d8ads Privacy Policy

This Privacy Policy ("Policy") describes how d8ads collects, uses, stores, shares, and protects the personal data of individuals who access or use the d8ads online betting and casino platform available at https://d8ads.io (the "Platform"). The Platform is operated by d8ads and is directed at users in Bangladesh.

This Policy applies to all personal data processed in connection with your use of the Platform, including data collected through account registration, identity verification, gameplay, financial transactions, customer support interactions, and your use of the d8ads website and any associated mobile-optimised interfaces.

This Policy should be read alongside the d8ads Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and any other document, this Policy shall govern with respect to the processing of personal data.

This Policy is written in English and is the authoritative version. Any translation provided for convenience is non-binding.

For the purposes of this Policy, d8ads is the data controller — the entity that determines the purposes and means by which personal data collected through the Platform is processed.

If you have any questions about how d8ads processes your personal data, or if you wish to exercise any of your data-subject rights described in Section 10 of this Policy, you may contact the d8ads data protection team using the details in Section 14.

d8ads collects personal data in the following ways: (a) data you provide directly, (b) data generated automatically through your use of the Platform, and (c) data received from third-party service providers. The specific categories are as follows:

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile number, residential address (street, district, division, postal code), and username and password of your choosing.
• Identity verification (KYC) data: Copies of government-issued photo identification (National ID card, passport, or driving licence), proof of address documents, and — where required — a selfie photograph for liveness verification.
• Financial data: Payment method identifiers such as your bKash or Nagad registered mobile number, bank account reference (for Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank transfers), deposit amounts, and withdrawal requests. Full payment account numbers and PINs are never collected or stored by d8ads.
• Support communications: Content of messages, emails, or live-chat transcripts exchanged between you and the d8ads support team.
• Responsible gaming preferences: Deposit limits, loss limits, cool-off period instructions, and self-exclusion requests submitted through your account settings or via the support team.

3.2 Data Generated Automatically

• Technical data: IP address, device fingerprint, operating system, browser type and version, screen resolution, and time-zone setting.
• Usage data: Pages visited on the Platform, click-path and navigation data, search queries within the Platform, session start and end times, and features accessed.
• Gaming activity data: Bet placement records, game titles played, wager amounts, outcomes, bonus claims, wagering progress, and session duration per game.
• Cookies and similar tracking technologies: See Section 6 for full details of cookies used on the Platform.

3.3 Data Received from Third Parties

• Payment verification data: Transaction status and reference codes returned by payment processing partners (bKash, Nagad, Rocket, Upay, and banking partners) to confirm deposit and withdrawal completion.
• Game provider data: Round outcomes, RTP logs, and session data returned by licensed third-party game providers (Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi) for the purposes of dispute resolution and audit.
• Fraud and risk data: Signals from third-party fraud detection and device intelligence services used to identify suspicious account activity.

d8ads uses personal data for the following purposes:

d8ads will not use your personal data for any purpose that is materially different from those listed above without first providing notice and, where required, obtaining your consent.

d8ads processes personal data on the following legal bases:

• Contract performance: Processing is necessary to perform the contract between d8ads and you — that is, to operate your account, process your transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing is necessary to comply with applicable legal requirements, including age verification, KYC, anti-money-laundering obligations, and responsible gaming mandates.
• Legitimate interests: Processing is necessary for d8ads's legitimate interests, including platform security, fraud detection, abuse prevention, and analytics — where those interests are not overridden by your privacy rights. d8ads has conducted a legitimate-interest assessment for each processing activity relying on this basis.
• Consent: Where d8ads relies on your consent — for example, to send you promotional communications or to place non-essential cookies on your device — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

d8ads uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a web server. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Remember your preferences such as language settings, remembered username, and responsible gaming reminder settings. Stored for the duration of your session or up to 30 days where "remember me" is selected.
• Analytics cookies: Used to understand how users navigate the Platform, which pages attract the most traffic, and where technical errors occur. Analytics data is aggregated and not used to identify individual users. You may opt out of analytics cookies.
• Marketing cookies (consent-based only): Used to deliver relevant promotional content to users who have opted in to marketing communications. These cookies are only placed with your explicit consent and may be withdrawn at any time.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. d8ads does not use tracking pixels or third-party advertising networks that track your activity across other websites.

d8ads does not sell your personal data to third parties. d8ads shares personal data only in the following limited circumstances:

• Payment processors: Transaction data is shared with payment providers (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank) solely to process your deposit and withdrawal requests. Each payment partner is bound by its own data protection obligations.
• Game providers: Session and wager data is exchanged with licensed game providers (Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi) to deliver games and resolve disputes. Game providers receive only the data necessary for game delivery and audit.
• KYC and fraud-prevention services: Identity documents and device signals may be shared with third-party verification and fraud-detection vendors for the purpose of identity confirmation and risk assessment. All such vendors are contractually bound to process data only on d8ads's instructions.
• Legal and regulatory authorities: d8ads may disclose personal data to law-enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or where d8ads believes disclosure is necessary to prevent fraud, money laundering, or harm to persons.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of d8ads's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and of any material change to this Policy that results from it.

All third-party processors engaged by d8ads are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with d8ads's documented instructions.

d8ads retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account plus a minimum of five years after account closure, to meet anti-money-laundering and financial record-keeping obligations.
• Transaction and financial data: Retained for a minimum of five years from the date of each transaction in accordance with financial record-keeping requirements.
• Gaming activity logs: Retained for three years from the date of the relevant session, for dispute resolution and audit purposes.
• Support communications: Retained for two years from the date of the last interaction, unless the communication relates to an ongoing dispute or legal matter.
• Responsible gaming records: Self-exclusion and restriction records are retained for a minimum of five years after the restriction is lifted, to prevent circumvention of exclusion periods.
• Marketing consent records: Retained for three years from the date consent was given or withdrawn, as evidence of consent status.
• Technical and device data: Retained for 12 months from collection, after which it is aggregated or deleted.

