Privacy Policy — nagad7 Data Protection & User Privacy

1 Introduction

This Privacy Policy (the "Policy") describes the manner in which nagad7 (the "Platform", "we", "us", or "our") collects, processes, stores, shares, and protects personal data provided by or generated by users (the "User", "Player", or "you") who access or interact with the nagad7 online casino and sports betting platform available at nagad7.app.

nagad7 is committed to protecting the privacy of every player across Bangladesh. We recognise that the personal data you share with us is sensitive and that maintaining your trust depends on responsible, transparent data stewardship. This Policy is designed to give you a clear and complete understanding of our data practices so that you can make informed decisions about your use of the nagad7 platform.

By registering an account, accessing the nagad7 platform, or otherwise providing personal information to nagad7, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. This Policy forms part of and should be read in conjunction with the nagad7 Terms & Conditions.

2 Data Controller

For the purposes of this Privacy Policy, nagad7 acts as the data controller in respect of all personal data collected from users of the nagad7 platform. As data controller, nagad7 determines the purposes for which and the means by which personal data is processed. All data protection enquiries, subject access requests, and complaints should be directed to our support team using the contact details set out in Section 14 of this Policy.

3 Personal Data We Collect

nagad7 collects the following categories of personal data from users, either directly provided by the user or automatically generated through platform interaction:

3.1 Identity & Contact Data

• Full legal name as it appears on government-issued identification
• Date of birth (for age verification purposes)
• Mobile telephone number registered in Bangladesh
• Email address (if provided during registration or correspondence)
• Residential address in Bangladesh (requested during KYC verification)

3.2 Identity Verification (KYC) Documents

• National Identity Card (NID) number and document image
• Passport details (where provided as an alternative to NID)
• Driving licence (where accepted as supporting identification)
• Proof of address documentation (utility bills, bank statements)
• Selfie or live photograph for biometric identity confirmation (where required)

3.3 Financial & Transaction Data

• Mobile wallet identifiers for bKash, Nagad, Rocket, and Upay accounts registered to the user
• Bank account details (account number, bank name, branch) for bank transfer transactions
• Transaction history including deposit amounts, withdrawal amounts, and timestamps
• Wagering history (game type, stake amounts, outcomes, session duration)

3.4 Technical & Usage Data

• IP address at the time of account registration and each subsequent login session
• Device type, operating system, browser type, and version
• Session timestamps and session duration records
• Pages visited, game titles accessed, and navigation patterns within the platform
• Geolocation data (country and city level, derived from IP address)

3.5 Communications Data

• Records of support chat conversations, email correspondence, and any complaints submitted to nagad 7 support channels
• Feedback and survey responses submitted voluntarily by the user
• Promotional opt-in preferences and marketing communication consent records

4 How We Collect Personal Data

nagad7 collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, submitting a support request, or responding to a promotional survey.
• Automated platform systems: Technical and usage data generated automatically when you access the nagad7 platform, including IP address logging, session tracking, and device fingerprinting for fraud prevention purposes.
• Payment processors: Transaction confirmation data received from mobile wallet providers (bKash, Nagad, Rocket, Upay) and banking partners following a deposit or withdrawal event.
• Third-party KYC partners: Identity verification data received from certified KYC service providers engaged by nagad7 to validate the authenticity of identity documents submitted during the verification process.
• Cookies and tracking technologies: Session cookies, persistent cookies, and similar technologies as described in Section 10 of this Policy.

5 Purposes of Processing Personal Data

nagad7 processes your personal data only for specific, legitimate, and documented purposes. The table below summarises the primary purposes for which your data is used:

nagad7 does not use your personal data for automated decision-making that produces significant legal effects without human review. Fraud risk scoring and responsible gaming alerts generated by automated systems are reviewed by trained compliance staff before any account action is taken.

6 Legal Basis for Processing

nagad7 processes personal data on one or more of the following legal grounds:

• Contractual necessity: Processing required to fulfil the account agreement between nagad7 and the user — including account creation, transaction processing, and game access.
• Legal obligation: Processing necessary to comply with applicable anti-money-laundering (AML) requirements, age verification obligations, and any other legal obligations imposed on nagad7 as an online gaming operator serving the Bangladesh market.
• Legitimate interests: Processing carried out in pursuit of nagad7's legitimate business interests, including fraud prevention, platform security, and the improvement of user experience, where such interests are not overridden by the user's fundamental rights and freedoms.
• Consent: Processing based on your explicit, freely given consent — in particular, the sending of promotional communications and the use of non-essential cookies. Consent may be withdrawn at any time by contacting the support team or updating your account preferences without affecting the lawfulness of processing carried out prior to withdrawal.

7 Data Sharing & Third Parties

nagad7 does not sell, rent, or trade your personal data to third-party marketing organisations under any circumstances. Your data may be shared with the following categories of carefully selected third parties, solely to the extent necessary for the defined purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank receive transaction-specific data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are independently regulated.
• KYC and identity verification partners: Certified third-party verification services receive identity document data for the sole purpose of confirming document authenticity and identity match during the KYC process.
• Game studio and software providers: Studios including Evolution Gaming, Pragmatic Play, Spribe, Ezugi, NetEnt, and Microgaming may receive session tokens and anonymised player identifiers to authenticate game sessions. These providers do not receive personally identifiable information beyond what is technically necessary for session management.
• Fraud prevention and security services: Third-party fraud detection platforms may receive technical and behavioural data (IP address, device fingerprint, session patterns) to identify suspicious activity and protect the platform from exploitation.
• Legal and regulatory authorities: nagad7 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by a valid legal order, court order, or applicable regulatory requirement. nagad7 will, where legally permitted, notify the affected user of such disclosure.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by nagad7 may access relevant personal data on a strictly need-to-know basis under confidentiality obligations.

