ac366 Privacy Policy

This Privacy Policy applies to all personal data collected or processed by ac366 in connection with the operation of the ac366 online casino and sports betting platform, accessible at https://ac366.io. It covers data collected through the website, any mobile-optimised versions of the platform, customer support communications, and any other channel through which a player interacts with ac366.

This Policy does not apply to the data practices of third-party game providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), payment processors (such as bKash, Nagad, Rocket, or Upay), or any other external service that a player may access via the ac366 platform. Players are encouraged to review the privacy policies of those third parties independently.

The ac366 platform is primarily operated for players located in Bangladesh and is offered in English. References to "players" throughout this Policy include all individuals who browse, register on, or otherwise interact with the ac366 platform, regardless of whether they have completed the account registration process.

For the purposes of this Privacy Policy, ac366 is the data controller in respect of all personal data collected from players who use the platform. As data controller, ac366 is responsible for determining the purposes and means of processing personal data received through the platform.

All data protection queries, access requests, deletion requests, and formal privacy complaints should be directed to ac366's data support team using the contact details provided in Section 17 of this Policy. ac366 will acknowledge all formal data requests within 5 business days (Bangladesh Standard Time, UTC+6) and aim to resolve them within 30 calendar days.

ac366 collects the following categories of personal data from players:

ac366 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, biometric data, or health data unless specifically required for responsible gaming purposes (for example, if a player self-discloses a gambling-related health concern when requesting a self-exclusion). In such cases, the data is processed solely for the purpose of applying the requested protection measure.

ac366 collects personal data through the following channels and mechanisms:

• Registration Form: When you create an ac366 account, you provide identity and contact data directly via the registration form.
• KYC Submission: When you submit identity documents to complete the KYC verification process required before withdrawals can be processed.
• Deposit and Withdrawal Transactions: Financial data is recorded automatically when you initiate a deposit or withdrawal through the ac366 cashier. Payment credentials are passed directly to the relevant payment provider API; ac366 retains only the transaction reference and mobile number or wallet address associated with the method.
• Platform Usage: Technical and account activity data is collected automatically as you navigate the platform, play games, place bets, and use account features.
• Customer Support Interactions: Communications data is collected when you contact ac366 support via live chat, email, or any other supported channel.
• Cookies and Similar Technologies: Session and preference cookies collect limited technical data as described in Section 10.
• Third-Party Verification Partners: Where ac366 uses a third-party identity verification service to cross-check KYC documents, that provider may return verification status data to ac366 in accordance with its own privacy policy and data processing agreement with ac366.

ac366 processes personal data on the following legal bases, depending on the specific processing activity:

• Contractual Necessity: The majority of processing activities — including account creation, payment processing, game delivery, and withdrawal processing — are necessary for the performance of the contract between ac366 and the player (the Terms & Conditions). Without this processing, ac366 cannot provide the services you have registered to use.
• Legal Obligation: Certain processing activities are required to comply with applicable legal obligations, including anti-money laundering (AML) record-keeping, age verification, and Know Your Customer (KYC) requirements. ac366 is obligated to retain financial and identity data for defined periods as part of these obligations.
• Legitimate Interests: ac366 processes technical and account activity data on the basis of its legitimate interests in maintaining platform security, detecting fraud, preventing multi-accounting, and improving the player experience. These interests are balanced against player privacy rights and do not override individual data rights.
• Consent: Where ac366 sends optional marketing communications (promotional emails, bonus notifications), this is done on the basis of consent given at the time of registration or subsequently through account settings. Consent may be withdrawn at any time.

ac366 uses player personal data for the following specific purposes:

• Creating and managing player accounts, including verifying registration details and maintaining account records;
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, USDT, Bitcoin, Ethereum, and other supported payment methods;
• Verifying player age and identity in accordance with KYC requirements prior to processing withdrawal requests;
• Providing access to casino games, live dealer tables, and sportsbook markets, and recording gameplay and betting history for account management and dispute resolution purposes;
• Detecting, investigating, and preventing fraud, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the ac366 Terms & Conditions;
• Monitoring player activity to identify signs of problem gambling and to deliver responsible gaming interventions, including deposit limit reminders and self-exclusion enforcement;
• Delivering transactional communications including deposit confirmations, withdrawal status updates, KYC request notifications, security alerts, and system maintenance notices;
• Sending promotional and marketing communications to players who have consented to receive them, including bonus offers, seasonal promotions (such as Eid or BPL tournament specials), and new game announcements;
• Responding to customer support enquiries via live chat and email, and maintaining a record of communications for quality assurance;
• Analysing aggregate, anonymised platform usage data to improve site performance, game catalogue curation, and the overall player experience.

