29bat Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by 29bat ("29bat", "we", "us", "our") and applies to all personal data collected through the 29bat website at https://29bat.io, its associated mobile-optimised interface, and any related services, applications, or communications (collectively, the "Platform").

29bat is committed to handling your personal data with transparency, integrity, and care. This Policy explains what personal data we collect about you when you use the Platform, the purposes for which that data is processed, the legal basis on which we rely for each processing activity, how long we retain data, with whom we share it, and what rights you have in relation to your personal data.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform generally, and our Responsible Gaming policy. By registering an account or using any feature of the 29bat Platform, you confirm that you have read and understood this Privacy Policy.

2 Data We Collect

29bat collects personal data that you provide directly, data generated automatically through your use of the Platform, and data obtained from trusted third-party service providers where necessary to verify your identity or process payments. The categories of personal data we collect include the following:

2.1 Registration & Identity Data

• Full legal name, date of birth, gender, and nationality.
• Residential address, including city, district, and postcode (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi).
• Email address and mobile phone number.
• Username and encrypted password.
• Government-issued identification documents submitted for KYC verification, such as National ID Card, passport, or driving licence.
• Proof of address documents such as utility bills or bank statements dated within the preceding three months.

2.2 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts in BDT, timestamps, and payment method references.
• Mobile banking account identifiers associated with bKash, Nagad, Rocket, and Upay transactions (account numbers are tokenised and not stored in plain text).
• Bank account details provided for bank-transfer withdrawals to Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank.
• Masked card numbers and card type for Visa and Mastercard transactions.
• Source of funds declarations where required by our compliance procedures.

2.3 Gaming & Betting Activity Data

• Bet history, including markets selected, odds accepted, stake amounts, and settlement outcomes.
• Casino game session data, including games played, bet sizes, session duration, and game outcomes.
• Bonus and promotion participation records.
• Responsible gaming tool usage, including self-exclusion periods, deposit limits set, and session time alerts configured.

2.4 Technical & Usage Data

• IP address, device type, operating system, and browser type and version.
• Pages visited, features accessed, session duration, and navigation paths within the Platform.
• Referring URL if you arrived at the Platform via a link from another website.
• Cookie identifiers and similar tracking technologies as described in Section 6.
• Geolocation data derived from your IP address (country and city level only — we do not collect precise GPS coordinates).

2.5 Communications Data

• Records of correspondence with our customer support team via live chat, email, or any other communication channel.
• Feedback, complaints, and survey responses you submit voluntarily.

3 How We Use Your Data

29bat processes your personal data for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes described below without first obtaining your consent or being required to do so by law.

• Account Management: To create, maintain, and administer your 29bat account, including verifying your identity, authenticating your login sessions, and managing your account settings and preferences.
• Service Delivery: To provide you with access to all betting, casino, slots, live games, and other features available on the Platform, and to process your deposits, withdrawals, and bonus claims.
• KYC & Fraud Prevention: To verify your identity and age in compliance with our obligations, to detect and prevent fraudulent activity, money laundering, and other forms of financial crime, and to report suspicious activity to the relevant authorities where required.
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling and to administer self-exclusion, deposit limit, and session time tools that you have activated.
• Customer Support: To respond to your enquiries, process complaints, and provide technical assistance.
• Legal Compliance: To fulfil our obligations under applicable law and regulation, including record-keeping requirements and responding to lawful requests from competent authorities.
• Marketing Communications: To send you promotional offers, bonuses, and platform news by email or SMS, subject to your marketing preferences. You may opt out at any time.
• Platform Improvement: To analyse aggregated usage data in order to improve the functionality, performance, and user experience of the Platform.
• Security: To detect and respond to cybersecurity threats, unauthorised access attempts, and other technical incidents.

4 Legal Basis for Processing

29bat processes your personal data on the following legal bases:

• Contractual Necessity: Processing your registration data, transaction data, and gaming activity data is necessary for the performance of the contract between you and 29bat as set out in our Terms & Conditions.
• Legal Obligation: Processing your identity and KYC documentation is necessary for compliance with our legal obligations, including anti-money laundering requirements and age verification obligations.
• Legitimate Interests: Processing technical and usage data for fraud prevention, platform security, and service improvement is carried out on the basis of our legitimate interests, provided those interests are not overridden by your fundamental rights.
• Consent: Processing your data for marketing communications is carried out on the basis of your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

5 Sharing Your Data

29bat does not sell, rent, or otherwise commercially exploit your personal data to third parties. We share your data only in the following specific and limited circumstances:

• Payment Processors: We share transaction data with payment service providers such as bKash, Nagad, Rocket, Upay, and banking partners (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank), as well as card networks (Visa, Mastercard) solely to process your deposits and withdrawals.
• Identity Verification Providers: We share identity document data with specialist KYC and identity verification service providers to authenticate your identity. These providers process data strictly as our data processors under written agreements.
• Game Content Providers: Game session data is shared with our licensed game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and others) to the extent necessary to deliver their games on the Platform. These providers do not receive your identity or financial data beyond what is required for game-specific account functions.
• Fraud & Security Partners: Anonymised and pseudonymised technical data may be shared with cybersecurity and anti-fraud service providers for the purpose of detecting and preventing fraudulent activity.
• Legal & Regulatory Authorities: We will disclose your data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by applicable law or in response to a valid legal order.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

