bagh1 Privacy Policy

This Privacy Policy ("Policy") is issued by bagh1 ("bagh1", "we", "us", "our") and applies to all players, visitors, and users who access or use the bagh1 website located at https://bagh1.io and all associated services, mobile interfaces, and communication channels (collectively, the "Platform").

bagh1 is committed to protecting the privacy and personal data of its users. This Policy explains in plain, formal English what personal data we collect, the purposes for which we collect it, the legal basis on which we process it, how long we retain it, with whom we share it, and what rights you hold as a data subject.

By registering an account on the bagh1 Platform, making a deposit, or otherwise using bagh1 services, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. Where processing is based on consent, you may withdraw that consent at any time, subject to the limitations described in Section 8 of this Policy.

This Policy should be read alongside the bagh1 Terms & Conditions and the Responsible Gaming Policy, both of which form part of the overarching agreement between you and bagh1.

bagh1 collects personal data from you directly (when you provide it during registration or account use), automatically (when you interact with the Platform), and from third parties (such as payment providers and identity verification services). The categories of personal data collected are as follows:

bagh1 does not collect or process special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health information) except where expressly required for responsible gaming purposes — for example, where a player voluntarily discloses a gambling-related health concern in the context of a self-exclusion request.

bagh1 uses the personal data it collects for the following purposes. Each purpose is linked to the relevant legal basis described in Section 4 of this Policy.

• Account Registration and Management: To create and maintain your bagh1 player account, verify your identity and age, and ensure the security and integrity of your account credentials.
• Payment Processing: To facilitate deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard. Financial data is shared with payment providers only to the extent necessary to complete transactions.
• Identity Verification (KYC): To comply with anti-money laundering (AML) obligations, verify that players are aged 21 or above, and confirm the legitimacy of payment methods used on the Platform.
• Fraud Prevention and Platform Security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, bonus abuse, money laundering, and other prohibited conduct as defined in the bagh1 Terms & Conditions.
• Responsible Gaming Compliance: To monitor player behaviour for indicators of problem gambling, enforce self-exclusion and deposit limit arrangements, and fulfil bagh1's duty of care obligations toward players showing signs of gambling-related harm.
• Customer Support: To respond to your support queries, complaints, and account-related requests in a timely and accurate manner.
• Platform Improvement: To analyse aggregated usage data, identify technical issues, improve product features, and enhance the overall bagh1 user experience. Analysis for this purpose uses anonymised or pseudonymised data wherever possible.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates via email or SMS — but only where you have opted in to receive such communications. You may opt out at any time as described in Section 8.
• Legal Compliance: To comply with applicable legal obligations, including responding to valid requests from law enforcement authorities, regulatory bodies, or court orders.

bagh1 does not use personal data for automated decision-making that produces legal or significant effects on players without human review, except in cases of automated fraud detection where immediate protective action is required. In such cases, affected players will be notified and given the opportunity to request human review of the decision.

bagh1 processes your personal data only where a valid legal basis exists for doing so. The applicable legal bases for each processing activity are summarised in the table below.

bagh1 does not sell, trade, or otherwise transfer your personal data to third parties for their own commercial purposes. bagh1 shares personal data with third parties only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Visa, and Mastercard receive transactional data necessary to process your deposits and withdrawals. Each payment provider operates under its own privacy policy and is independently responsible for data processed in connection with the payment transaction.
• Identity Verification Partners: Third-party KYC and AML service providers may process your identity documents and facial verification data solely for the purpose of confirming your identity and complying with age verification obligations. These partners are contractually bound to process data only for the stated purpose and to maintain appropriate security standards.
• Game Content Providers: Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, PG Soft, and Ezugi receive technical session data (such as player ID and session token) necessary to deliver their games within the bagh1 Platform. They do not receive your full identity or contact data.
• Cloud Infrastructure and IT Service Providers: bagh1 uses reputable cloud hosting and infrastructure providers to operate the Platform. These providers act as data processors under contractual obligations and do not have independent access to player data for any purpose.
• Law Enforcement and Regulatory Authorities: bagh1 will disclose personal data to police, regulatory authorities, or courts where required to do so by a valid legal obligation, court order, or governmental request. Where legally permissible, bagh1 will notify the affected player of any such disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial part of bagh1's business assets, player data may be transferred to the acquiring entity. Affected players will be notified via email prior to any such transfer, and this Privacy Policy will continue to govern the processing of their data.

All third-party data processors engaged by bagh1 are subject to contractual data processing agreements that require them to process personal data only on bagh1's documented instructions, to implement appropriate technical and organisational security measures, and to assist bagh1 in meeting its obligations under applicable data protection law.

bagh1 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) on the Platform to ensure proper functionality, enhance your user experience, analyse Platform usage, and deliver relevant communications. The types of cookies used are described below.

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies may impair the functionality of the bagh1 Platform and prevent you from accessing certain features, including your account.

bagh1 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, to comply with applicable legal retention obligations, and to resolve any disputes or enforce agreements. The following retention periods apply to the principal categories of personal data held by bagh1:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised data may be retained indefinitely for statistical or analytical purposes.