ac366 will not use player personal data for any purpose that is incompatible with the purposes listed above without first notifying the player and, where required, obtaining consent.

ac366 does not sell, rent, or trade personal data with any third party for commercial or marketing purposes. Personal data is shared with third parties only in the following limited and necessary circumstances:

• Payment Processors: Transaction data (mobile number or wallet address and transaction amount) is shared with the relevant payment provider — including bKash, Nagad, Rocket, Upay, and cryptocurrency network infrastructure — solely to process deposits and withdrawals.
• Identity Verification Partners: KYC document data may be transmitted to a third-party identity verification service for the purpose of verifying identity and age. Such providers operate under contractual data processing agreements with ac366 and are prohibited from using the data for any other purpose.
• Game Providers: Certain technical identifiers (anonymised player session tokens) may be passed to third-party game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi to enable game loading and session management. Full identity data is not shared with game providers.
• Legal and Regulatory Disclosure: ac366 may disclose personal data where required to do so by applicable law, court order, or regulatory authority. In such cases, disclosure will be limited to the specific data required.
• Business Transfers: In the event of a merger, acquisition, or sale of ac366 assets, player data may be transferred to the acquiring entity, subject to equivalent data protection commitments. Players will be notified of any such transfer in advance.
• Fraud Prevention Networks: Where ac366 participates in industry fraud prevention networks, limited account and behavioural data may be shared with other members of such networks to identify shared fraudulent actors. All sharing within such networks is conducted on a confidential, aggregated, or pseudonymised basis.

All third parties with whom ac366 shares personal data are required to implement appropriate technical and organisational security measures to protect that data and are contractually prohibited from using it for any purpose beyond the specific purpose for which it was shared.

8.1 Cross-Border Processing. Given the global nature of online gaming infrastructure, some personal data processed by ac366 may be transferred to or stored on servers located outside Bangladesh. This may include data transferred to third-party game provider infrastructure, cloud hosting providers, or KYC verification services located in other countries.

8.2 Transfer Safeguards. Where personal data is transferred outside Bangladesh, ac366 takes reasonable steps to ensure that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Policy. Such safeguards may include contractual data processing agreements, standard contractual clauses, or reliance on the recipient country's adequacy status where applicable.

8.3 Cryptocurrency Transactions. Players should be aware that cryptocurrency deposit and withdrawal transactions are recorded on public blockchain networks. While ac366 does not publish player identities alongside wallet addresses, the nature of public blockchain infrastructure means that transaction data may be visible to parties operating blockchain analytics tools. Players who have concerns about blockchain privacy should consult independent resources on cryptocurrency privacy practices before transacting.

ac366 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Anonymised data (from which all identifying information has been removed) may be retained indefinitely for statistical and analytical purposes.

Where a player requests account closure under Section 14.3 of the ac366 Terms & Conditions, ac366 will begin the deletion process following the expiry of the applicable retention periods. The account will be marked as closed immediately, preventing further login or wagering activity, but underlying data will be retained for the durations stated above in order to fulfil legal obligations.

10.1 What Are Cookies. Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites function correctly and to provide operational and preference information to the website operator.

10.2 Cookies Used by ac366. ac366 uses the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the ac366 platform to function. They maintain your login session, preserve your account state across page loads, and support security features such as CSRF protection. These cookies cannot be disabled without impacting platform functionality.
• Preference Cookies: These cookies remember your display preferences, such as your chosen language setting and any responsible gaming session reminder intervals you have configured. They persist across browser sessions to avoid you having to re-enter preferences on each visit.
• Analytics Cookies: ac366 may use privacy-respecting analytics tools to collect aggregate data on how players navigate the platform — for example, which pages are visited most frequently, which games are loaded most often, and where users exit the registration flow. This data is used solely to improve platform usability and is not linked to individual player identities.

10.3 Cookies Not Used by ac366. ac366 does not use third-party advertising cookies, cross-site tracking pixels, social media tracking tags, or behavioural profiling cookies of any kind. The platform does not participate in programmatic advertising networks.

10.4 Managing Cookies. You may configure your browser to refuse some or all cookies, or to alert you when cookies are being set. Please be aware that refusing strictly necessary cookies will prevent you from logging in to or using the ac366 platform. Instructions for managing cookies in major browsers are available through your browser's help documentation.

