bf89 Privacy
Policy

bf89 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who interacts with our online casino and sports betting platform. This Privacy Policy describes how we collect, use, store, share, and safeguard personal information in connection with the operation of bf89.net, serving players primarily located in Bangladesh.

This policy is intended to comply with internationally recognised data protection principles, including those derived from the General Data Protection Regulation (GDPR) framework, which represents the global standard for responsible data handling even in jurisdictions where it does not apply directly. Where local Bangladeshi law or regulation imposes additional obligations with respect to data handling, those obligations take precedence.

This Privacy Policy should be read alongside the bf89 Terms & Conditions and Responsible Gaming Policy. Together, these documents form the complete framework governing your relationship with bf89. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a data-related matter, this Privacy Policy shall take precedence.

This policy applies to data collected through any channel associated with bf89, including the main website at bf89.net, in-browser live chat, email correspondence with our support team, and any mobile-optimised interface. It does not apply to third-party websites or services that may be linked from our platform — those services operate under their own independent privacy policies.

bf89 collects personal data through three primary channels: information you provide directly during registration and account use, information generated automatically through your interaction with the platform, and information received from third-party service providers such as payment processors. The categories of data we collect are as follows:

bf89 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond identity photograph for KYC purposes), or health data, except where a player voluntarily discloses health-related information in the context of a responsible gaming interaction.

We do not knowingly collect personal data from individuals under the age of 18. If we become aware that data belonging to a minor has been collected, that data will be deleted promptly and the associated account closed in accordance with our Terms & Conditions.

The personal data bf89 collects is used for the following specific purposes:

• Account Creation and Management: To register your account, verify your identity, maintain accurate account records, and enable secure login to the bf89 platform.
• Service Delivery: To process deposits and withdrawals via bKash, Nagad, Rocket, and Upay; to settle bets and game outcomes; to credit bonuses and promotional rewards to eligible accounts.
• Identity and Age Verification (KYC): To confirm that you meet the 18+ age requirement and eligibility criteria before processing withdrawals or extending promotional offers, in compliance with responsible gaming obligations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, bonus abuse, money laundering, and other prohibited conduct. Technical data including IP addresses and device fingerprints is used for this purpose.
• Responsible Gaming: To monitor player behaviour for indicators of problem gambling, enforce self-imposed limits and exclusions, and proactively offer responsible gaming resources where appropriate.
• Customer Support: To respond to your queries, complaints, and formal dispute submissions efficiently and accurately, maintaining records of all interactions for quality and compliance purposes.
• Legal and Regulatory Compliance: To fulfil any reporting, record-keeping, or disclosure obligations imposed by applicable law, regulatory bodies, or law enforcement agencies operating under lawful authority.
• Platform Improvement: To analyse aggregated, anonymised usage patterns and technical data to improve the performance, usability, and security of the bf89 platform over time.
• Marketing Communications: With your explicit consent, to send promotional offers, bonus notifications, and seasonal campaign information (such as BPL cricket promotions, Eid offers, and Pohela Boishakh specials) via email or on-site messaging. You may withdraw marketing consent at any time via your account settings.

Where bf89 processes your data on the basis of legitimate interest — for example, fraud prevention or platform security — we have assessed that our interests do not override your rights and freedoms. You have the right to object to any processing carried out on a legitimate interest basis; see the "Your Privacy Rights" section for details on how to do so.

bf89 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share data with external parties only in the limited circumstances described below, and only under appropriate contractual or legal safeguards:

• Payment Processors: Your mobile wallet identifier (bKash number, Nagad number, Rocket or Upay number) and transaction amounts are shared with the relevant mobile financial service provider solely to process deposits and withdrawals you initiate. Each provider operates under its own privacy policy and applicable Bangladesh Bank regulations.
• Game Technology Providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive pseudonymous player identifiers and game session data necessary to operate their games within the bf89 environment. These providers are contractually prohibited from using this data for independent marketing or analytics beyond the scope of game delivery.
• Identity Verification Services: Third-party KYC and identity verification service providers may process your identity documents and biometric photograph on behalf of bf89 for the purpose of age and identity verification. These processors act under data processing agreements that bind them to confidentiality and data minimisation obligations.
• Analytics and Platform Infrastructure: Anonymised or pseudonymised technical and usage data may be processed by infrastructure and analytics partners to support platform performance monitoring and security operations. No directly identifiable personal data is shared for analytics purposes.
• Law Enforcement and Regulatory Authorities: bf89 may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required by applicable law, court order, or lawful government request. We will notify you of such disclosures wherever legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the bf89 business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to data handling arrangements that result from it.

All third-party processors that handle personal data on behalf of bf89 are subject to written data processing agreements requiring them to maintain appropriate security standards, process data only for the specified purpose, and not retain data beyond the agreed retention period.

When you access bf89.net, our platform places small data files called cookies on your device. We also use related technologies including local storage, session storage, and pixel tags. These technologies serve the following purposes:

bf89 does not use third-party advertising cookies or retargeting pixels. We do not participate in cross-site behavioural advertising networks, and we do not permit third-party advertising technology providers to place cookies on bf89.net pages.

