18aa Privacy Policy — Your Data, Your Rights

1 Who We Are

18aa is an online betting and casino platform accessible at https://18aa.im, operated for the benefit of registered members based in Bangladesh. The platform offers cricket betting, live casino, slots, and a range of other gambling products, all denominated in Bangladeshi Taka (BDT) and accessible via desktop and mobile browsers.

For the purposes of this Privacy Policy, "18aa", "we", "us", and "our" refer to the operators of the 18aa platform. "You", "Member", and "User" refer to any individual who accesses, registers on, or otherwise interacts with the 18aa platform. "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.

This Privacy Policy should be read together with the 18aa Terms & Conditions, available at /terms-conditions, and the Responsible Gaming Policy, available at /responsible-gaming. By using the 18aa platform, you confirm that you have read and understood this Privacy Policy in its entirety.

2 Scope of This Policy

This Privacy Policy applies to all personal data collected, stored, or processed by 18aa in connection with:

• Registration of a new 18aa member account.
• Ongoing use of the 18aa platform, including placing bets, playing casino games, and accessing account features.
• Deposits and withdrawals made through Approved Payment Methods including bKash, Nagad, Rocket, Upay, and bank transfers.
• Communications with the 18aa customer support team via live chat or email.
• Participation in 18aa promotions, competitions, or bonus programmes.
• Technical interactions with the 18aa platform, including browser sessions, IP addresses, and device identifiers collected automatically.

This policy does not apply to the data practices of third-party game providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi) or third-party payment processors. Those entities have their own privacy policies, which we encourage you to review independently.

3 Data We Collect

18aa collects the following categories of personal data. We collect only what is necessary for the purposes described in this policy.

4 How We Collect Your Data

18aa collects personal data through the following channels:

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, or update your account preferences, you provide data to us directly.
• Automatically: When you visit or interact with the 18aa platform, technical data (IP address, browser information, device data, session duration) is collected automatically through server logs and first-party cookies. This data is collected whether or not you are logged into your account.
• From payment partners: When you initiate a transaction through bKash, Nagad, Rocket, Upay, or a bank transfer, we receive transaction confirmation data from the relevant payment provider. We do not receive your full payment account credentials — only the reference information necessary to match and process your transaction.
• From game providers: Third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) may transmit game-round data, win/loss results, and session information to 18aa as part of the game integration. This data is used to maintain accurate account balances and resolve game disputes.
• From identity verification services: Where 18aa uses a third-party KYC service to verify submitted identity documents, that service may return a verification outcome and associated confidence score. We do not store raw biometric data beyond what is required for verification purposes.

5 Legal Basis for Processing

18aa processes your personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing your identity data, contact data, and financial data is necessary for 18aa to fulfil its obligations under the member account agreement — including account registration, payment processing, and customer support.
• Legal obligation: Certain data processing activities — particularly KYC identity verification and anti-money laundering transaction monitoring — are carried out to comply with applicable legal and regulatory obligations.
• Legitimate interests: 18aa processes technical data and account activity data to operate and improve the platform, detect and prevent fraud, maintain platform security, and enforce our Terms & Conditions. These activities represent legitimate interests that we consider proportionate and not overridden by your privacy rights.
• Consent: Where 18aa sends you promotional communications about bonuses, new games, or seasonal offers (such as BPL season promotions or Eid bonuses), we do so based on your explicit consent at the time of registration or through your account preferences. You may withdraw consent at any time.

6 How We Use Your Data

18aa uses your personal data for the following specific purposes, each grounded in one of the legal bases described in Section 5:

• Account creation and management: Verifying your identity, creating your account, maintaining your profile, and enabling secure login to your 18aa account.
• Payment processing: Processing deposit and withdrawal requests accurately and promptly, matching transactions to your account, and investigating payment discrepancies.
• Identity and age verification: Conducting KYC checks to confirm that you are who you say you are and that you meet the minimum age requirement of 21 years. Members based in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar are all subject to the same verification standards.
• Fraud prevention and security: Monitoring account activity for signs of fraud, collusion, bot use, multiple account creation, bonus abuse, or money laundering. Investigating and responding to security incidents.
• Customer support: Responding to queries, resolving complaints, and maintaining records of support interactions for quality assurance purposes.
• Responsible gaming: Implementing deposit limits, loss limits, session time-outs, and self-exclusion measures at your request, and monitoring account activity to identify potential problem gambling patterns.
• Platform improvement: Analysing aggregated, anonymised usage data to understand how members use the 18aa platform and to improve game offerings, interface design, and feature performance.
• Promotional communications: Sending you bonus offers, promotion alerts, and seasonal notifications (such as BPL cricket offers or Pohela Boishakh promotions) where you have opted in. All marketing emails include a clear unsubscribe option.
• Legal compliance: Retaining records as required by applicable law, responding to lawful requests from competent authorities, and fulfilling our obligations under anti-money laundering regulations.

7 Data Sharing and Disclosure

18aa does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. Your data may be shared only in the following limited and controlled circumstances:

• Payment service providers: Transaction data is shared with bKash, Nagad, Rocket, Upay, and relevant banks solely to process your deposits and withdrawals. These providers process your data in accordance with their own privacy policies and applicable financial regulations.
• Game technology providers: Bet and game session data is shared with third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) to the extent necessary to operate their games on the 18aa platform and to settle game results accurately.
• Identity verification services: Where a third-party KYC provider is used, your identity documents and personal details are transmitted to that provider for verification. The provider returns a verification outcome only; raw document images are not retained by 18aa beyond the verification period.
• Fraud and compliance services: Aggregated or pseudonymised transaction and behaviour data may be shared with anti-fraud and compliance technology partners to support our fraud prevention and anti-money laundering obligations.
• Legal authorities: 18aa may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law, by court order, or by a directive from a competent authority. We will notify affected members of such disclosures where legally permitted to do so.
• Business transfers: In the event that 18aa undergoes a merger, acquisition, or transfer of its operational assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights under this policy will be maintained.

