acd8 Privacy Policy

1 Introduction

Welcome to the acd8 Privacy Policy. acd8 ("we", "us", "our", "acd8") operates the online betting and gaming platform accessible at acd8.io, offering cricket betting, live casino, slot games, fishing games, and related services to players in Bangladesh and other eligible jurisdictions.

We are committed to protecting the privacy and personal data of everyone who interacts with our platform — whether you are a registered player, a visitor browsing the acd8 website, or a prospective user who has not yet created an account. This Privacy Policy describes in clear, formal terms what personal data we collect about you, why we collect it, how we store and protect it, to whom we may disclose it, and what choices and rights you have regarding your own data.

This Privacy Policy should be read alongside the acd8 Terms & Conditions and, where applicable, the Responsible Gaming policy. Together, these documents govern your use of the acd8 platform.

2 Data Controller

For the purposes of applicable data protection legislation, the data controller responsible for your personal data is the acd8 operating entity that holds the platform's gaming licence. The data controller determines the purposes for which, and the means by which, your personal data is processed. All data subject rights requests, privacy enquiries, and data protection concerns should be directed to the acd8 Data Protection contact detailed in Section 15 of this Policy.

acd8 may appoint a Data Protection Officer (DPO) or equivalent privacy compliance contact. Enquiries addressed to the DPO will be acknowledged within 5 business days and responded to within 30 calendar days in accordance with standard data subject rights timelines.

3 Data We Collect

acd8 collects and processes the following categories of personal data:

3.1 Identity & Contact Data

• Full legal name (as it appears on government-issued ID)
• Date of birth (for age verification — players must be 21 or older)
• Residential address (including city, division, and postcode)
• Mobile phone number (primary contact and OTP verification)
• Email address (account communications and support)
• National ID Card (NID) number or passport number (KYC verification)

3.2 Account & Credentials Data

• acd8 username and encrypted account password
• Security question responses (if set)
• Account registration date and time
• Account status and verification tier

3.3 Financial & Transaction Data

• Deposit and withdrawal history (amounts, timestamps, methods)
• Mobile banking account identifiers (bKash, Nagad, Rocket, Upay numbers — used for payment routing and withdrawal verification; PINs and full account credentials are never stored by acd8)
• Card payment metadata (last 4 digits, card type, expiry month/year — stored by our PCI-DSS compliant payment processor, not by acd8 directly)
• Bonus and promotion redemption history
• Account balance history

3.4 Wagering & Gaming Data

• Betting and gaming history (markets selected, stakes placed, outcomes, winnings)
• Game session timestamps and duration
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)
• Sports preferences and in-app behaviour patterns (for platform personalisation)

3.5 Technical & Device Data

• IP address and approximate geolocation (city/region level — used for fraud prevention and jurisdictional compliance)
• Device type, operating system, browser type and version
• Session identifiers and authentication tokens
• Referring URL (how you arrived at acd8.io)
• Log data: page views, feature interactions, error logs

3.6 Communications Data

• Records of your correspondence with acd8 customer support (email threads, live chat transcripts)
• Feedback and survey responses submitted voluntarily
• Marketing communication preferences and opt-in/opt-out records

3.7 KYC Documentation

• Scanned or photographed copies of government-issued identity documents (NID, passport, driving licence) submitted during identity verification
• Proof-of-address documents (utility bill, bank statement) where requested
• Selfie or liveness-check images submitted for biometric identity verification (where applicable)

4 How We Collect Your Data

acd8 collects personal data through the following means:

5 How We Use Your Data

acd8 uses the personal data we collect for the following specific purposes:

• Account Registration & Management: To create, maintain, and administer your acd8 account, verify your identity and age, and communicate essential account-related information to you.
• Payment Processing: To process deposits and withdrawals securely, verify payment method ownership, and comply with anti-money laundering (AML) requirements.
• Platform Operation: To provide access to sports betting, casino games, fishing games, and slot games; to display accurate account balances and betting history; and to support real-time gaming features.
• Customer Support: To respond to your queries, investigate complaints, resolve disputes, and provide technical assistance.
• Legal & Regulatory Compliance: To comply with KYC, AML, and responsible gaming obligations under applicable law and our operating licence conditions, including age verification requirements (21+ only).
• Fraud & Security: To detect, investigate, and prevent fraudulent accounts, bonus abuse, money laundering, match-fixing, use of prohibited software, and other violations of the acd8 Terms & Conditions.
• Responsible Gaming: To monitor gambling behaviour patterns that may indicate problem gambling, to enforce responsible gaming tool settings you have activated (such as deposit limits or self-exclusion), and to proactively reach out when our monitoring systems flag a concern.
• Marketing Communications: Where you have given explicit consent, to send you promotional emails, SMS messages, or in-platform notifications about acd8 bonuses, seasonal promotions (such as Eid or BPL cricket special offers), and new game releases. You may withdraw marketing consent at any time.
• Platform Improvement: To analyse aggregated, anonymised usage data to identify areas for improvement, test new features, and optimise the acd8 user experience for players across Bangladesh including in Dhaka, Chittagong, Sylhet, and beyond.
• Legal Claims: To establish, exercise, or defend legal claims in arbitration, litigation, or regulatory proceedings.