When personal data is no longer required for any retention purpose, d8ads will securely delete or anonymise it in accordance with its internal data disposal procedures.

d8ads implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser or device and the d8ads Platform is encrypted using Transport Layer Security (TLS) protocol. The Platform enforces HTTPS on all pages.
• Encryption at rest: Sensitive personal data stored in d8ads databases — including identity documents and financial identifiers — is encrypted at rest using industry-standard symmetric encryption algorithms.
• Access controls: Access to personal data by d8ads personnel is restricted on a strict need-to-know basis, enforced through role-based access controls. All access events are logged and subject to periodic review.
• Password security: User account passwords are stored using one-way cryptographic hashing with an appropriate salting algorithm. d8ads staff cannot view your plaintext password at any time.
• Two-factor authentication: d8ads offers two-factor authentication (2FA) for user accounts. We strongly recommend enabling 2FA to add an additional layer of protection to your account.
• Penetration testing and vulnerability management: The Platform undergoes regular security assessments and vulnerability scanning. Identified vulnerabilities are remediated according to a risk-prioritised schedule.
• Incident response: d8ads maintains a documented data-breach response procedure. In the event of a personal data breach that poses a risk to your rights, d8ads will notify affected users promptly and take immediate remedial action.

While d8ads takes all reasonable steps to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for using a strong, unique password. If you suspect unauthorised access to your account, contact [email protected] immediately.

As a d8ads user, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your d8ads account. d8ads will respond to all verified data-subject requests within 30 calendar days. In cases of complexity or high volume, this period may be extended by a further 30 days, in which case d8ads will notify you of the extension and the reason for it.

• Right of access (Subject Access Request): You may request a copy of all personal data d8ads holds about you, along with information about the purposes of processing, the categories of data held, retention periods, and any third parties with whom the data has been shared.
• Right to rectification: You may request correction of inaccurate personal data or completion of incomplete data. Many standard details (email address, phone number, address) can be updated directly in your account settings without contacting support.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where (a) it is no longer necessary for the purpose for which it was collected, (b) you withdraw consent and there is no other legal basis for processing, (c) you object to processing and there are no overriding legitimate grounds, or (d) the data has been processed unlawfully. Note that d8ads may be required to retain certain data for legal compliance purposes even following an erasure request; in such cases, d8ads will explain which data must be retained and why.
• Right to restriction of processing: You may request that d8ads restrict processing of your data in specific circumstances, such as where you contest the accuracy of the data, where processing is unlawful but you prefer restriction to erasure, or where d8ads no longer needs the data but you require it for legal claims.
• Right to data portability: You may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) where the processing is based on consent or contract and is carried out by automated means.
• Right to object to processing: You may object at any time to processing of your personal data for direct marketing purposes, including profiling related to direct marketing. Upon receipt of a valid objection to marketing, d8ads will cease all marketing communications immediately. You may also object to processing based on legitimate interests, in which case d8ads will assess whether its interests override your rights.
• Rights related to automated decision-making: Where d8ads makes a decision about you solely by automated means that produces legal or similarly significant effects — for example, an automated account suspension — you have the right to request human review of that decision, to express your point of view, and to contest the outcome.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

d8ads will not charge a fee for handling a data-subject request unless the request is manifestly unfounded, repetitive, or excessive, in which case a reasonable administrative fee may be levied or the request refused, with written reasons provided.

The d8ads Platform is strictly for adults aged 21 years and above. d8ads does not knowingly collect personal data from individuals under the age of 21. All account registrations are subject to age verification as part of the KYC process.

If d8ads discovers that personal data has been collected from a user who is under 21 years of age, d8ads will immediately suspend the relevant account, void any associated transactions, and securely delete the personal data of that individual without delay.

If you are a parent or guardian and believe that a minor has registered a d8ads account, please contact [email protected] immediately with the relevant account details so that corrective action can be taken promptly.

The d8ads Platform may display the names and logos of third-party service providers such as game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and payment partners (bKash, Nagad, Rocket, Upay) for informational and identification purposes. These references do not constitute endorsement of the third party's privacy practices.

d8ads is not responsible for the privacy practices or content of any third-party websites or services. If you access a third-party service through the Platform, you do so at your own risk and your interaction with that service is governed by the third party's own privacy policy. d8ads encourages you to review the privacy policies of any third-party services you use.

d8ads reserves the right to update or amend this Privacy Policy at any time. When material changes are made, d8ads will notify registered users by email to the address on file and will update the "Last Updated" date and version number at the top of this page. The updated Policy will take effect 14 days after notification is sent, unless the change is required by law, in which case it will take effect immediately.

Your continued use of the Platform after the effective date of an updated Policy constitutes your acknowledgement of the changes. If you do not accept the updated Policy, you must close your account and cease using the Platform before the effective date.

d8ads recommends that you review this Privacy Policy periodically to stay informed of how your personal data is being protected. All previous versions of this Policy are available on request by contacting [email protected].

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by d8ads, please contact the d8ads data protection team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: 24/7 live chat available on the Platform
• Support hours: 24/7, Bangladesh Standard Time (BST, UTC+6)

When submitting a data-subject request or privacy complaint, please include your registered email address and a clear description of your request or concern. d8ads may need to verify your identity before processing the request to ensure that personal data is not disclosed to an unauthorised party.

d8ads takes all privacy complaints seriously and will acknowledge receipt of your complaint within two business days and provide a substantive response within 30 calendar days. If you are not satisfied with d8ads's response to your complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction.