Privacy Policy
Your Data, Protected by 8a88

This Privacy Policy ("Policy") is published by 8a88 ("8a88", "we", "us", "our") and applies to all users ("you", "your", "User", "Player") who access or use the 8a88 website at https://8a88.io and any associated services, features, mobile interfaces, and applications operated under the 8a88 brand.

8a88 is committed to protecting the privacy and personal data of all users in accordance with applicable data protection law and international best practices. We process your personal data only for the purposes described in this Policy and only to the extent permitted by the legal bases set out in Section 4.

This Policy should be read together with the 8a88 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. By creating an account, depositing funds, or otherwise using the 8a88 platform in any capacity, you acknowledge that you have read and understood this Policy and that you consent to the processing of your personal data as described herein.

The categories of personal data that 8a88 collects depend on the nature of your interaction with the platform. We collect data in three primary ways: data you provide directly, data generated through your use of the platform, and data received from third parties.

2.1 Data You Provide Directly

• Registration Data: Full name, date of birth, email address, mobile phone number, username, and password (stored in hashed form).
• Identity Verification (KYC) Data: Government-issued photo identification (National Identity Card, passport, or driving licence), selfie or live photograph, and proof of address documentation where required.
• Payment Data: Mobile banking account numbers (bKash, Nagad, Rocket, Upay), bank account details (Dutch-Bangla Bank, BRAC Bank, City Bank), and card details (Visa, Mastercard) where applicable. Full card numbers are processed by PCI-DSS compliant payment processors and are not stored on 8a88 servers.
• Support Communications: The content of messages, chat logs, emails, and any attachments you submit to the 8a88 support team.
• Responsible Gaming Preferences: Deposit limits, loss limits, session reminders, and self-exclusion requests as set by you within your account dashboard.

2.2 Data Generated Through Platform Use

• Technical Data: IP address, device type and model, operating system and version, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, features accessed, time and duration of sessions, search queries within the platform, and clickstream data.
• Transaction Data: Records of all deposits, withdrawals, bets placed, games played, bonus activations, and account balance history.
• Geolocation Data: General geographic location derived from IP address. We do not collect precise GPS-level location data unless specifically enabled by the user.
• Cookie and Tracking Data: As described in Section 6 of this Policy.

2.3 Data Received from Third Parties

• Identity Verification Partners: Confirmation results from KYC verification service providers engaged by 8a88 to authenticate your identity documents.
• Payment Processors: Transaction status confirmations and fraud-risk signals from payment gateway providers including bKash, Nagad, and card payment networks.
• Fraud Prevention Services: Risk scores and flagging data from third-party anti-fraud and anti-money-laundering screening services.

8a88 uses the personal data it collects for the following purposes. Each purpose is tied to a specific legal basis, as detailed in Section 4.

3.1 Marketing Communications

8a88 may send you promotional emails, SMS notifications, or in-platform messages about bonuses, new games, seasonal offers (such as Eid, Pohela Boishakh, or IPL promotions), and platform updates. Marketing communications are sent only where you have provided your prior consent during registration or through your account notification preferences. You may withdraw consent at any time by updating your communication preferences within your account dashboard or by contacting our support team.

8a88 processes your personal data under the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and 8a88, including account management, transaction processing, bet settlement, and customer support. Without this processing, 8a88 cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money-laundering (AML) obligations, know-your-customer (KYC) requirements, and age verification mandates.
• Legitimate Interests: Processing carried out in pursuit of 8a88's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement analytics, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your specific, freely given, informed, and unambiguous consent, including the sending of direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

8a88 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We share your personal data only in the following strictly controlled circumstances:

5.1 Service Providers

We engage carefully selected third-party service providers who process personal data on our behalf in order to deliver the 8a88 platform. These include payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard network operators, Dutch-Bangla Bank, BRAC Bank), identity verification providers, cloud hosting and infrastructure providers, customer support platform operators, anti-fraud and AML screening services, and game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi). All service providers are bound by data processing agreements that restrict them to processing your data only as instructed by 8a88 and only for the purposes specified.

5.2 Legal and Regulatory Disclosure

8a88 may disclose your personal data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where we are legally required or compelled to do so, or where we believe in good faith that disclosure is necessary to prevent fraud, protect the safety of any person, or defend our legal rights.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a substantial part of 8a88's assets, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to the Privacy Policy that result from it.

8a88 uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate the platform, personalise your experience, and analyse usage patterns. The categories of cookies we use are as follows:

You can manage or delete cookies through your browser settings at any time. Please note that disabling non-essential cookies may affect certain features of the platform. Strictly necessary and fraud prevention cookies cannot be disabled without impairing platform functionality and security.

