bu888 Privacy Policy

bu888 is committed to protecting the personal privacy of every player who uses our Platform. We understand that the data you share with us is sensitive, and we take our responsibility to handle that data with care, transparency, and respect very seriously.

This Privacy Policy sets out in plain language what personal data bu888 collects from you, why we collect it, the legal basis on which we process it, how long we retain it, the third parties with whom we share it, the security measures we employ to protect it, and the rights you have in relation to your own data.

bu888 operates as an online cricket betting and casino platform serving players primarily in Bangladesh. We handle data in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, and data subject rights — while meeting the practical requirements of operating a compliant, secure online gaming platform for Bangladeshi players aged 21 and above.

If you have questions about any aspect of this Privacy Policy that are not addressed in this document, you are welcome to contact our support team at any time via 24/7 live chat on the Platform, or by writing to us at the email address set out in Section 14 of this Policy.

bu888 collects personal data across several categories depending on your interaction with the Platform. The table below summarises the main categories of data we collect and provides examples of the specific data points within each category:

bu888 does not intentionally collect special categories of sensitive personal data (such as health information, racial or ethnic origin, religious beliefs, political opinions, or biometric data) except where a KYC document incidentally contains such information as part of a government-issued identity document. In such cases, bu888 processes only the identity and age verification aspects of the document and does not record or use the sensitive elements.

bu888 collects your personal data through the following channels:

• Direct Collection: Data you provide to us directly when you register an account, complete KYC verification, make a deposit or withdrawal request, claim a bonus, contact our support team, or update your account profile settings.
• Automated Collection: Technical and usage data collected automatically when you access the Platform via cookies, log files, pixel tags, and similar tracking technologies. See Section 7 for full details on our use of cookies.
• Payment Processors: Financial transaction data received from our payment processing partners (bKash, Nagad, Rocket, Upay, and card processors) when you initiate a deposit or withdrawal. This data is limited to what is required to confirm the transaction and reconcile your account balance.
• KYC Verification Partners: Identity and age verification data received from our third-party KYC verification service providers when your submitted documents are reviewed and cross-referenced against identity databases.
• Fraud & Security Services: Risk signals and device fingerprint data received from fraud detection services we use to protect the integrity of the Platform and the security of all player accounts.
• Game Providers: Aggregated session and wagering data received from game providers (such as Pragmatic Play, Evolution Gaming, Spribe, and others) for the purpose of reconciling game results, resolving disputes, and maintaining accurate transaction records.

bu888 processes your personal data only where a valid lawful basis exists for doing so. The following lawful bases apply to our processing activities:

• Contractual Necessity: Processing that is necessary to perform the contract between you and bu888 — including account creation, payment processing, game delivery, bonus management, and customer support. Without this processing, bu888 cannot provide you with the Platform services.
• Legal Obligation: Processing that is required to comply with applicable legal obligations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements, age verification obligations, and the retention of financial transaction records as required by law.
• Legitimate Interests: Processing carried out in pursuit of bu888's legitimate business interests, provided that those interests are not overridden by your data protection rights. Legitimate interest processing at bu888 includes fraud detection and prevention, Platform security, responsible gaming monitoring, and internal analytics to improve Platform performance.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for the sending of direct marketing communications (such as promotional emails and bonus alerts). You may withdraw your consent to marketing communications at any time by updating your notification preferences in your account settings or by contacting our support team.

bu888 uses the personal data we collect for the following specific purposes:

• Account Registration and Management: To create and maintain your player account, verify your identity and age, authenticate your login sessions, and enable you to access Platform features.
• Payment Processing: To process your deposit and withdrawal requests, reconcile account balances, and maintain accurate financial transaction records. Your payment method details are handled by our PCI-DSS-compliant payment processing partners.
• KYC and AML Compliance: To verify your identity prior to processing withdrawals and to conduct ongoing monitoring of transaction patterns to detect and prevent money laundering, fraud, and other financial crime as required by applicable compliance obligations.
• Bonus and Promotion Management: To credit bonus balances to your account, track wagering progress toward bonus requirements, and manage promotional eligibility.
• Customer Support: To respond to your enquiries, complaints, and requests for assistance submitted via live chat or email. Support interactions are recorded for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor your gaming activity for signs of problem gambling behaviour, to enforce any responsible gaming restrictions you have self-applied, and to reach out proactively if our monitoring systems identify patterns associated with harmful gambling.
• Platform Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, multi-accounting, and other prohibited activities described in the bu888 Terms & Conditions.
• Platform Improvement: To analyse aggregated usage data in order to improve the performance, content, and usability of the bu888 Platform for all players.
• Marketing Communications: Where you have consented, to send you promotional emails, bonus alerts, and notifications about new games or seasonal promotions (such as BPL, IPL, Eid, and Pohela Boishakh offers). You may opt out at any time.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and requests from law enforcement or regulatory authorities where legally required.

bu888 does not sell or trade your personal data. We share your personal data only with the following categories of third parties, and only to the extent necessary to fulfil the specific purpose for which the data is shared:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and card processing partners receive financial data necessary to process your transactions. These partners operate under their own privacy policies and are contractually obligated to process your data only for the purpose of completing the relevant transaction.
• KYC and Identity Verification Providers: Third-party services that assist bu888 in verifying the identity and age of players, as required by our compliance obligations. These providers process your identity documents and cross-reference them against authorised databases.
• Game Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other certified game studios receive session-level data necessary for game delivery, result reconciliation, and dispute resolution. Game providers do not receive your financial payment data or KYC documents.
• Fraud Detection and Security Services: Specialist providers that supply fraud signals, device fingerprinting, and risk-scoring services to protect the integrity of the Platform and the security of all player accounts.
• Legal and Regulatory Authorities: bu888 will share personal data with law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where we are legally required or compelled to do so. We will, where legally permitted, notify you of such a disclosure.
• Professional Advisers: Lawyers, accountants, and auditors engaged by bu888 may have access to personal data in the course of providing professional services to bu888, and are bound by confidentiality obligations.

All third-party data processors engaged by bu888 are subject to written data processing agreements that require them to apply appropriate technical and organisational security measures, process data only on bu888's documented instructions, and comply with applicable data protection obligations.

bu888 uses cookies and similar tracking technologies to operate the Platform, analyse performance, and personalise your experience. The following categories of cookies are used on the bu888 Platform:

Strictly necessary cookies cannot be disabled as they are essential for the Platform to function. All other cookie categories can be managed through your browser settings or by contacting our support team to update your marketing consent preferences. Note that disabling functional cookies may affect the user experience on certain parts of the Platform.

bu888 does not use cookies to collect personal data for sale to third parties. Analytics cookies generate aggregated, pseudonymous data only — individual user-level data from analytics tools is not shared externally.

bu888 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law. The following retention periods apply:

• Account Data (active accounts): Retained for the duration of your account relationship with bu888 and for a period of five (5) years following account closure, to allow for the resolution of any disputes, regulatory enquiries, or legal claims that may arise after closure.
• Financial Transaction Records: Retained for a minimum of seven (7) years following each transaction, as required by financial record-keeping and anti-money laundering obligations.
• KYC Documents: Retained for five (5) years following account closure, or for such longer period as required by applicable AML and financial crime prevention law.
• Support Communications: Live chat transcripts and email correspondence retained for three (3) years from the date of the communication, for quality assurance and dispute resolution purposes.
• Technical and Usage Logs: Retained for up to twelve (12) months, after which they are anonymised or deleted.
• Marketing Consent Records: Retained for the duration of your account relationship and for three (3) years following account closure, as evidence of your consent status.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data that has been anonymised such that it can no longer be linked back to an identifiable individual falls outside the scope of this Privacy Policy and may be retained and used by bu888 indefinitely for statistical and analytical purposes.

