Privacy Policy – How nagad9 Collects, Uses, and Protects Your Personal Data

nagad9 acts as the data controller in respect of all personal data collected through the Platform. As data controller, nagad9 determines the purposes for which, and the means by which, your personal data is processed. All enquiries regarding data protection, including requests to exercise your rights, should be directed to the support team at the email address listed in the footer of this page.

nagad9 is committed to handling personal data responsibly and in accordance with applicable data protection principles. These principles require that personal data is processed lawfully, fairly, and transparently; collected only for specified, legitimate purposes; limited to what is necessary; kept accurate and up to date; retained only for as long as is necessary; and protected by appropriate technical and organisational security measures.

nagad9 collects personal data from you directly when you interact with the Platform, and automatically through technical systems as you browse and use our services. The categories of data we collect include the following:

2.1 Registration and Account Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for age verification — players must be 21 years or older).
• Mobile phone number registered in Bangladesh.
• Email address (if provided during registration).
• Preferred username and encrypted password.
• Residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, or Mymensingh).

2.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification such as a National Identity Card (NID) or passport.
• Proof of address documents such as utility bills or bank statements.
• Proof of payment method ownership, including mobile wallet screenshots showing your registered bKash, Nagad, or Rocket number.
• Selfie or facial photograph where required for enhanced identity verification.

2.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates, and transaction reference numbers.
• Payment method details including mobile wallet numbers (bKash, Nagad, Rocket, Upay) and bank account identifiers (Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank).
• Wagering history, game play records, and betting activity across all nagad9 products.
• Bonus and promotion redemption history.
• Account balance history and statement data.

2.4 Technical and Usage Data

• IP address and approximate geographic location derived from it.
• Device type, operating system, and browser or app version.
• Session start and end times, pages visited, features accessed, and click-path data.
• Referral source (the URL or channel through which you arrived at nagad9).
• Cookies and similar tracking technologies (see Section 8 — Cookies).

2.5 Communications Data

• Records of correspondence with nagad9 customer support, including chat transcripts and email exchanges.
• Survey responses, feedback submissions, and promotional opt-in records.

nagad9 processes your personal data only for defined, legitimate purposes. The table below summarises the principal purposes for which we use your data and the lawful basis for doing so:

Purpose	Lawful Basis
Creating and managing your Account	Performance of a contract
Processing deposits and withdrawals	Performance of a contract
Age and identity verification (KYC)	Legal obligation
Fraud prevention and anti-money laundering checks	Legal obligation / Legitimate interest
Delivering customer support	Performance of a contract
Sending promotional communications (where opted in)	Consent
Improving Platform features and user experience	Legitimate interest
Responsible gaming monitoring and intervention	Legal obligation / Legitimate interest
Compliance with applicable law and regulatory requests	Legal obligation

nagad9 does not use your personal data for automated individual decision-making that produces legal or similarly significant effects without human review. Where profiling is used for responsible gaming monitoring purposes, a member of the nagad9 team will review any intervention before it is applied to your Account.

nagad9 does not sell your personal data to third parties. We share personal data only in the following limited circumstances and always with appropriate safeguards in place:

• Payment processors: We share transaction data with bKash, Nagad, Rocket, Upay, and banking partners solely to facilitate the processing of your deposits and withdrawals. These providers act as independent data controllers in respect of their own services.
• Identity verification providers: We may use third-party KYC and fraud screening services to verify the identity and age of players. These providers process only the data strictly necessary for verification and are contractually bound to keep it confidential.
• Technology and infrastructure providers: nagad9 uses cloud hosting, analytics, and security providers who process data on our behalf as data processors under contractual data processing agreements.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data for game performance and fairness auditing purposes. No personally identifiable information is shared with game studios for marketing purposes.
• Law enforcement and regulatory authorities: Where we are required to do so by applicable law, court order, or regulatory directive, nagad9 will disclose personal data to the relevant authority. We will notify you of such disclosure where we are legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of nagad9's business, personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights under this Policy will continue to apply.

nagad9 does not share personal data with third-party advertisers or data brokers for targeted advertising purposes.

nagad9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and registration data: Retained for the duration of your Account and for a period of five years following Account closure, in line with anti-money laundering record-keeping obligations.
• KYC and identity documents: Retained for five years from the date of verification or Account closure, whichever is later.
• Transaction and betting records: Retained for five years from the date of each transaction or bet settlement.
• Customer support communications: Retained for two years from the date of the last interaction, unless the correspondence relates to an ongoing dispute.
• Technical and usage data (logs): Retained for up to 12 months from the date of collection, after which they are aggregated or anonymised.
• Marketing consent records: Retained for the duration of your opt-in consent, plus one year following withdrawal of consent for record-keeping purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with nagad9's internal data disposal procedures. Where data must be retained beyond the standard period due to an ongoing legal matter or regulatory investigation, you will be notified where practicable.

nagad9 applies a range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your device and nagad9's servers is encrypted using industry-standard SSL/TLS protocols. You can verify this by checking for the padlock icon in your browser's address bar.
• Access controls: Personal data is accessible only to nagad9 staff who have a legitimate operational need to access it. All staff with data access are subject to confidentiality obligations.
• Password hashing: Account passwords are stored as salted cryptographic hashes. nagad9 does not store passwords in plaintext and cannot retrieve your password — only reset it.
• Infrastructure security: nagad9's servers and databases are hosted in secure data centres with physical access controls, firewall protections, and regular vulnerability assessments.
• Incident response: nagad9 maintains a data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected players promptly.

While nagad9 takes data security seriously, no method of electronic transmission or storage is completely secure. You are responsible for keeping your Account credentials — including your password and any one-time passcodes — confidential and for notifying nagad9 immediately if you suspect unauthorised access to your Account.

As a nagad9 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team using the email address in the footer of this page:

• Right of access: You may request a copy of the personal data nagad9 holds about you. We will respond to your request within 30 calendar days of receipt.
• Right to rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you may ask us to correct or update it. In many cases, you can update basic account details directly from within your Account settings.
• Right to erasure ("right to be forgotten"): You may request that nagad9 delete your personal data. We will honour this request where the data is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (see Section 5).
• Right to restriction of processing: In certain circumstances (such as where you contest the accuracy of the data or have objected to processing), you may ask nagad9 to restrict the processing of your personal data.
• Right to data portability: You may request that nagad9 provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to object: You may object at any time to the processing of your personal data for direct marketing purposes. You may also object to processing based on nagad9's legitimate interests, though in some cases we may be able to demonstrate compelling legitimate grounds that override your objection.
• Right to withdraw consent: Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

nagad9 will not charge a fee for handling data rights requests submitted in good faith. Where a request is manifestly unfounded or excessive, nagad9 reserves the right to charge a reasonable administrative fee or decline the request, providing written reasons for doing so.

nagad9 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. Cookies allow nagad9 to recognise your device, remember your preferences, and measure how the Platform is used. The types of cookies we use include:

• Strictly necessary cookies: These are essential for the Platform to function and cannot be disabled. They include session cookies that keep you logged in and security tokens that protect against cross-site request forgery.
• Performance and analytics cookies: These cookies collect anonymised data about how players use the Platform — which pages are visited most, where players encounter errors, and how they navigate between sections. This information helps nagad9 improve the user experience.
• Functional cookies: These cookies remember your preferences, such as your chosen language settings and responsible gaming limits, so that you do not need to re-enter them each time you visit.
• Marketing and attribution cookies: Where you have consented, these cookies help nagad9 understand which channels brought you to the Platform, allowing us to measure the effectiveness of promotions relevant to Bangladesh markets such as BPL and IPL cricket seasons, Eid, and Pohela Boishakh offers.

You can control or delete cookies through your browser settings. Please note that disabling strictly necessary cookies may prevent certain features of nagad9 from functioning correctly. Clearing cookies will log you out of your Account and remove any saved preferences.

nagad9 does not knowingly collect personal data from individuals under the age of 21. The Platform is strictly intended for adults aged 21 and above. If nagad9 becomes aware that personal data has been collected from a person under 21 years of age, we will immediately close the associated Account, void all bets placed from that Account, return any deposited funds to the payment method of origin, and delete the personal data from our systems as soon as practicable in compliance with our legal retention obligations.

If you are a parent or guardian and believe that a minor has registered an Account on nagad9 without your knowledge, please contact our support team immediately using the email address in the footer of this page.

nagad9 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. When material changes are made, we will notify registered players via Account notification or email at least seven days before the revised Policy takes effect. The effective date at the top of this page indicates when the current version was last updated.

Continued use of nagad9 after the effective date of any updated Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically so that you remain informed about how your data is being protected.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way nagad9 handles your personal data, please contact us. Our support team is available 24 hours a day, 7 days a week, including during Bangladesh Standard Time (BST, UTC+6) business hours.

Privacy enquiries email: [email protected]

Please include your registered username and a clear description of your privacy request or concern so that we can handle it promptly and accurately. For data access or deletion requests, please also include a copy of your government-issued ID so that we can verify your identity before releasing or erasing any personal data.