ac366 Privacy Policy

1.1 Information You Provide Directly

When you register an account with ac366, you provide us with personal information that is necessary to create and manage your account, verify your identity, and process transactions. This includes:

• Full legal name as it appears on your government-issued identity document
• Date of birth (used for age verification — ac366 is an 18+ platform)
• Residential address, including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or other)
• Mobile phone number (used for account authentication and support communications)
• Email address (used for account notifications and support correspondence)
• Payment method details — bKash number, Nagad number, Rocket number, Upay number, or bank account reference (BRAC Bank, Dutch-Bangla Bank, City Bank, Islami Bank, Sonali Bank, etc.)
• Username and password (password is stored in hashed form — never in plain text)
• Any information you voluntarily submit when contacting ac366 support at [email protected]

1.2 Identity Verification (KYC) Documents

As part of the Know Your Customer (KYC) process, ac366 may request copies of identity documents to verify your age, name, and address. Documents that may be requested include:

• National Identity Card (NID) issued by the Bangladesh Election Commission
• Valid Bangladeshi Passport
• Driving Licence issued by the Bangladesh Road Transport Authority
• A recent utility bill or bank statement as proof of address (issued within 90 days)
• A photograph or screenshot confirming ownership of the payment method used for deposits

KYC documents are stored securely and accessed only by authorised ac366 personnel for the purposes of identity verification and fraud prevention.

1.3 Transaction and Betting Data

ac366 records a full history of your platform activity, including all deposits, withdrawals, bet placements, game sessions, bonus claims, and account setting changes. This data is linked to your account and retained as described in Section 7 of this policy.

1.4 Information Collected Automatically

When you access ac366.app, our systems automatically collect certain technical data about your device and session. This includes your IP address, device type, operating system, browser type and version, referring URL, pages visited on ac366.app, session duration, and approximate geographic location derived from IP. This data is used to maintain platform security, prevent fraud, improve user experience, and comply with responsible gaming obligations.

3.1 Payment Processors

To process your deposits and withdrawals, ac366 shares the minimum necessary payment data with our payment partners — bKash, Nagad, Rocket, and Upay for mobile financial services, and partnered Bangladeshi banks (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank) for bank transfers. Each payment partner operates under its own privacy and data security framework. ac366 does not store full payment credentials on its own servers.

3.2 Game Technology Providers

ac366 integrates live game feeds and RNG casino content from third-party providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. When you play a game powered by one of these providers, your player session data (session ID, stake amounts, game outcomes) may be transmitted to that provider's servers to facilitate the game. These providers are bound by data processing agreements with ac366 and are not permitted to use your data for their own independent commercial purposes.

3.3 Identity Verification Partners

ac366 may use third-party KYC and identity verification service providers to assist with document review and age verification checks. Where this occurs, your identity document images and personal details are shared with the verification partner for the sole purpose of completing the verification check. Verification partners are contractually required to delete your data once the verification process is concluded.

3.4 Analytics and Security Providers

ac366 uses technical analytics and cybersecurity tools to monitor platform performance, detect fraud, and prevent DDoS attacks and automated bot activity. These tools may process IP addresses and session data. All such providers are engaged under data processing agreements that restrict the use of data to the specific service function contracted.

3.5 Legal Disclosure

ac366 may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so. ac366 will not disclose data beyond what is strictly required by the applicable legal obligation and will notify affected players where legally permitted to do so.

5.1 Encryption in Transit and at Rest

All data transmitted between your device and ac366.app is encrypted using TLS 1.2 or higher (256-bit SSL). Player passwords are stored using one-way cryptographic hashing and are never stored in a recoverable plain-text form. Sensitive data fields within the ac366 database — including payment method references and KYC document metadata — are encrypted at rest using industry-standard encryption protocols.

5.2 Access Controls

Access to player personal data within ac366's internal systems is restricted on a strict need-to-know basis. Only authorised ac366 personnel with a specific operational or compliance role that requires access to personal data are granted that access. All internal data access is logged and subject to periodic review. ac366 support staff are trained on data protection obligations and are prohibited from accessing player data for purposes outside their defined role.

5.3 Infrastructure Security

ac366.app is hosted on secure infrastructure with firewalls, intrusion detection systems, and DDoS mitigation controls in place. Regular vulnerability assessments are conducted to identify and remediate potential security weaknesses in the platform. ac366 employs automated monitoring to detect unusual access patterns that may indicate a security incident.

5.4 Data Breach Response

In the event of a personal data breach that poses a risk to affected players, ac366 will notify impacted players without undue delay via the email address registered to their account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps ac366 has taken to address the breach and mitigate its impact. Players are advised to keep their registered email address up to date to ensure they receive any such notifications.

5.5 Data Location

ac366 player data is stored on servers that support the delivery of ac366.app to the Bangladesh market. ac366 takes reasonable steps to ensure that data storage arrangements provide a level of protection consistent with the principles set out in this Privacy Policy, regardless of where servers are physically located.

7.1 Active Account Data

While your ac366 account is active, all personal data associated with it — including identity information, contact details, transaction history, and betting records — is retained in full. This data is necessary to provide you with continuous platform access, process transactions, and comply with responsible gaming monitoring obligations.

7.2 Post-Closure Retention

Following voluntary account closure or ac366-initiated account termination, ac366 retains certain categories of personal data for a defined period beyond the closure date:

• Transaction and financial records: Retained for a minimum of 5 years from the date of the last transaction, consistent with standard financial record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of account closure.
• Responsible gaming records: Self-exclusion records are retained indefinitely to prevent re-registration during an active exclusion period.
• Support communications: Retained for a minimum of 2 years from the date of the last communication.
• Betting and game session records: Retained for a minimum of 3 years from the date of account closure.

7.3 Anonymisation

Where ac366 no longer has a lawful basis to retain personal data in identifiable form, but the data has analytical or operational value in aggregate, ac366 may anonymise the data (removing all identifiers that could link the data back to an individual) and retain the anonymised dataset indefinitely for platform improvement purposes. Anonymised data is not personal data and falls outside the scope of this Privacy Policy.