Privacy Policy — How aec67 Protects Your Data

aec67 collects personal data through several channels: directly from players during account registration and KYC verification; automatically through platform usage and technical systems; and, in limited circumstances, from third-party service providers such as payment processors and identity verification agencies. aec67 operates a principle of data minimisation — we collect only the information that is genuinely necessary to deliver our services, comply with our legal obligations, and protect the integrity of the platform.

Registration data collected when you create an aec67 account includes: full legal name, date of birth, Bangladesh mobile number, email address, preferred username, and residential address (city and district — e.g., Dhaka, Chittagong, Sylhet, Khulna, or Rangpur). This information is required to create and manage your account, verify your identity, and comply with anti-money-laundering (AML) obligations.

KYC and identity verification data collected during the mandatory verification process includes: scanned or photographed copies of your Bangladesh National Identity Card (NID), valid passport, or Bangladesh driving licence; a recent photograph (selfie) for facial matching; and, where required, proof of ownership of your payment method (e.g., a screenshot of your registered bKash or Nagad account details). This data is processed by aec67's third-party identity verification partner and is retained in accordance with the Data Retention schedule set out in Section 5 of this policy.

Financial and transaction data includes records of deposits, withdrawals, bonus credits, wagering activity, and account balance history. aec67 retains transaction records for a minimum of 5 years to satisfy financial compliance and AML reporting obligations. Payment instrument details — such as the registered mobile number associated with a bKash or Nagad wallet, or the first six and last four digits of a Visa or Mastercard — are retained for fraud prevention and reversal purposes. Full card numbers and mobile wallet PINs are never stored by aec67.

Technical and usage data collected automatically when you access aec67 includes: IP address, device type and operating system, browser type and version, session timestamps, pages visited, games played, betting patterns, and in-app navigation data. This data is used for platform performance optimisation, fraud detection, responsible gaming monitoring, and improving the overall player experience.

Communications data is collected when you contact the aec67 support team via live chat or email. Records of support interactions, including chat transcripts and email correspondence, are retained to ensure service quality, resolve disputes, and train support personnel. Players who contact support consent to their communications being recorded and reviewed by aec67 staff for quality and compliance purposes.

aec67 uses the personal data it collects for specific, clearly defined purposes. We do not use your data for any purpose that is incompatible with the reasons it was originally collected. The following sets out the primary purposes for which aec67 processes player data, along with the legal basis for each purpose.

Account administration and service delivery: Your registration data is used to create and manage your aec67 account, authenticate your identity at login, process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported payment methods, and deliver account notifications including transaction confirmations and security alerts. This processing is necessary for the performance of the contract between aec67 and you as a player.

Identity verification and KYC compliance: aec67 is required to verify the identity of all players before processing withdrawals, and in some cases before certain deposit thresholds are reached. KYC data is processed to confirm your legal name, age (18+ verification), and payment method ownership. This processing is required by applicable financial regulations and our legal obligations as a platform operator.

Fraud prevention and platform security: Technical and usage data — including IP addresses, device fingerprints, and betting patterns — is analysed by automated systems and reviewed by the aec67 security team to detect fraudulent activity, duplicate accounts, bonus abuse, money laundering, and unauthorised account access. This processing is necessary for the legitimate interests of aec67 and its player community in maintaining a safe and fair gaming environment.

Responsible gaming monitoring: aec67 uses wagering pattern data and account activity history to identify players who may be exhibiting signs of problem gambling behaviour. Where such patterns are identified, aec67 may proactively reach out to the player with information about responsible gaming tools, deposit limits, and self-exclusion options. This processing is in the legitimate interests of player welfare and is aligned with industry best practice for responsible gaming operators.

Marketing and promotional communications: With your consent, aec67 uses your contact details (mobile number and email address) to send promotional communications about bonuses, seasonal offers (including BPL cricket promotions, Eid specials, and Pohela Boishakh campaigns), new game releases, and VIP programme updates. You may withdraw your consent to marketing communications at any time by updating your notification preferences or contacting support. Withdrawal of marketing consent does not affect the lawfulness of prior communications.