8a88 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following measures:

• Transport Encryption: All data in transit between your device and 8a88 servers is encrypted using TLS 1.2 or higher (256-bit SSL). You can verify this by checking for the padlock icon in your browser's address bar when visiting https://8a88.io.
• Data Encryption at Rest: Sensitive personal data stored on 8a88 infrastructure is encrypted at rest using AES-256 encryption standards.
• Password Hashing: Account passwords are never stored in plaintext. They are hashed using a one-way cryptographic algorithm with unique per-user salting, meaning 8a88 staff cannot retrieve your password — only reset it through a verified process.
• Access Controls: Access to personal data is restricted to 8a88 personnel and service providers on a strict need-to-know basis. All internal data access is logged and subject to regular audit.
• Penetration Testing: 8a88 conducts regular security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a confirmed data security incident affecting your personal data, 8a88 will notify affected users within a reasonable timeframe and provide clear guidance on protective action where appropriate.

8a88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable legal, regulatory, or contractual obligations. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with 8a88's internal data disposal procedures. Anonymised data that cannot be linked back to any individual may be retained indefinitely for statistical and analytical purposes.

As a user of the 8a88 platform, you hold the following rights in respect of the personal data we process about you. To exercise any of these rights, please contact our support team using the details provided in Section 14.

• Right of Access: You have the right to request a copy of the personal data 8a88 holds about you, together with information about how it is processed, the legal basis for processing, and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and no overriding legitimate interest exists. This right is subject to 8a88's legal retention obligations; we may be required to retain certain data even following an erasure request.
• Right to Restriction: You may request that 8a88 restrict the processing of your personal data in certain circumstances, such as while you contest the accuracy of the data or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes, which 8a88 will action immediately upon receipt of your objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

8a88 will respond to all verifiable data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, and you will be notified of such an extension. 8a88 will not charge a fee for data rights requests unless they are manifestly unfounded or excessive.

The 8a88 platform is strictly intended for adults aged 21 years and above. 8a88 does not knowingly collect, process, or store personal data relating to any individual under the age of 21. If you are under 21 years old, you are not permitted to create an account, deposit funds, or use any feature of the 8a88 platform.

8a88 employs age verification checks as part of the registration and KYC process to identify and prevent access by underage individuals. If 8a88 discovers or has reasonable grounds to believe that a registered user is under the age of 21, the account will be suspended immediately pending verification, and any funds held in the account will be returned via the original payment method. All personal data associated with the underage account will be deleted following the resolution of the matter.

If you believe that a minor has created an account on 8a88 or that personal data relating to a minor has been submitted to the platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

The 8a88 platform may contain references to game providers and payment partners whose products and services are integrated into the platform experience. While 8a88 takes care in selecting its technology and payment partners, we are not responsible for the privacy practices of third-party entities whose data processing activities fall outside the scope of 8a88's own operations.

Game content delivered by providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi is subject to those providers' own data handling terms, which govern the limited technical data they may process in order to deliver game functionality. 8a88 does not permit game providers to access your registration or payment data beyond what is strictly required for game delivery and anti-fraud purposes.

Payment processing via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank is subject to those providers' respective privacy policies governing the transaction data they process on their own networks. 8a88 recommends that you review the privacy terms of any payment provider you use.

8a88 primarily serves players based in Bangladesh and processes the majority of personal data within infrastructure located in or serving the Bangladesh Standard Time (BST, UTC+6) region. However, certain service providers engaged by 8a88, including cloud hosting infrastructure providers and specialised fraud prevention services, may process personal data in jurisdictions outside Bangladesh.

Where personal data is transferred to service providers operating outside Bangladesh, 8a88 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection principles. Safeguards may include contractual data processing agreements incorporating standard data protection clauses, or reliance on the service provider's certification under a recognised international data protection framework.

If you have questions about the international transfer safeguards applicable to your personal data, please contact us using the details in Section 14.

8a88 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we provide. The most current version of this Policy is always available on this page, and the "Last Updated" date at the top of the document will be revised accordingly whenever a change is made.

Where a change to this Policy is material — meaning it significantly affects the rights of users or the way in which we process personal data — 8a88 will provide advance notice to registered players via their registered email address or through a prominent notice on the platform prior to the change taking effect.

Your continued use of the 8a88 platform after any revision to this Policy constitutes your acknowledgement of the revised terms. If you do not agree with a revised version of this Policy, you should cease using the platform and contact us to close your account and arrange the return of any funds held in your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 8a88 processes your personal data, please contact our dedicated privacy and support team using the details below. We are committed to responding to all enquiries promptly and thoroughly.

• Email: [email protected]
• Platform: https://8a88.io
• Support Hours: 24 hours a day, 7 days a week
• Response Time: Within 2 business days for general enquiries; within 30 days for formal data rights requests

When contacting us regarding a data rights request or privacy concern, please include your registered username and a clear description of your enquiry so that we can identify your account and respond as efficiently as possible. You may be asked to verify your identity before we action any request involving access to or modification of your personal data.