bag33 Privacy
Policy

This Privacy Policy ("Policy") describes how bag33 ("bag33", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to players, visitors, and other users ("you", "your") of the bag33 online betting and casino platform, accessible at https://bag33.io and all associated sub-pages, features, and services (collectively, the "Platform").

bag33 is committed to protecting the privacy and personal data of everyone who interacts with our Platform. We handle all personal data in a manner that is lawful, fair, transparent, and consistent with the data protection principles outlined in this Policy.

By registering an account on bag33, making a deposit, placing a wager, or otherwise accessing or using the Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not access or use the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, each of which forms part of the overall agreement between you and bag33.

This Policy is written in English, which is the governing language for all legal and interpretive purposes. bag33 targets the Bangladesh market and operates exclusively in English as its site language.

bag33 collects personal data in the following categories depending on how you interact with the Platform:

A. Registration & Identity Data

• Full legal name
• Date of birth (used for mandatory age verification — players must be 21 years or older)
• Residential address (including division, district, and postal code within Bangladesh)
• Email address
• Bangladeshi mobile number
• National Identity Card (NID) number (where provided for KYC verification)
• Selfie photograph and/or scanned identity document (where submitted for KYC)

B. Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts in BDT (Bangladeshi Taka), timestamps, and transaction reference numbers
• Mobile financial service (MFS) account references (e.g., bKash, Nagad, Rocket, Upay numbers) — note: bag33 does not store full MFS account passwords
• Bank account details (where provided for direct bank transfer processing via Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, or Sonali Bank)
• Bonus and promotional credit history

C. Gaming & Betting Activity Data

• Betting and wagering history including markets selected, stake amounts, odds accepted, and outcomes
• Casino and slot game session history including games played, session duration, and win/loss records
• Account balance history and responsible gaming tool usage (deposit limits set, session limits, cooling-off periods, self-exclusion requests)

D. Technical & Device Data

• IP address and geolocation data (used to verify that access is from Bangladesh and to detect fraudulent activity)
• Device type, operating system, and browser information
• Session timestamps and duration
• Cookies and similar tracking identifiers (see Section 08)

E. Communications Data

• Records of communications between you and the bag33 support team (email correspondence, support ticket content)
• Feedback, complaints, or dispute records

bag33 uses the personal data it collects for the following specific purposes:

bag33 does not use your personal data for automated decision-making that produces significant legal effects without human review, except where explicitly required for fraud prevention or regulatory compliance purposes.

bag33 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to provide the betting, casino, and payment services you have registered to use. Without this processing, we cannot operate your account or deliver our services.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, age verification mandates, and lawful requests from financial intelligence or law enforcement authorities.
• Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided those interests are not overridden by your rights and freedoms.
• Consent: Where we rely on your consent as the legal basis for a specific processing activity (such as sending promotional communications), we will request that consent explicitly and separately. You may withdraw consent at any time by contacting [email protected], without affecting the lawfulness of processing carried out prior to withdrawal.

bag33 does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. Your data may be shared only in the following limited and controlled circumstances:

• Payment Processors: Transaction data is shared with mobile financial service providers (bKash, Nagad, Rocket, Upay) and banking partners (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank) strictly as necessary to process your deposits and withdrawals. These partners operate under their own data protection obligations and are not permitted to use your data for any other purpose.
• Game & Technology Providers: Certain game session data is processed by our licensed game studios and technology partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — solely to deliver the games and verify outcomes. These providers are contractually bound to treat your data with the same standard of care as bag33.
• Fraud Prevention & Security Partners: We may share technical data (such as IP addresses and device fingerprints) with specialist fraud detection and cybersecurity service providers to protect the Platform and its players from fraudulent activity.
• Legal & Regulatory Authorities: bag33 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent regulatory authorities where required by applicable law or in response to a valid legal order. Such disclosures are made only where legally required and to the minimum extent necessary.
• Business Transfers: In the event of a merger, acquisition, asset sale, or restructuring of bag33's business, your personal data may be transferred to the acquiring or successor entity, subject to the same or equivalent privacy protections as described in this Policy. We will notify active players of any such transfer where practicable.

All third-party data processors engaged by bag33 are subject to written data processing agreements that require them to implement appropriate technical and organisational security measures and to process data only on documented instructions from bag33.

bag33 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected and to comply with applicable legal and regulatory obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

Where you request deletion of your account and personal data prior to the expiry of a mandatory retention period, bag33 will restrict active processing of your data to the minimum necessary to comply with its legal obligations and will delete all data that is not subject to a mandatory retention requirement.

bag33 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data exchanged between your device and the bag33 Platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all pages of the Platform, including registration, login, deposit, withdrawal, and support interactions.
• Encryption at Rest: Sensitive personal data stored on bag33's servers — including identity documents and financial records — is encrypted at rest using strong encryption algorithms.
• Access Controls: Access to personal data within bag33's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited. Privileged access requires multi-factor authentication.
• Regular Security Audits: bag33 conducts regular internal and third-party security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses in our systems.
• Incident Response: bag33 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players promptly and take all reasonable steps to contain, investigate, and remediate the incident.