You can control cookie behaviour through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and receive alerts when new cookies are set. Note that disabling strictly necessary cookies will prevent you from logging into your bf89 account. Detailed instructions for managing cookies are available in the help documentation for your specific browser (Chrome, Firefox, Samsung Internet, Opera Mini, etc.).

bf89 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, to comply with legal and regulatory obligations, and to resolve any disputes that may arise. The following retention schedule applies:

• Active Account Data (identity, contact, financial): Retained for the full duration of the account's active status plus a minimum of five (5) years following permanent account closure. This extended retention period exists to satisfy anti-money laundering (AML) record-keeping requirements applicable to financial services businesses.
• Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, consistent with standard financial record-keeping practices and to support dispute resolution.
• KYC Documents (NID copies, passport scans, utility bills): Retained for five (5) years after account closure. Physical or digital copies are stored in encrypted, access-controlled environments with strict internal access logging.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, or longer where a formal complaint or legal matter remains unresolved.
• Responsible Gaming Records (self-exclusion status, limit history): Retained for five (5) years from account closure to ensure that any self-exclusion commitment is honoured if the individual attempts to re-register.
• Technical and Log Data (IP addresses, session logs): Retained for twelve (12) months for routine purposes, and up to three (3) years where the data is associated with a fraud investigation or security incident.
• Marketing Consent Records: Retained for as long as you maintain an active marketing consent, plus three (3) years after withdrawal of consent as evidence of prior permission.

All personal data is stored on servers that implement industry-standard encryption at rest. bf89 maintains strict internal access controls, ensuring that only authorised personnel with a legitimate operational need may access personal data. Access events are logged and audited regularly.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.

Subject to applicable legal exemptions, you have the following rights with respect to your personal data held by bf89:

• Right of Access: You may request a copy of all personal data that bf89 holds about you. We will provide this in a structured, commonly used electronic format within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as a misspelled address) can often be made directly through your account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request that bf89 delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no overriding legitimate interest exists. Note that this right may be limited where retention is required by law — for example, AML record-keeping obligations.
• Right to Restriction of Processing: In certain circumstances (such as where you contest the accuracy of data or have objected to processing pending our review), you may request that processing of your data be restricted to storage only, until the matter is resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your data in a machine-readable format and, where technically feasible, to have it transmitted directly to another controller.
• Right to Object: You may object to processing of your personal data where bf89 relies on legitimate interest as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Marketing Consent: If you have opted in to receive marketing communications from bf89, you may withdraw that consent at any time. Withdrawal of marketing consent will not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact bf89 customer support via live chat or by email to [email protected] with the subject line "DATA RIGHTS REQUEST". Please include your registered account details and specify the right you wish to exercise. We will acknowledge your request within 5 business days (Bangladesh Standard Time, UTC+6) and aim to fulfil it within 30 calendar days. Complex requests may require up to 60 days; we will notify you if an extension is necessary.

bf89 employs a layered security approach to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our technical and organisational security measures include:

• Transport Layer Security (TLS): All data transmitted between your device and bf89 servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained and renewed continuously to prevent lapses in encryption coverage.
• Encryption at Rest: Sensitive personal data — including identity documents, financial records, and KYC data — is encrypted at rest using AES-256 or equivalent standards within our database infrastructure.
• Access Controls: Internal access to personal data is restricted to personnel who require it to perform their operational role. Role-based access controls are enforced, and all access events are logged in a tamper-resistant audit trail.
• Password Security: Player account passwords are stored as salted cryptographic hashes. bf89 employees cannot view your password in plain text under any circumstances. We strongly recommend enabling two-factor authentication (2FA) on your account.
• Penetration Testing and Vulnerability Management: The bf89 platform undergoes periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, bf89 will notify affected players without undue delay and, where required by applicable law, will report the breach to the relevant authority within the required timeframe.

While bf89 implements robust security measures, no digital platform can guarantee absolute security against all possible threats. You play an important role in protecting your own account security by choosing a strong unique password, keeping your login credentials confidential, and notifying us immediately if you suspect any unauthorised access to your account.

bf89 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, applicable legal requirements, or feedback from players. The effective date displayed at the top of this document indicates when the current version came into force.

Where updates are material — meaning they significantly alter how we collect, use, or share your personal data, or meaningfully affect your privacy rights — bf89 will notify you in advance through a prominent on-site notice and, where a registered email address is available, by direct email notification. We will always give you reasonable time to review material changes before they take effect.

Minor updates, such as clarifications, typographical corrections, or restructuring that does not change the substance of the policy, take effect immediately upon publication without advance individual notification. The updated effective date at the top of the document serves as the notification of such changes.

If you disagree with a material update to this Privacy Policy, you may request account closure in accordance with Section 08 of the bf89 Terms & Conditions before the updated policy takes effect. Continued use of the bf89 platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

Previous versions of this Privacy Policy are archived and available upon request by contacting our support team. This provides a clear audit trail of how our data practices have evolved over time.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bf89 handles your personal data, please contact us through any of the following channels:

• Live Chat: Available 24/7 on the bf89 platform. Our support agents can handle general privacy queries, direct you to the correct team for formal requests, and provide initial acknowledgement of data rights submissions.
• Email: For formal data rights requests, complaints, or detailed privacy enquiries, contact us at [email protected] with the subject line "PRIVACY ENQUIRY" or "DATA RIGHTS REQUEST" as appropriate. Responses are provided in English within 5 business days (Bangladesh Standard Time, UTC+6).
• WhatsApp Support: +880 1700-BF89XX — available for general account queries during Bangladesh Standard Time (UTC+6) business hours. For formal data requests, email is the preferred channel to ensure a full written record.

All formal data rights requests will be handled by bf89's dedicated compliance team. We will not ask you for your account password or any unnecessary personal information when processing a data rights request. Identity verification may be required to confirm that the request is being made by the account holder or an authorised representative.