Platform analytics and improvement: Aggregated, anonymised usage data is used to analyse player behaviour patterns, identify popular games and features, optimise the aec67 platform interface, and plan future product development. Anonymised analytics data cannot be used to identify any individual player and is retained indefinitely for business intelligence purposes.

aec67 does not sell your personal data to any third party under any circumstances. However, to deliver the full range of aec67 services, we share limited and necessary data with a select group of trusted third-party service providers who are contractually bound to process that data only on aec67's behalf and only for the specific purpose for which it was shared. All third-party data processors engaged by aec67 are required to maintain appropriate technical and organisational security measures to protect the data they handle.

Payment processing partners: To facilitate deposits and withdrawals, aec67 shares your registered payment method identifier (e.g., bKash-registered mobile number, Nagad wallet ID, or Visa/Mastercard partial card details) with the relevant payment processor. Payment processors receive only the minimum information required to execute and verify the transaction. aec67's payment processing partners include but are not limited to: bKash Limited, Nagad (by Bangladesh Post Office), DBBL Rocket, and Upay (UCB Fintech). International card transactions may be processed by a certified payment gateway operating under PCI-DSS standards.

Identity and KYC verification providers: aec67 uses a third-party identity verification service to process KYC document submissions. This service receives copies of your identity documents and performs automated and manual checks, including cross-referencing with available national databases, to confirm your identity, age, and document authenticity. The identity verification provider processes this data solely on aec67's instruction and is prohibited from retaining, selling, or using it for any other purpose.

Regulatory and law enforcement authorities: aec67 may be required by applicable Bangladeshi law or court order to disclose player data to regulatory authorities, law enforcement agencies, or financial intelligence units. In the event of a legally compelled disclosure, aec67 will share only the minimum data required to satisfy the legal obligation and, where legally permissible, will notify the affected player of the disclosure request.

Anti-fraud and security networks: aec67 participates in industry-standard fraud prevention networks that allow the sharing of anonymised risk indicators — such as flagged IP address ranges or device fingerprints associated with known fraud patterns — with other participating platforms. No personally identifiable data (name, NID, mobile number) is shared through these networks.

aec67 does not share player data with social media platforms, advertising networks, data analytics resellers, or any commercial third party for marketing or profiling purposes. Where aec67 uses analytics tools to understand aggregate platform usage, those tools are configured to anonymise all data before processing and do not receive personally identifiable player information.

aec67 retains personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies to the main categories of player data held by aec67. Upon expiry of the applicable retention period, data is securely deleted or permanently anonymised so that it can no longer be linked to an individual player.

Account and registration data is retained for the lifetime of the active account plus a minimum of 5 years following account closure. This retention period reflects financial compliance and AML regulatory requirements applicable to online payment platforms operating in Bangladesh. During this retention period, the data is stored in secure, access-controlled systems and is not used for active marketing purposes once the account has been closed.

KYC and identity verification documents — including copies of NID, passport, and driving licence — are retained for a minimum of 5 years following the date of verification or account closure (whichever is later). This is the standard retention period required for AML compliance documentation.

Financial transaction records are retained for a minimum of 5 years from the date of each transaction. This period is required for financial audit trail purposes and to support any potential regulatory enquiries or player dispute resolution processes.

Support and communication records — including live chat transcripts and email correspondence — are retained for a minimum of 2 years from the date of the interaction, or until any related dispute or complaint is fully resolved, whichever is later.

Technical and usage logs (IP addresses, device data, session logs) are retained for a maximum of 12 months for platform performance and fraud detection purposes, after which they are automatically purged or anonymised.

Data deletion requests: Players wishing to request deletion of their personal data should contact the aec67 support team via live chat or email at [email protected] (plain text only — not a link). Deletion requests will be reviewed within 30 days. Where a deletion request conflicts with a mandatory legal retention obligation (e.g., AML record-keeping requirements), aec67 will notify the player of the applicable retention period and will delete the data as soon as the legal obligation permits.

