Privacy Policy — Your Data at bq77

bq77 operates the online gaming and sports betting platform accessible at bq77.bet. For the purposes of this Privacy Policy, bq77 acts as the data controller in respect of all personal data collected from players and visitors to the platform. As data controller, bq77 determines the purposes for which and the means by which personal data is processed.

This Privacy Policy applies to:

• All registered players who hold an active or inactive bq77 account.
• All visitors who browse the bq77 platform, whether or not they proceed to create an account.
• All individuals who communicate with bq77 via Live Chat, email, or WhatsApp support channels.
• All individuals who participate in bq77 promotions, surveys, or feedback programmes.

This policy does not apply to third-party websites, payment processors, or game providers that may be accessible via links or integrations from within the bq77 platform. Each such third party operates under its own privacy policy, and bq77 encourages players to review those policies independently.

The primary language of this Privacy Policy is English. Where bq77 communicates with players based in Bangladesh, all privacy-related communications will be conducted in English in accordance with the platform's language policy.

bq77 processes personal data only where there is a valid lawful basis for doing so. The primary lawful bases upon which bq77 relies when processing player data are as follows:

• Contractual Necessity: Processing is necessary to perform the contract between bq77 and the player — that is, to operate the player's account, process deposits and withdrawals, credit winnings, and deliver the gaming and betting services described in the Terms & Conditions. Without this processing, bq77 would be unable to provide its services.
• Legal Obligation: Processing is necessary to comply with applicable legal requirements, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, age verification duties, fraud prevention, and financial record-keeping obligations. bq77 is required to retain certain categories of data for defined periods regardless of a player's withdrawal request.
• Legitimate Interests: Processing is necessary for bq77's legitimate business interests, provided those interests are not overridden by the player's own privacy rights. Legitimate interest processing at bq77 includes: platform security monitoring, fraud and abuse detection, responsible gambling analysis, internal analytics to improve the platform, and network and information security.
• Consent: Where bq77 relies on consent as the lawful basis for processing — in particular for the sending of promotional emails, SMS marketing, and the placement of non-essential cookies — that consent is sought separately and explicitly. Players may withdraw consent at any time without detriment to their account status, by contacting support at [email protected] or adjusting account communication settings.

bq77 does not sell, rent, or trade personal data to any third party for commercial purposes. Personal data is shared with third parties only in the limited circumstances described below, and only to the extent strictly necessary for the relevant purpose:

• Payment Processing Partners: Transaction data — including wallet numbers, amounts, and reference codes — is shared with mobile financial service providers including bKash, Nagad, Rocket, and Upay for the sole purpose of processing deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated.
• Identity Verification Providers: Where bq77 uses third-party KYC or identity verification technology, relevant identity data (name, date of birth, ID document images) may be transmitted to that provider in encrypted form for the purpose of age and identity verification. bq77 selects KYC partners that maintain data security standards equivalent to or exceeding those applied by bq77 itself.
• Game and Software Providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive limited technical data (session identifiers, wager amounts, game outcome records) in the ordinary course of delivering their games via the bq77 platform. These providers are contractually prohibited from using such data for any purpose other than delivering and auditing their services.
• Analytics and Platform Infrastructure: bq77 may use third-party infrastructure and analytics service providers to host the platform, monitor uptime, and analyse aggregate usage patterns. These providers act as data processors under written contracts and are not permitted to process player data for their own purposes.
• Legal and Regulatory Disclosure: bq77 may disclose personal data to law enforcement agencies, financial intelligence units, courts, or other competent authorities where required to do so by applicable law, a valid court order, or a lawful regulatory demand. bq77 will, where legally permitted, notify the affected player of any such disclosure.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of bq77's assets, personal data held by bq77 may be transferred to the acquiring entity, provided that the acquiring entity agrees in writing to honour the commitments set out in this Privacy Policy.

bq77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Active Account Data: Retained for the duration of the active account relationship. Data is reviewed periodically; accounts that have been dormant for 24 consecutive months may be subject to a data minimisation review, during which non-essential data may be deleted.
• Transaction and Financial Records: Retained for a minimum of 5 years from the date of the transaction, in accordance with standard financial record-keeping and anti-money laundering obligations applicable to online gaming platforms.
• KYC and Identity Documents: Retained for a minimum of 5 years from the date of account closure or the date of the last verified transaction, whichever is later. This retention is required to support the investigation of any financial crime allegations that may arise after account closure.
• Customer Support Records: Live chat transcripts, email correspondence, and support ticket records are retained for a minimum of 3 years from the date of the interaction, for dispute resolution, quality assurance, and compliance audit purposes.
• Marketing Data: Communication preference records and marketing consent logs are retained for the duration of the player's account plus 2 years, to demonstrate compliance with applicable marketing consent requirements.
• Game and Wagering Logs: Detailed game session logs and wagering history are retained for a minimum of 3 years from the date of the session, for dispute resolution, responsible gambling analysis, and regulatory compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is used in preference to deletion, the resulting data may be retained indefinitely for aggregated statistical analysis.

bq77 applies a layered approach to data security, combining technical, organisational, and procedural safeguards to protect player personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures in place at bq77 include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the bq77 platform is encrypted using TLS 1.2 or higher, preventing interception of data in transit. The bq77 platform enforces HTTPS across all pages.
• Encryption at Rest: Sensitive personal data — including identity documents, financial records, and KYC data — is stored in encrypted form on bq77's servers. Encryption keys are managed separately from the data they protect.
• Access Controls: Access to personal data within bq77's internal systems is restricted on a strict need-to-know basis. Staff who are not required to access personal data in the performance of their role are denied access. All internal access is logged and subject to periodic review.
• Two-Factor Authentication: bq77 strongly encourages all players to enable two-factor authentication (2FA) on their accounts. 2FA adds a second layer of security by requiring a one-time code — sent to your registered mobile number — in addition to your password when logging in.
• Penetration Testing and Vulnerability Management: The bq77 platform undergoes regular security assessments including penetration testing by qualified security professionals. Identified vulnerabilities are remediated on a risk-prioritised basis.
• Incident Response: In the event of a confirmed personal data breach that is likely to result in risk to affected players, bq77 will notify affected players and, where applicable, the relevant competent authority, within the timeframes required by applicable law. Notification will be issued via the email address registered to the affected account.