8 Data Retention

nagad7 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal retention obligations, whichever is the longer. The following general retention periods apply:

• Active account data: Retained for the full duration of the account relationship and for a period of five (5) years following permanent account closure, in accordance with standard AML record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction and wagering records: Retained for a minimum of five (5) years following the date of each transaction, in line with financial record-keeping obligations.
• Support communications: Retained for three (3) years from the date of the most recent correspondence, unless the communication relates to an unresolved dispute, in which case retention continues until the dispute is fully resolved.
• Technical and usage logs: Retained for up to twelve (12) months, after which they are anonymised or permanently deleted unless retained as part of an active fraud or security investigation.
• Marketing consent records: Retained for the duration of the consent and for one (1) year following withdrawal of consent as a demonstration of compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with nagad7's internal data disposal procedures.

9 Data Security

nagad7 implements a layered set of technical, organisational, and procedural security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, and unlawful disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and the nagad7 platform, ensuring that your personal and financial data cannot be intercepted during transmission.
• Encryption at rest applied to sensitive personal data and financial records stored on nagad7 servers.
• Access controls ensuring that personal data is accessible only to nagad7 personnel and authorised service providers who have a documented, legitimate need to access it, governed by role-based access permissions.
• Two-factor authentication (2FA) available to all users via SMS OTP, providing an additional layer of protection for account access beyond the password.
• Regular security assessments including vulnerability scanning and penetration testing conducted by qualified security professionals.
• Incident response procedures enabling nagad7 to detect, contain, and respond to data security incidents promptly, with a commitment to notifying affected users without undue delay in the event of a material data breach.

While nagad7 takes every reasonable precaution to safeguard your data, no digital platform can guarantee absolute security. You are responsible for keeping your account login credentials confidential and for notifying nagad7 immediately at [email protected] if you suspect any unauthorised access to your account.

10 Cookies & Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They enable the website to recognise your device across sessions, remember your preferences, and deliver a more consistent user experience. nagad7 uses both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a defined period).

10.2 Categories of Cookies Used by nagad7

• Strictly necessary cookies: Required for core platform functionality, including maintaining your authenticated session, processing transactions, and delivering the game lobby. These cookies cannot be disabled without preventing platform access.
• Performance and analytics cookies: Used to collect anonymised data about how users navigate the nagad7 platform, which pages are visited most frequently, and where technical errors occur. This data is used solely to improve platform performance and user experience.
• Functional cookies: Used to remember your stated preferences, such as display settings and language preference, to personalise your platform experience between sessions.
• Fraud prevention cookies: Used in conjunction with device fingerprinting technologies to identify and mitigate suspicious login patterns and fraudulent account activity.

10.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair or prevent your ability to use core nagad7 platform features. Instructions for managing cookies in all major browsers are available through your browser's help documentation.

11 Your Data Subject Rights

As a user of the nagad7 platform, you hold the following rights with respect to your personal data. Requests to exercise any of these rights should be submitted to [email protected]. nagad7 will respond to all valid requests within a reasonable timeframe, and in any event within 30 days of receipt:

• Right of access: You have the right to request a copy of the personal data that nagad7 holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request that nagad7 correct any inaccurate or incomplete personal data held about you without undue delay.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to nagad7's legal retention obligations (including AML record-keeping requirements, which may preclude immediate erasure).
• Right to restriction of processing: You may request that nagad7 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
• Right to object: You have the right to object to the processing of your personal data where that processing is based on nagad7's legitimate interests, unless nagad7 can demonstrate compelling legitimate grounds that override your interests.

12 Protection of Minors

The nagad7 platform is strictly intended for adults aged 18 and above. nagad7 does not knowingly collect, process, or retain personal data from any individual under the age of 18. Age verification is a mandatory step in the account registration process, and accounts suspected of being held by minors are subject to immediate suspension pending investigation.

If nagad7 becomes aware that personal data has been collected from a person under the age of 18 without appropriate parental or guardian consent, that data will be deleted as promptly as is operationally possible and the associated account will be permanently closed. Parents or guardians who believe that a minor in their care has registered an account on the nagad7 platform are urged to contact [email protected] immediately so that the matter can be addressed without delay.

13 Changes to This Privacy Policy

nagad7 reviews this Privacy Policy periodically and reserves the right to update or amend it at any time to reflect changes in applicable law, regulatory guidance, platform functionality, or data processing practices. When material changes are made to this Policy, nagad7 will notify registered users via the mobile number or email address on file, or by displaying a prominent notice on the platform upon next login. The updated Policy will take effect from the date of publication at nagad7.app/privacy-policy.

Your continued use of the nagad7 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to remain informed about how your personal data is being protected.

14 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or nagad7's data processing practices, or if you wish to exercise any of your data subject rights as set out in Section 11, please contact our support team through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 inside your nagad7 account dashboard
• Response Commitment: All privacy-related enquiries will receive an initial response within 24 hours in Bangladesh Standard Time (BST, UTC+6), with full resolution targeted within 30 days

nagad7 is committed to handling all privacy concerns with the seriousness and respect they deserve. Where a complaint cannot be resolved through direct contact with our support team, we operate a formal internal escalation process. Details of the escalation process are available upon request.