As a player on the aec67 platform, you hold a set of rights in relation to your personal data. aec67 is committed to honouring these rights in a timely and transparent manner. Requests to exercise any of the rights described below should be submitted to the aec67 Data Protection team via the support channel (live chat or email at [email protected] — plain text, not a clickable link). aec67 will respond to all privacy rights requests within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by a further 30 days with prior notification to the requesting player.

Right of access: You have the right to request a copy of the personal data that aec67 holds about you, together with information about how it is being used, who it has been shared with, and for how long it will be retained. Access requests are fulfilled free of charge in digital format. aec67 may request proof of identity before releasing personal data, to prevent unauthorised disclosure to third parties.

Right to rectification: If any personal data held by aec67 about you is inaccurate, incomplete, or out of date, you have the right to request that it be corrected. Common rectification requests include updates to residential address, mobile number changes following a new SIM registration, or corrections to a misspelled name. Players may correct certain details directly through the account settings panel; others require a formal request via support.

Right to erasure ("right to be forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. As noted in Section 5, certain data categories are subject to mandatory legal retention periods that override erasure requests during the retention window. In such cases, aec67 will delete the data at the earliest opportunity once the legal obligation has been fulfilled.

Right to restriction of processing: In certain circumstances — such as where you contest the accuracy of data, or where processing is unlawful but you prefer restriction over deletion — you have the right to request that aec67 restrict processing of your data to storage only. During a restriction period, your data will not be used for any active purpose beyond storage and legal compliance.

Right to object to marketing: You have the absolute right to object to the use of your personal data for direct marketing purposes (including promotional emails and SMS messages about bonuses, BPL offers, and seasonal campaigns) at any time, without providing a reason. Upon receipt of a marketing objection, aec67 will cease all marketing communications to the affected contact details within 5 business days.

Right to withdraw consent: Where aec67 processes your data on the basis of your consent (principally for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

aec67 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features, or internal data processing practices. When material changes are made to this policy, aec67 will notify all registered players via their registered email address or an in-platform notification at least 14 calendar days before the changes take effect. The updated policy will also be published on this page with a revised "Last Updated" date at the top.

Minor amendments — such as corrections to typographical errors, clarifications of existing language that do not alter the substance of the policy, or updates to contact details — may be made without advance notice. In all cases, the version published on this page constitutes the current, binding version of the aec67 Privacy Policy.

Continued use of the aec67 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this policy, you should cease using the aec67 platform and submit a data deletion request as described in Section 7. Players who close their accounts prior to the effective date of a policy change will not be subject to the new terms for data collected before their account closure; however, the mandatory legal retention obligations described in Section 5 will continue to apply to previously collected data regardless of account status.

Version history: aec67 maintains an internal archive of all previous versions of this Privacy Policy. Players who wish to review the specific version of the policy that was in effect at a particular time (e.g., at the time they registered their account) may request a copy by contacting the Data Protection team via live chat or email.

Children and minors: aec67 does not knowingly collect personal data from individuals under the age of 18. The aec67 platform is strictly for adults aged 18 and above. If aec67 discovers that personal data has been collected from a person under the age of 18, that data will be deleted immediately and the associated account will be permanently closed. If you believe that a minor has registered on the aec67 platform, please contact support immediately at [email protected] (plain text — not a link).

Cross-border data transfers: aec67 operates servers and engages service providers in multiple jurisdictions. Where personal data is transferred outside Bangladesh, aec67 ensures that appropriate safeguards are in place — including contractual data protection clauses — to provide a level of data protection equivalent to that applicable under Bangladeshi data protection principles. Players who have questions about the specific jurisdictions in which their data may be processed are encouraged to contact the Data Protection team.

Contact the Data Protection team: For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by aec67, please contact us via 24/7 live chat available on every page of the platform, or by email at [email protected] (displayed as plain text — this is not a clickable link). The aec67 Data Protection team aims to acknowledge all privacy enquiries within 2 business days and to provide a substantive response within 30 calendar days.