While bag33 takes every reasonable precaution to safeguard your data, no online system can guarantee absolute security. You are responsible for maintaining the confidentiality of your bag33 account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

bag33 uses cookies and similar tracking technologies (such as web beacons and local storage tokens) on the Platform. These technologies help us deliver a functional, secure, and optimised experience for all players.

bag33 does not use advertising or third-party marketing cookies. We do not share cookie data with advertising networks, social media platforms, or any other third party for the purpose of building advertising profiles or retargeting you with ads on other websites.

You may manage or disable non-essential cookies at any time through your browser's privacy settings. Please note that disabling essential cookies will impair the functionality of the Platform and may prevent you from logging in or accessing your account.

As a player on the bag33 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Privacy Rights Request". We will respond within 5 business days of receiving your request.

• Right of Access: You have the right to request a copy of the personal data bag33 holds about you, along with information about how it is being used and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent on which processing is based; or (c) the data has been unlawfully processed. Note that deletion requests are subject to bag33's mandatory legal retention obligations — data that must be retained by law cannot be deleted until the applicable retention period has expired.
• Right to Restriction of Processing: You may request that bag33 restrict the active processing of your data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a structured, machine-readable copy of your personal data for your own use or for transfer to another service provider.
• Right to Object: You have the right to object to the processing of your personal data where it is based on bag33's legitimate interests, including processing for direct marketing purposes. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your explicit consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

bag33 will not charge a fee for standard privacy rights requests and will not discriminate against players who exercise their rights. Where a request is manifestly unfounded or excessive (for example, repetitive requests for the same data), bag33 reserves the right to charge a reasonable administrative fee or to decline the request, providing written reasons for doing so.

The bag33 Platform is strictly intended for adults aged 21 years and older. bag33 does not knowingly collect personal data from individuals under the age of 21. This is a firm, non-negotiable requirement enforced at the point of registration and throughout a player's use of the Platform.

bag33 employs mandatory age verification checks as part of our KYC (Know Your Customer) process. All players are required to confirm their date of birth at registration, and bag33 may request documentary evidence of age — including a National Identity Card (NID) or passport — before allowing deposits, withdrawals, or access to real-money gaming features.

If bag33 discovers that personal data has been collected from a player who was under the age of 21 at the time of registration, the account will be immediately suspended, all gaming activity will be reviewed, applicable winnings may be voided, deposited funds will be returned to their source, and all personal data associated with that account will be deleted as soon as the mandatory review process is complete.

If you are a parent or guardian and believe that your child has registered on bag33 using false age information, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and take action without delay.

bag33 primarily processes and stores personal data within its secure server infrastructure. Some of our third-party service providers — including licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may process certain game session data on servers located outside Bangladesh.

Where personal data is transferred to a third party operating outside Bangladesh, bag33 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements that require the recipient to implement security standards equivalent to those described in this Policy.
• Transfers only to organisations that are subject to recognised data protection frameworks or that have provided sufficient guarantees of compliance with applicable data protection principles.

By using the bag33 Platform, you acknowledge that certain data processing activities may involve international transfers as described above, and you consent to such transfers being carried out in accordance with the safeguards described in this Policy.

bag33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, bag33 will update the "Last Updated" date at the top of this document and, where reasonably practicable, notify active players via email or in-platform notification.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes and your acceptance of the revised terms. If you do not agree with any amendment to this Policy, you must immediately cease using the Platform and contact [email protected] to request account closure.

We encourage all players to review this Privacy Policy periodically to stay informed about how bag33 protects your personal data. The most current version of this Policy is always available at https://bag33.io/privacy-policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bag33 handles your personal data, please contact our Data Protection team directly:

• Email: [email protected]
• Subject Line: Privacy Policy Enquiry
• Response Time: Within 5 business days (Bangladesh Standard Time, UTC+6)

bag33 takes all privacy complaints seriously. Upon receipt of a formal complaint, we will acknowledge your submission, investigate the matter thoroughly, and provide a substantive written response within the stated timeframe. Where a complaint cannot be resolved to your satisfaction through our internal process, you may escalate the matter to the relevant regulatory authority in your jurisdiction.