aca67 Privacy Policy

1. Introduction

aca67 ("we", "us", "our") operates the online betting and casino platform accessible at aca67.io. We are committed to protecting the privacy and personal data of every individual who interacts with our Platform. This Privacy Policy describes in detail the categories of personal data we process, the lawful bases on which we process them, the parties with whom we may share data, and the rights available to you as a data subject.

This Privacy Policy should be read alongside the aca67 Terms & Conditions, which govern the overall relationship between you and aca67. Where the Terms and Conditions and this Privacy Policy address the same matter, the Privacy Policy prevails with respect to all data-protection questions.

By registering an account on aca67 or by continuing to use the Platform after this policy is published, you acknowledge that you have read and understood how your personal data is used as described here. If you do not agree with any aspect of this policy, you should not use the Platform and should contact us to close your account.

2. Data Controller

For the purposes of applicable data protection law, aca67 is the data controller responsible for the personal data collected and processed through the Platform. All enquiries relating to your personal data, data subject rights requests, or privacy-related complaints should be addressed to our dedicated Privacy team at [email protected] with the subject line "Privacy Enquiry".

We aim to respond to all privacy-related enquiries within five (5) business days. Complex requests — such as full data-subject access requests — may take up to 30 calendar days to fulfil, during which time we will keep you informed of progress.

3. Data We Collect

aca67 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

We do not collect sensitive categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information) except where strictly required by law for identity-verification purposes, in which case such data is handled with the highest level of protection and is not used for any other purpose.

4. How We Collect Your Data

aca67 collects personal data through the following channels:

• Direct interactions: Data you provide when you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automated technologies: Technical and usage data collected automatically each time you visit or interact with the Platform, including data gathered via cookies, web beacons, server logs, and similar tracking technologies. See Section 7 for full details on cookies.
• Third-party identity verification providers: Where we instruct a specialist KYC (Know Your Customer) or AML (Anti-Money Laundering) service to verify your identity documents, that provider may share verification results and flagged risk indicators with us.
• Payment processors: bKash, Nagad, Rocket, Upay, and our card processing partners share transaction confirmation data with aca67 solely to enable deposit crediting and withdrawal processing.
• Fraud and security intelligence partners: We may receive flagged risk signals from third-party fraud-prevention services to protect the Platform and its players from fraudulent activity.

5. Purpose & Legal Basis for Processing

aca67 processes your personal data only where a lawful basis exists. The table below sets out our primary processing activities and the basis on which each is carried out:

Where processing is based on your consent (for example, receiving promotional emails or SMS notifications), you may withdraw that consent at any time by contacting [email protected] or by updating your communication preferences within your account dashboard. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

aca67 does not sell, rent, or trade your personal data to any third party. We share personal data only in the following strictly controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, Upay, and our Visa/Mastercard acquiring bank receive the minimum financial data necessary to process your transactions. All payment partners are contractually bound to use your data solely for payment processing.
• Identity verification providers: Specialist KYC and AML service providers receive identity documents and relevant personal data to perform regulatory verification checks. These providers are not permitted to use your data for their own purposes.
• Fraud prevention partners: Anonymised or pseudonymised risk signals may be shared with fraud-intelligence networks to protect the Platform. Full personal data is only shared where a specific fraud investigation requires it.
• Technology and hosting providers: aca67 uses trusted cloud-infrastructure and software service providers to operate the Platform. These providers act as data processors under written agreements that restrict their use of your data to providing services to aca67.
• Game providers: Casino and live dealer games supplied by Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi may receive a pseudonymous player identifier and session token to facilitate game play. Full personal data is not shared with game providers.
• Legal and regulatory authorities: aca67 will disclose personal data to law enforcement, regulatory bodies, or legal advisers where required to do so by applicable law, court order, or where we believe in good faith that disclosure is necessary to protect our rights, the safety of players, or to prevent or detect crime.
• Business transfers: In the event of a merger, acquisition, or asset sale involving aca67, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. Affected players will be notified in advance.

7. Cookies & Tracking Technologies

aca67 uses cookies and similar technologies to operate the Platform, remember your preferences, detect fraud, and analyse Platform performance. The following types of cookies may be set when you visit aca67.io:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, load-balancing cookies, and security cookies. These cannot be disabled without severely affecting your ability to use the Platform.
• Functional cookies: Remember your preferences such as preferred language, time-zone display, and previously set responsible-gambling limits. Disabling these cookies may affect certain platform features.
• Analytics cookies: Collect anonymised data about how players navigate the Platform — pages visited, time spent, error pages encountered — to help aca67 improve the user experience. These cookies do not identify you personally.
• Fraud and security cookies: Detect suspicious login patterns, multiple-account activity, and bot behaviour. These cookies are essential for the integrity and security of the Platform.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect your experience on the Platform. aca67 does not use third-party advertising cookies or behavioural-targeting cookies that share your data with advertising networks.

8. Data Security

aca67 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our key security controls include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the aca67 Platform is encrypted using industry-standard 256-bit SSL/TLS protocols. Look for the padlock icon in your browser's address bar when visiting aca67.io.
• Encryption at rest: Sensitive personal data stored on our servers — including identity documents, payment references, and account credentials — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within aca67 is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of data access required to perform their specific role. All access is logged and audited.
• Two-factor authentication: aca67 supports and encourages the use of two-factor authentication (2FA) on all player accounts to provide an additional layer of login security.
• Penetration testing: The Platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: aca67 maintains a documented data-breach response procedure. In the event of a confirmed breach that poses a risk to your rights and freedoms, we will notify affected players within 72 hours of becoming aware of the incident.

While aca67 takes all reasonable steps to protect your data, no electronic transmission over the internet is completely secure. You are responsible for keeping your account login credentials confidential and for ensuring that no unauthorised person has access to your device or aca67 session.

9. Data Retention

aca67 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal obligations. The following retention periods apply:

• Account data: Retained for the duration of your active account and for a period of five (5) years following account closure, to comply with AML and financial record-keeping obligations.
• Identity verification documents: Retained for five (5) years from the date of verification, as required under applicable AML regulations.
• Transaction records: All deposit, withdrawal, and betting transaction records are retained for seven (7) years from the date of the transaction.
• Customer support communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the interaction.
• Responsible gambling records: Records of self-exclusion elections, deposit limits, and cooling-off periods are retained for five (5) years to ensure compliance with responsible-gaming obligations and to prevent re-registration during an active exclusion period.
• Marketing consent records: Records of consent given or withdrawn are retained for as long as necessary to demonstrate compliance, and for a minimum of three (3) years after the relevant consent decision.

After the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Anonymised, aggregated data (which cannot identify any individual) may be retained indefinitely for statistical and analytical purposes.

10. Your Data Rights

As a data subject, you hold the following rights in relation to your personal data held by aca67. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: You may request a copy of all personal data aca67 holds about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of receiving your verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (such as a misspelled name) can often be made directly from within your account profile.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal obligation to retain certain data for AML and financial compliance purposes.
• Right to restrict processing: You may request that we limit the way in which we use your data while a dispute about its accuracy or the legitimacy of processing is being investigated.
• Right to data portability: Where processing is based on your consent or on a contract, you may request that we provide your data in a portable format suitable for transfer to another service provider.
• Right to object: You may object to processing carried out on the basis of legitimate interest, including direct marketing. Where you object to direct marketing, we will cease such processing immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11. Children & Minors

The aca67 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. If we become aware that an account has been registered by or on behalf of a minor, we will immediately suspend the account, void any associated transactions, and securely delete all related personal data.

If you are a parent or guardian and have reason to believe that a person under 21 in your care has registered an account with aca67, please contact us immediately at [email protected]. We will investigate the matter promptly, with full discretion and sensitivity.

12. Third-Party Links

The aca67 Platform may occasionally reference or display the names of third-party service providers, game studios (such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi), or payment partners (such as bKash, Nagad, Rocket, and Upay). These references do not constitute clickable links to external websites.

aca67 has no responsibility for, or control over, the privacy practices or content of any external third-party websites. If you access any external website independently, we encourage you to read that website's own privacy policy before providing any personal data.

13. Policy Updates

aca67 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or the services we offer. When a material change is made, we will notify registered players by posting a prominent notice on the Platform and, where appropriate, by sending a notification to the email address registered on your account.

The effective date at the top of this Privacy Policy will always reflect the date of the most recent revision. Your continued use of the Platform after the revised policy takes effect constitutes your acknowledgment of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or about the way aca67 handles your personal data, please contact our Privacy team using the details below. All communication is handled in English and responses are provided within five (5) business days.

• Privacy enquiries email: [email protected] (subject line: "Privacy Enquiry")
• Data rights requests email: [email protected] (subject line: "Data Rights Request")
• Support hours: 24/7 — Bangladesh Standard Time (UTC+6)
• Response time: Standard enquiries within 2 hours; data rights requests within 30 calendar days