ace97 Privacy
Policy

This Privacy Policy ("Policy") sets out how ace97 ("ace97", "we", "us", "our") collects, processes, stores, shares, and protects personal data obtained through the online gaming platform accessible at https://ace97.io and all associated subdomains, mobile interfaces, and applications (collectively the "Platform").

This Policy applies to all individuals who register an account, visit the Platform as a guest, contact our customer support team, or otherwise interact with any ace97 service. It should be read alongside the ace97 Terms & Conditions, which govern the overall contractual relationship between you and ace97.

ace97 is the data controller for all personal data processed under this Policy. Our primary point of contact for all data privacy matters is our customer support team, reachable at [email protected]. We endeavour to respond to all data-related enquiries within 5 business days.

This Policy is written in English and is intended for players located in Bangladesh. All references to payment amounts use Bangladeshi Taka (BDT), and all communications between ace97 and players are conducted in English.

ace97 collects personal data in several ways: data you provide directly during registration and account use, data generated automatically during your use of the Platform, and data obtained from third-party verification and payment partners. The categories of data we collect include:

Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, National ID (NID) number, passport number	Registration form, KYC verification
Contact Data	Email address, mobile phone number, residential address	Registration form, account settings
Financial Data	bKash/Nagad/Rocket/Upay account references, bank account details, transaction history	Cashier/deposit flow, payment processors
Gameplay Data	Bets placed, game sessions, win/loss records, bonus usage, wagering activity	Platform activity logs
Technical Data	IP address, device type, browser type, operating system, session timestamps	Automatic collection via cookies and server logs
Communications Data	Support ticket content, live chat transcripts, email correspondence	Customer support interactions
Verification Documents	Scanned copies of NID, passport, utility bills, bank statements	KYC/AML verification requests

ace97 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information. If any such data is inadvertently included in documents submitted for verification purposes, it will not be used for any purpose other than confirming the authenticity of the submitted document.

ace97 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to provide the services you have registered for, including account management, game access, and payment processing.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and fraud prevention obligations.
• Legitimate interests: Processing necessary for ace97's legitimate business interests, including platform security, fraud detection, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where you have given explicit consent for a specific processing activity, such as receiving marketing communications or promotional offers from ace97. You may withdraw your consent at any time by contacting [email protected] or updating your account communication preferences.

ace97 uses the personal data collected for the following purposes:

• Account creation and management: To register your account, verify your identity and age (21+ requirement), manage your login credentials, and maintain accurate account records.
• Payment processing: To facilitate deposits and withdrawals in BDT via your chosen payment method (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, Mastercard), and to maintain transaction records as required by financial regulations.
• Service delivery: To provide access to casino games, live dealer tables, sports betting markets (including cricket BPL, T20, IPL, and football), and all other ace97 platform features.
• Responsible gaming: To monitor gameplay patterns for indicators of problem gambling behaviour, to administer player-requested deposit limits, self-exclusion requests, and cooling-off periods, and to fulfil our duty of care obligations.
• Fraud and security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited behaviours on the Platform.
• Legal compliance: To fulfil KYC and AML obligations, respond to lawful requests from regulatory or law enforcement authorities, and maintain records as required by applicable law.
• Marketing communications: To send you personalised promotions, bonus offers, and platform news where you have opted in to receive such communications. You may opt out at any time.
• Platform improvement: To analyse usage patterns, conduct A/B testing, resolve technical issues, and enhance the overall user experience on the ace97 platform.

ace97 does not use automated decision-making processes that produce significant legal effects on your account without human oversight. Any account restriction or closure decision that materially affects your ability to access the Platform involves review by a member of our operations team.

ace97 does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared with external parties only in the following circumstances and with appropriate data-sharing agreements in place:

• Game providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) receive limited session and account data necessary to deliver their games securely and to comply with their own fair-play and compliance obligations.
• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and card networks (Visa, Mastercard) receive the payment details necessary to process your deposit and withdrawal transactions.
• Identity verification providers: KYC and AML compliance partners receive the identity and address documents you submit during the verification process to carry out automated and manual verification checks.
• Fraud prevention services: Specialist security providers may receive technical data (such as IP addresses, device fingerprints, and behavioural patterns) to identify and block fraudulent activity on the Platform.
• Legal and regulatory authorities: ace97 may disclose personal data to relevant authorities where required by law, court order, or regulatory demand. ace97 will notify affected players of such disclosures where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the ace97 business, personal data held by ace97 may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained. Players will be notified of any such transfer in advance where possible.

