and regular key rotation schedules.

8.3 Access Controls. Access to personal data within baau88's internal systems is governed by a role-based access control (RBAC) framework. Only staff members with a legitimate operational need to access a specific category of personal data are granted access rights for that category. All internal data access is logged and subject to periodic audit review.

8.4 Infrastructure Security. The baau88 platform is hosted on enterprise-grade infrastructure with industry-standard physical and logical security controls, including network firewalls, intrusion detection systems, DDoS mitigation, and regular penetration testing by independent security specialists. Server environments are isolated and access is restricted to authorised personnel only.

8.5 Payment Security. Payment data is handled exclusively through PCI-DSS compliant payment processors. baau88 does not store full card numbers, CVV codes, or mobile banking PINs on its own servers. All payment credentials are tokenised at the point of entry by the relevant payment processor before any transaction data is relayed to baau88 systems.

8.6 Staff Training. All baau88 staff who handle personal data receive mandatory data protection training at the time of onboarding and annually thereafter. Staff are trained to recognise phishing attempts, social engineering attacks, and other threats to personal data security. Data protection responsibilities are embedded in staff contracts and role descriptions.

8.7 Security Incident Response. baau88 maintains a documented incident response procedure for data security events. In the event of a personal data breach that poses a risk to affected players, baau88 will notify affected individuals promptly with clear information about what data was involved, what steps have been taken to contain the incident, and what you can do to protect yourself. baau88's security team conducts post-incident reviews to prevent recurrence.

8.8 Vulnerability Management. baau88 operates a continuous vulnerability management programme that includes regular automated scanning of platform infrastructure, periodic manual penetration tests, and a responsible disclosure policy that allows security researchers to report potential vulnerabilities safely. Identified vulnerabilities are prioritised and remediated according to severity within defined response-time targets.