6 Legal Basis for Processing

To the extent that applicable data protection law requires acd8 to identify a legal basis for each processing activity, the legal bases we rely upon are as follows:

• Contract Performance: Processing necessary to fulfil our obligations to you under the acd8 Terms & Conditions — including account management, payment processing, and delivering the betting and gaming services you have contracted for.
• Legal Obligation: Processing required to comply with KYC, AML, responsible gaming, and other regulatory obligations imposed on acd8 by its operating licence and applicable law.
• Legitimate Interests: Processing necessary for acd8's legitimate business interests, including fraud prevention, platform security, abuse detection, and internal analytics — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where we have obtained your specific, informed, and freely given consent. You may withdraw consent at any time without penalty.

7 Data Sharing & Disclosure

acd8 does not sell your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

7.1 Payment Service Providers

We share necessary transaction data with bKash, Nagad, Rocket, Upay, and our card payment gateway partners to process your deposits and withdrawals. These providers are bound by their own data protection obligations and PCI-DSS compliance requirements.

7.2 KYC & Identity Verification Partners

We share identity document images and personal details with our contracted KYC verification service providers for the sole purpose of verifying your identity and age. KYC partners are contractually prohibited from using your data for any purpose other than providing verification services to acd8.

7.3 Fraud Prevention & Security Services

We share device and behavioural signals with fraud detection partners to identify and prevent suspicious activity. These partners process data on our behalf as data processors under contractual data protection terms.

7.4 Game Providers

When you play a game provided by a third-party studio (such as Evolution Gaming, Pragmatic Play, Ezugi, NetEnt, Microgaming, or Spribe), limited session and account data is shared with that provider to facilitate game access and to return game outcome results to your acd8 account. Game providers are bound by contractual confidentiality and data protection obligations.

7.5 Legal & Regulatory Authorities

acd8 may disclose personal data to law enforcement agencies, financial intelligence units, gaming regulators, or courts when required to do so by applicable law, valid legal process, or our licensing authority. We will, where legally permitted, notify affected account holders of such disclosures.

7.6 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of acd8's business, personal data held by acd8 may be transferred to the successor entity. We will notify affected account holders of any such transfer and the privacy terms applicable to their data under the new entity.

8 Data Retention

acd8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised in accordance with our data disposal procedures. Anonymised aggregated data (from which no individual can be identified) may be retained indefinitely for statistical and business analysis purposes.

9 Data Security

acd8 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport Security: All data in transit between your device and acd8 servers is encrypted using 256-bit TLS 1.3 (or the strongest protocol supported by your browser). HTTP connections are automatically redirected to HTTPS.
• Data at Rest Encryption: Sensitive personal data stored in acd8's databases is encrypted at rest using AES-256 encryption.
• Password Security: Account passwords are never stored in plain text. acd8 uses a strong one-way cryptographic hashing algorithm with per-user salting to store password credentials.
• Access Controls: Access to personal data within acd8's internal systems is strictly role-based. Only authorised personnel with a legitimate operational need may access player personal data, and all such access is logged and audited.
• Two-Factor Authentication (2FA): acd8 strongly encourages all players to enable 2FA on their accounts for an additional layer of login security. 2FA is also mandated for internal acd8 staff accessing sensitive operational systems.
• Penetration Testing: acd8 engages independent security professionals to conduct regular penetration testing and vulnerability assessments of the platform infrastructure.
• Incident Response: acd8 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, acd8 will notify affected account holders without undue delay and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

10 Cookies & Tracking Technologies

acd8 uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) on the acd8.io website and platform. This section explains what these technologies are, which ones we use, and how you can manage your preferences.

10.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits, remember your preferences, maintain your logged-in session, and collect certain usage analytics.