8 Cookies and Tracking

18aa uses cookies — small text files stored on your device by your browser — to ensure the platform functions correctly, to maintain your login session, and to gather anonymised performance data. We do not use third-party advertising cookies or cross-site tracking technologies.

You may configure your browser to block or delete cookies. Note that blocking essential session cookies will prevent you from logging into your 18aa account and using core platform features. Blocking performance cookies will not affect your ability to use the platform but will limit our ability to identify and fix performance issues.

9 Data Retention

18aa retains personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in this policy, and to comply with our legal obligations. The following general retention periods apply:

• Account data and transaction records: Retained for a minimum of 5 years from the date your account is closed, to comply with anti-money laundering record-keeping requirements.
• KYC identity verification documents: Retained for a minimum of 5 years from the date of verification. Where an account was closed due to fraud or a legal hold, documents may be retained for longer in connection with any ongoing investigation or legal proceedings.
• Customer support communications: Retained for 2 years from the date of the last interaction, or longer where relevant to an open complaint or dispute.
• Technical and session data: Retained for up to 12 months from collection, after which it is anonymised or deleted.
• Responsible gaming records: Retained for the duration of any active self-exclusion period plus 5 years, to prevent re-registration during an exclusion period and to defend against related claims.
• Marketing consent records: Retained for as long as you remain a member and for 2 years after account closure, to evidence that we had valid consent for any marketing communications sent.

When data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the anonymised dataset no longer constitutes personal data and is retained indefinitely for aggregated analytics purposes.

10 Data Security

18aa implements a range of technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These measures include:

• TLS/SSL encryption: All data transmitted between your browser and the 18aa platform is encrypted using current Transport Layer Security (TLS) protocols. Look for the padlock icon in your browser address bar when using 18aa.
• Encryption at rest: Sensitive data stored in our databases — including identity documents and financial references — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: Access to personal data within the 18aa organisation is restricted on a strict need-to-know basis. Staff who handle personal data receive appropriate data protection training and are subject to confidentiality obligations.
• Two-factor authentication: 18aa supports two-factor authentication (2FA) for member accounts. We strongly encourage all members to enable 2FA to protect their account from unauthorised access.
• Penetration testing and audits: The 18aa platform undergoes periodic security testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a confirmed personal data breach that poses a risk to your rights, 18aa will notify affected members promptly and take immediate steps to contain the breach, assess its scope, and prevent recurrence.

11 Your Rights

As a registered 18aa member, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or email. We will respond within 30 days of receiving your request.

• Right of Access: You may request a copy of the personal data 18aa holds about you, along with information about how it is used, who it has been shared with, and how long it will be retained.
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it. Note that corrections to identity data must be supported by documentary evidence.
• Right to Erasure: You may request that 18aa delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where you object to processing. This right is subject to legal retention obligations — for example, we cannot delete transaction records that we are legally required to retain for 5 years.
• Right to Restriction: You may request that 18aa restrict the processing of your personal data in certain circumstances, such as where you have contested the accuracy of the data or where you have objected to processing pending our review.
• Right to Object: You may object to processing based on legitimate interests, including profiling for fraud detection. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests. You may also object to direct marketing at any time without restriction.
• Right to Data Portability: Where processing is based on your consent or a contractual relationship, and is carried out by automated means, you may request that we provide your personal data in a structured, machine-readable format.

12 Children and Minors

The 18aa platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. If we become aware that a registered member is under the minimum age, we will immediately close the account, delete the associated personal data to the extent permitted by law, and — where relevant — report the incident in accordance with our legal obligations.

Parents and guardians in Bangladesh who are concerned that a minor may have accessed or registered on the 18aa platform are encouraged to contact our support team immediately. We will investigate and take prompt action. We also encourage parents and guardians to use parental control software to prevent underage individuals from accessing online gambling platforms.

13 Third-Party Links

The 18aa platform may contain links to third-party websites or services, such as game provider interfaces or payment gateway pages. Once you navigate away from the 18aa platform to a third-party website, this Privacy Policy no longer applies. 18aa is not responsible for the privacy practices of third-party websites, and we have no control over how those websites collect, store, or use your data.

We recommend that you review the privacy policy of any third-party website before submitting personal information. The inclusion of a link to a third-party website on the 18aa platform does not constitute an endorsement of that website's privacy practices or content.

14 Changes to This Policy

18aa reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the policy, we will notify registered members by email and by displaying a prominent notice on the 18aa platform for a period of at least 14 days prior to the changes taking effect.

Minor updates — such as clarifications of existing practices, corrections to typographical errors, or updates to contact information — may be made without advance notice. The "Last updated" date at the top of this policy will always reflect the date of the most recent revision.

Your continued use of the 18aa platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should stop using the platform and close your account. You may contact our support team if you have questions about any changes before they take effect.

15 Contact and Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 18aa handles your personal data, please contact our support team. All privacy-related enquiries are handled by trained staff and responded to within 30 days.

When submitting a data subject request — such as a request to access, correct, or delete your personal data — please include your registered username, the email address associated with your account, and a clear description of the request. We may ask you to verify your identity before we can process the request. We will not charge a fee for standard data requests; however, we reserve the right to charge a reasonable administrative fee for requests that are manifestly unfounded or excessive in scope or frequency.

18aa is committed to resolving all privacy concerns fairly and transparently. If you feel that your concern has not been addressed to your satisfaction, you may raise a complaint through our formal complaints procedure, which is outlined in the 18aa Terms & Conditions at /terms-conditions.