bu888 takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher. There is no plaintext data channel on the bu888 Platform.
• Data Encryption at Rest: Sensitive data fields — including identity documents, payment method details, and authentication credentials — are encrypted at rest in our databases using AES-256 encryption.
• Access Controls: Access to personal data within bu888's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality agreements and receive regular data protection training.
• Penetration Testing: The bu888 Platform and underlying infrastructure are subject to periodic security penetration testing by independent security specialists to identify and remediate vulnerabilities.
• Fraud Detection: Real-time fraud monitoring systems continuously analyse Platform activity to detect and respond to suspicious activity that may indicate a compromise of player account security.
• Incident Response: bu888 maintains a documented data breach incident response plan. In the event of a confirmed personal data breach, the plan is activated immediately and affected players are notified in accordance with Section 6 of this Policy and applicable breach notification obligations.

As a bu888 player, you have the following rights in relation to your personal data. You may exercise any of these rights at any time by contacting our support team via live chat or by emailing support@bu888 .io:

bu888 will respond to all verified data rights requests within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window. There is no charge for exercising your data rights. However, where requests are manifestly unfounded or excessive — in particular due to their repetitive character — bu888 reserves the right to charge a reasonable administrative fee or refuse to act on the request, and will inform you accordingly.

The bu888 Platform is strictly intended for adults aged 21 years and above. bu888 does not knowingly collect, store, or process any personal data relating to individuals under the age of 21. All new account registrations are subject to an age verification check at the point of registration, and any account found to belong to a person under the minimum age will be immediately suspended and all associated funds returned or withheld in accordance with our Terms & Conditions and applicable law.

If you are a parent or guardian and you believe that your child or a minor in your care has registered an account on the bu888 Platform or has submitted personal data to bu888 without your knowledge, please contact our support team immediately via live chat or by emailing [email protected]. Upon receipt of a credible underage report, bu888 will investigate and take immediate action, including suspension of the account and secure deletion of any personal data associated with the minor, to the extent not prevented by legal obligations.

bu888 encourages parents and guardians to make use of available parental control software to prevent minors from accessing online gambling platforms. Safe messaging and internet filtering tools are widely available and can provide an additional layer of protection beyond bu888's own age verification measures.

The bu888 Platform may, from time to time, contain references to or integrations with third-party services such as game providers and payment processors. Where such third-party services involve a separate user interface or website, those third parties operate their own privacy policies and data protection practices, which are independent of this Privacy Policy.

bu888 is not responsible for the privacy practices of third-party services accessible through or referenced on the Platform. We encourage you to review the privacy policies of any third-party service with which you interact in connection with your use of the bu888 Platform. This Privacy Policy applies solely to personal data collected directly by bu888 through the bu888.io Platform and its associated communication channels.

bu888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our Platform. When material changes are made to this Privacy Policy, bu888 will notify registered players by email to their registered email address and/or via an in-platform notification, providing at least seven (7) days' advance notice prior to the changes taking effect.

The "Last updated" date at the top of this Privacy Policy will always reflect the date on which the most recent version came into effect. We encourage you to review this Privacy Policy periodically. Your continued use of the bu888 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must discontinue your use of the Platform and may request account closure in accordance with the bu888 Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to bu888's handling of your personal data, you may contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly within the bu888 Platform. Live chat is the fastest way to reach our support team for account-specific data queries.
• Email: [email protected] (displayed as plain text — not a clickable link). Responses to data protection enquiries are typically provided within 12 hours during Bangladesh Standard Time (BST, UTC+6) business hours, and within 24 hours at all other times.

For formal data protection requests — including Subject Access Requests, erasure requests, data portability requests, and written complaints — please clearly mark your communication with the subject line "Data Protection Request" so that our team can route your enquiry to the appropriate personnel promptly. When submitting a data rights request, please include your registered account username and, where applicable, a copy of a government-issued identity document to enable us to verify your identity before processing the request.

bu888 takes all data protection complaints seriously. If you are not satisfied with our response to your complaint, you have the right to escalate your concern to a competent data protection supervisory authority in your jurisdiction.