All third parties with whom ace97 shares personal data are contractually required to process that data only for the specified purposes, to maintain appropriate security standards, and to comply with all applicable data protection requirements.

ace97 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, in accordance with AML and KYC regulatory requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, as required by applicable financial regulations.
• Gameplay and betting records: Retained for a minimum of 3 years from the date of the activity, to support dispute resolution and regulatory compliance.
• Customer support communications: Retained for a minimum of 2 years from the date of the final communication in a given thread.
• Marketing consent records: Retained until consent is withdrawn or the account is permanently closed, and for a further 1 year thereafter as proof of compliance.
• Technical and session logs: Retained for a maximum of 12 months from the date of generation, unless required for an ongoing investigation or legal proceeding.

When personal data is no longer required for any lawful purpose, it is securely deleted or anonymised in accordance with ace97's internal data destruction procedures. Anonymised aggregate data that cannot be used to identify any individual may be retained indefinitely for statistical and analytical purposes.

ace97 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 128-bit SSL (Secure Socket Layer) encryption applied to all data transmitted between your device and the ace97 Platform.
• Industry-standard password hashing algorithms for the secure storage of account credentials. Plaintext passwords are never stored by ace97.
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access personal data systems.
• Regular independent security audits and penetration testing of the Platform infrastructure.
• Intrusion detection systems and real-time monitoring for anomalous access patterns or data exfiltration attempts.
• Secure, encrypted backup procedures for all personal data stores.

While ace97 employs all reasonable security measures, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the security of your own login credentials and for notifying ace97 immediately if you suspect unauthorised access to your account. Contact our support team at [email protected] to report any security concerns.

In the event of a personal data breach that poses a risk to your rights and freedoms, ace97 will notify affected individuals without undue delay and will take all necessary steps to contain the breach and prevent recurrence.

ace97 uses cookies, web beacons, pixel tags, and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session management cookies, authentication tokens, and security cookies. These cookies cannot be disabled without impairing core Platform functionality.
• Functional cookies: Used to remember your preferences, such as your preferred language, display settings, and saved payment methods. Disabling these cookies may affect your user experience but will not prevent access to the Platform.
• Analytics cookies: Used to collect aggregate, anonymised data on how users interact with the Platform, including pages visited, session duration, and navigation paths. This data helps ace97 identify areas for improvement. Analytics data is never used to identify individual users.
• Marketing cookies: Where you have consented to marketing communications, these cookies help ace97 deliver personalised promotional content relevant to your gaming interests and activity on the Platform.

You can manage your cookie preferences through your browser settings at any time. Most modern browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies will affect your ability to log in and use core Platform features. ace97 does not use third-party advertising networks for the purpose of serving behavioural advertising to users outside the ace97 Platform.

ace97 operates a strict 21+ policy. The Platform is not intended for and must not be used by any person under the age of 21. ace97 does not knowingly collect personal data from individuals under this age. If ace97 becomes aware that personal data has been collected from a person under 21, such data will be deleted immediately and the associated account will be permanently closed.

Parents and guardians are encouraged to make use of parental control software to prevent minors from accessing online gaming platforms. If you believe a minor has registered an ace97 account, please contact our support team at [email protected] immediately so that the matter can be investigated and resolved without delay.

To exercise any of the data rights described in this Policy — including the right to access, rectify, erase, restrict, port, or object to the processing of your personal data — please submit a written request to our support team at [email protected]. Please include your full name, registered email address, and a clear description of the right you wish to exercise.

ace97 will respond to all verified data rights requests within 30 calendar days of receipt. In cases of particular complexity or where multiple requests are received simultaneously, this period may be extended by a further 60 days. ace97 will notify you of any such extension within the initial 30-day period and will provide a reason for the delay.

ace97 will not charge a fee for processing data rights requests unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may be applied. ace97 reserves the right to request additional identifying information before acting on a data rights request in order to verify the identity of the requester and protect against fraudulent access to third-party data.

The ace97 Platform primarily stores and processes personal data within servers located in data centres that maintain ISO 27001 or equivalent security certifications. In some circumstances, personal data may be accessed by or transferred to third-party service providers located outside Bangladesh — for example, where a game provider or fraud prevention partner operates servers in a different country.

Where such international transfers occur, ace97 ensures that appropriate safeguards are in place to protect the security and confidentiality of your personal data, including contractual data transfer agreements that impose equivalent privacy and security obligations on the recipient party. ace97 will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate protective measures.

ace97 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. Where a material change is made to this Policy, ace97 will provide reasonable advance notice by posting a prominent notice on the Platform or by sending an email to your registered address.

The date at the top of this Policy indicates when it was last reviewed. Your continued use of the ace97 Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with any changes, you should discontinue use of the Platform and may request account closure in accordance with the ace97 Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or ace97's data protection practices, please contact our support team at [email protected]. We are available 24 hours a day, 7 days a week, and will respond to all formal privacy enquiries within 5 business days.