10.2 Types of Cookies We Use

10.3 Managing Cookies

You may control and manage cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored on your device. Please note that disabling strictly necessary cookies will prevent you from logging in to your acd8 account and using the platform. Instructions for managing cookies in major browsers are available in each browser's official help documentation. acd8 does not use third-party advertising or tracking cookies.

11 Your Privacy Rights

Subject to applicable data protection law and certain legal limitations, you have the following rights in relation to your personal data held by acd8:

• Right of Access: You have the right to request a copy of the personal data acd8 holds about you, together with information about how that data is processed.
• Right to Rectification: If any personal data acd8 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may also update certain account details directly within your acd8 account settings.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected, or where you withdraw consent. This right is subject to acd8's legal data retention obligations (see Section 8), which may require us to retain certain data for a defined period even after account closure.
• Right to Restrict Processing: You have the right to request that acd8 restrict the processing of your personal data in certain circumstances — for example, while a dispute about data accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where acd8 relies on legitimate interests as the legal basis, unless acd8 can demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to processing for direct marketing purposes at any time.
• Right to Withdraw Consent: Where acd8 processes your data based on your consent (e.g., for marketing communications), you may withdraw that consent at any time by contacting support or using the opt-out mechanism in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact the acd8 privacy team at [email protected] with the subject line "Privacy Rights Request". acd8 will respond to all valid data subject rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case acd8 will notify you of the extension within the initial 30-day window.

12 Minors & Age Verification

The acd8 platform is strictly intended for adults aged 21 years and above. acd8 does not knowingly collect personal data from individuals under the age of 21, and we do not permit anyone under 21 to register an account or access real-money betting or gaming services on the platform.

As part of the account registration and KYC verification process, acd8 requires all players to confirm their date of birth and to submit valid government-issued identity documentation to verify that they meet the minimum age requirement. Where our verification systems flag a potential underage user, the account is immediately suspended pending further investigation.

If acd8 discovers that personal data has been collected from a person under the age of 21 — whether through a misrepresentation of age during registration or any other means — we will promptly delete all personal data associated with that account and close the account permanently. Any funds deposited by an underage user will be returned through the original payment method, less any bonus amounts, in accordance with the acd8 Terms & Conditions.

If you are a parent or guardian and believe that a minor in your care has created an acd8 account, please contact us immediately at [email protected] so that we may take appropriate action without delay.

13 International Data Transfers

acd8 operates internationally, and your personal data may be transferred to, stored in, or processed in countries other than the country in which you reside, including countries that may not provide the same level of data protection as your home jurisdiction.

When acd8 transfers personal data across international borders, we ensure that appropriate safeguards are in place to protect your data. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities and incorporated into our agreements with third-party data processors located outside your jurisdiction;
• Transfers to countries that have received an adequacy decision recognising their data protection framework as equivalent to the standards required by applicable law;
• Binding Corporate Rules (BCRs) where applicable within the acd8 corporate group;
• Other legally recognised transfer mechanisms as may be adopted from time to time.

You may request further information about the specific safeguards in place for international data transfers affecting your personal data by contacting the acd8 privacy team at the contact details set out in Section 15.

14 Changes to This Privacy Policy

acd8 reserves the right to update or modify this Privacy Policy at any time. Changes may be made to reflect developments in applicable data protection law, updates to our platform features and data processing activities, changes to our third-party service providers, or improvements to our privacy practices based on internal review.

When we make material changes to this Privacy Policy — that is, changes that meaningfully affect how we collect, use, or share your personal data — we will notify you by one or more of the following means:

• Posting a prominent notice on the acd8.io website and/or within your logged-in account dashboard;
• Sending a notification to the email address registered to your acd8 account;
• Sending an SMS notification to your registered mobile number.

The "Effective Date" shown at the top of this Privacy Policy will always reflect the date on which the most recent version came into force. We encourage you to review this Privacy Policy periodically to stay informed about how acd8 is protecting your personal information. Continued use of the acd8 platform following notification of material changes to this Privacy Policy will constitute your acknowledgement of the updated terms.

15 Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way acd8 processes your personal data, please contact the acd8 privacy team using the details below. acd8 is committed to addressing all privacy enquiries in a timely, professional, and transparent manner.

Privacy & Data Protection Contact:
Email: [email protected]
Subject line for privacy enquiries: "Privacy Rights Request" or "Privacy Policy Enquiry"
Response time: Within 30 calendar days of receipt of a valid, verifiable request.

If you are not satisfied with acd8's response to your privacy enquiry or data subject rights request, you have the right to escalate your concern to the relevant data protection supervisory authority in the jurisdiction under whose laws acd8 is required to operate.