6 Cookies & Tracking Technologies

29bat uses cookies and similar tracking technologies on the Platform to ensure it functions correctly, to improve your experience, and to gather analytics about how the Platform is used. The types of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to operate. They enable you to log in, maintain your session securely, and navigate between pages. These cookies cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: These cookies remember your preferences, such as your preferred language, currency display, and notification settings, so that you do not need to re-enter them each time you visit.
• Analytics Cookies: These cookies collect aggregated, anonymised information about how visitors use the Platform, such as which pages are visited most frequently and how users navigate through the site. This information is used to improve Platform performance.
• Performance Cookies: These cookies help us identify and resolve technical errors and measure the load time of key Platform features, supporting our ongoing infrastructure optimisation efforts.

You can control cookie settings through your browser settings. Disabling certain categories of cookies may affect the functionality of the Platform. 29bat does not use third-party advertising cookies or behavioural targeting cookies that track you across external websites.

7 Data Retention

29bat retains your personal data for as long as is necessary for the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

• Account & Identity Data: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, as required by financial record-keeping obligations.
• Gaming Activity Data: Retained for the duration of your account and for a period of 3 years following account closure, unless a regulatory investigation or legal dispute requires longer retention.
• Customer Support Correspondence: Retained for 3 years from the date of the last communication in a support thread, to enable us to respond to follow-up enquiries and resolve disputes.
• Technical & Log Data: Retained for up to 12 months for security monitoring and fraud detection purposes, after which it is aggregated and anonymised.
• Marketing Consent Records: Retained for the duration of your account to document the basis on which marketing communications were sent.

When data reaches the end of its retention period, 29bat will securely delete it or irreversibly anonymise it so that it can no longer be associated with any individual.

8 Data Security

29bat implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• SSL/TLS encryption for all data in transit between your device and the 29bat Platform.
• Encryption of sensitive data at rest, including identity documents, financial records, and authentication credentials.
• Role-based access controls ensuring that internal staff can only access personal data that is necessary for their specific job functions.
• Multi-factor authentication requirements for administrative access to systems that hold personal data.
• Regular penetration testing and vulnerability assessments conducted by qualified security professionals.
• Automated monitoring systems that detect and alert on anomalous access patterns and potential security incidents in real time.
• Staff training on data protection, information security, and responsible handling of customer data.

In the event of a personal data breach that is likely to result in a risk to your rights, 29bat will notify affected individuals promptly and take all reasonable steps to mitigate the impact of the breach.

9 Your Data Rights

As a user of the 29bat Platform, you have a number of rights in relation to the personal data we hold about you. The following table summarises these rights and how to exercise them:

29bat will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases requiring additional time, we will notify you of the extension and the reason for it. We will not charge a fee for processing data rights requests unless a request is manifestly unfounded or excessive.

10 Children's Privacy

The 29bat Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. If we discover or are notified that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete all personal data relating to that individual, and void any balances held in the account.

If you are a parent or guardian and you believe that a minor has registered an account on 29bat, please contact us immediately at [email protected] with the relevant account details so that we can take prompt action.

11 International Data Transfers

29bat's primary operations serve players in Bangladesh. Some of the third-party service providers we use, including game content providers, payment processors, and technology infrastructure partners, may be located in or operate servers in jurisdictions outside Bangladesh. When your personal data is transferred to such third parties, 29bat ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Bangladesh.

Safeguards for international data transfers include contractual data processing agreements that impose data protection obligations on recipient organisations, and diligence checks to confirm that recipient jurisdictions or organisations provide an adequate level of data protection. If you require further information about the specific safeguards in place for any particular data transfer, please contact us at [email protected].

12 Third-Party Links

The 29bat Platform may contain references to third-party game providers, payment processors, and other services. Where such services are accessed via their own websites or interfaces, please be aware that those third parties have their own privacy policies which govern the collection and use of your data on their platforms. 29bat is not responsible for the privacy practices of third parties and encourages you to review their privacy policies before providing any personal data to them.

13 Updates to This Policy

29bat reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we provide. When we make material changes to this Policy, we will notify registered players via their registered email address and display a prominent notice on the Platform prior to the changes taking effect.

The effective date at the top of this document reflects when the current version was last updated. We encourage you to review this Policy periodically to stay informed about how 29bat protects your personal data. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of those changes.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 29bat processes your personal data, please contact our support team through the following channel:

• Email: [email protected] (plain text — this is not a clickable link)
• Live Chat: available 24 hours a day, 7 days a week via the support widget on the Platform
• Response time: email within 24 hours; live chat typically within 5 minutes during peak hours

Our support team operates in Bangladesh Standard Time (BST, UTC+6) and is equipped to assist players from all regions of Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.