As a data subject, you hold the following rights with respect to the personal data bagh1 holds about you. To exercise any of these rights, submit a written request to [email protected] with your full name, registered email address, and a description of your request. bagh1 will acknowledge your request within 5 business days and respond in full within 30 calendar days.

• Right of Access: You have the right to request a copy of all personal data bagh1 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: If any personal data bagh1 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been unlawfully processed. This right is subject to bagh1's legal retention obligations — data that must be retained to comply with AML, KYC, or financial record-keeping requirements cannot be deleted on request.
• Right to Restriction of Processing: You may request that bagh1 restrict the processing of your data — meaning it is stored but not actively used — in certain circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: You have the right to receive the personal data you have provided to bagh1 in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You may object at any time to processing based on bagh1's legitimate interests, including profiling for responsible gaming purposes. bagh1 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Opt Out of Marketing: You may opt out of all bagh1 marketing communications at any time by contacting [email protected] or by following the unsubscribe instructions in any marketing email. Opting out of marketing does not affect transactional or account-related communications.

bagh1 implements a multi-layered security framework to protect your personal and financial data against unauthorised access, disclosure, alteration, loss, or destruction. The key security measures in place include:

• Encryption in Transit: All data transmitted between your device and the bagh1 Platform is encrypted using TLS 1.2 or higher, providing 256-bit SSL encryption equivalent to the standard used by international financial institutions.
• Encryption at Rest: Sensitive personal data and financial records stored on bagh1 infrastructure are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data held by bagh1 is restricted on a strict need-to-know basis. Only staff members with a legitimate operational need to access specific data categories are authorised to do so. All staff access is logged and audited.
• Two-Factor Authentication (2FA): bagh1 offers SMS OTP-based two-factor authentication for player accounts, and requires it for all internal staff access to systems holding personal data.
• Penetration Testing and Security Audits: The bagh1 Platform and infrastructure undergo regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities proactively.
• Incident Response: bagh1 maintains a formal data breach response procedure. In the event of a personal data breach that poses a risk to affected individuals, bagh1 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

While bagh1 employs industry-standard security measures, no online platform can guarantee absolute security. You are responsible for keeping your bagh1 account credentials confidential. If you suspect that your account has been compromised, contact [email protected] immediately.

The bagh1 Platform is strictly intended for adults aged 21 years and above. bagh1 does not knowingly collect, store, or process personal data belonging to any person under the age of 21. Registration by or on behalf of a minor is a serious breach of the bagh1 Terms & Conditions and is strictly prohibited.

As part of the registration and KYC process, bagh1 requires all players to provide documentary evidence of age. If bagh1 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21 — whether through a false declaration of age or any other means — bagh1 will immediately suspend the relevant account, delete all associated personal data to the extent not required for legal or AML compliance purposes, and void any balances or winnings associated with the account.

The bagh1 Platform may contain references to or integrations with third-party services, including game content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, as well as payment service providers including bKash, Nagad, Rocket, and Upay. Where your interaction with the Platform takes you to a third-party interface or environment, that third party's own privacy policy will govern the collection and use of your data within their environment.

bagh1 is not responsible for the privacy practices, data security measures, or content of any third-party platforms, services, or websites. The inclusion of a third-party service or provider within the bagh1 Platform does not constitute an endorsement of that third party's privacy practices. We strongly recommend that you review the privacy policy of any third-party service you use in connection with your bagh1 account.

Where bagh1 shares data with third-party game providers or payment processors for the purpose of delivering Platform services, such sharing is governed by contractual data processing agreements as described in Section 5 of this Policy, and the third party's use of data is restricted to fulfilling the service for which the data was shared.

bagh1 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or Platform features. When material changes are made to this Policy, bagh1 will:

• Update the "Effective Date" displayed at the top of this Policy and in the page hero section;
• Publish a notice on the bagh1 Platform informing players that the Policy has been updated;
• Where changes materially affect the rights of registered players, send a direct notification to the email address registered on the affected accounts at least 14 days before the changes take effect.

Your continued use of the bagh1 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Policy, you must discontinue use of the Platform and may request account closure by contacting our support team.

We recommend that you review this Privacy Policy periodically to stay informed of how bagh1 collects, uses, and protects your personal data. Archived versions of previous Privacy Policy editions are available upon request by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or bagh1's handling of your personal data, please contact our dedicated privacy support team using the details below. bagh1 is committed to responding to all privacy-related enquiries promptly and transparently.

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: Please use "Privacy Request — [Your Registered Username]" to help us route your query correctly
• Response Time: Acknowledgement within 5 business days; full response within 30 calendar days
• Availability: 24 hours a day, 7 days a week — English and Bengali support available
• Time Zone: Bangladesh Standard Time (BST, UTC+6)

For urgent data security concerns — including suspected unauthorised access to your account or a suspected data breach — please contact [email protected] immediately and mark your message as urgent. Our security response team monitors incoming communications around the clock and will prioritise urgent security-related queries.

For responsible gaming assistance, self-exclusion requests, or deposit limit changes, please visit the Responsible Gaming page or contact [email protected] directly. bagh1 treats all responsible gaming requests as high priority and will act on them without delay.