As a player whose personal data is processed by ac366, you hold the following rights in relation to that data. To exercise any of these rights, contact ac366 using the details provided in Section 17:

• Right of Access: You have the right to request a copy of the personal data that ac366 holds about you, together with information about how that data is being used. ac366 will provide this information within 30 calendar days of a verified request.
• Right to Rectification: If any personal data held by ac366 about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (such as a misspelled address), this can be done through your account settings dashboard. For corrections to identity data, contact support directly.
• Right to Erasure: You may request that ac366 delete your personal data. This right is subject to certain limitations — specifically, ac366 may retain data where doing so is necessary to comply with legal obligations (such as AML record-keeping) or to defend against legal claims. Where deletion is not possible in full, ac366 will explain which data is retained and why.
• Right to Restriction: In certain circumstances, you may request that ac366 restrict the processing of your data — for example, while a dispute about data accuracy is being resolved. During a restriction period, ac366 will store the data but not actively process it beyond what is required to maintain the restriction.
• Right to Data Portability: You may request that ac366 provide your personal data in a structured, commonly used, machine-readable format so that it can be transferred to another service provider. This right applies to data you have provided directly and that is processed on the basis of consent or contractual necessity.
• Right to Object: Where ac366 processes your data on the basis of legitimate interests, you have the right to object to that processing. ac366 will cease the processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

ac366 will not charge a fee for exercising any of the above rights in ordinary circumstances. Where requests are manifestly unfounded or excessive, ac366 reserves the right to charge a reasonable administrative fee or to decline to act on the request, in which case we will explain the reason for this decision.

12.1 Consent-Based Marketing. ac366 sends promotional communications — including bonus offers, free spin notifications, seasonal promotion alerts (such as Eid specials, Pohela Boishakh promotions, BPL cricket tournament offers, and IPL season bonuses), and new game announcements — only to players who have given their explicit consent to receive such communications at the time of registration or subsequently through their account settings.

12.2 Channels. Marketing communications may be delivered by email to the player's registered email address. ac366 does not send unsolicited SMS messages to player mobile numbers. WhatsApp contact details displayed on the platform are for support purposes only and are not used for outbound marketing.

12.3 Opting Out. Players who have consented to marketing communications may opt out at any time by:

• Clicking the "Unsubscribe" link included at the bottom of every marketing email from ac366;
• Updating their communication preferences in the ac366 account settings dashboard; or
• Contacting ac366 support at [email protected] with the subject line "Marketing Opt-Out".

Opt-out requests will be processed within 5 business days. After that period, the player will no longer receive marketing communications. Please note that transactional communications (deposit confirmations, withdrawal updates, KYC requests, security alerts) are not subject to the marketing opt-out and will continue to be sent as they are necessary for the operation of your account.

13.1 Technical Safeguards. ac366 implements the following technical security measures to protect player personal data:

• 256-bit SSL/TLS encryption on all pages and API connections between player devices and ac366 servers;
• Passwords stored using industry-standard one-way hashing algorithms — plaintext passwords are never stored;
• Payment credentials (bKash PINs, Nagad PINs, bank passwords, cryptocurrency private keys) are never transmitted to or stored on ac366 servers — all payment authentication takes place directly within the relevant payment provider's secure environment;
• Server infrastructure protected by firewalls, intrusion detection systems, and regular vulnerability scanning;
• Access to production data systems restricted to authorised personnel only, with access controls enforced through multi-factor authentication and role-based permissions;
• Regular security audits and penetration testing conducted by qualified independent security professionals.

13.2 Organisational Safeguards. ac366 staff who have access to player personal data are subject to confidentiality obligations and receive regular training on data protection responsibilities. Access to personal data is granted on a strict need-to -know basis only.

13.3 Breach Response. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of players, ac366 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach. ac366 maintains an internal incident response plan specifically for data security events.

13.4 Player Responsibilities. Players also bear responsibility for the security of their own account. ac366 recommends that players:

• Use a strong, unique password for their ac366 account that is not used on any other platform;
• Never share their account credentials, OTP codes, or KYC documents with any third party, including individuals claiming to represent ac366 (ac366 support will never ask for your password);
• Log out of their ac366 account when using shared or public devices;
• Contact ac366 support immediately at [email protected] if they suspect any unauthorised access to their account.

14.1 Age Restriction. The ac366 platform is strictly intended for adults aged 21 and above. ac366 does not knowingly collect personal data from individuals under the age of 21. The registration process requires players to confirm that they are 21 years of age or older, and KYC verification is used to confirm age prior to any withdrawal being processed.

14.2 Underage Registration. If ac366 discovers or is notified that a player account was registered by an individual who was under 21 years of age at the time of registration, ac366 will:

• Immediately suspend the account and freeze all associated funds pending investigation;
• Delete all personal data associated with the underage account as soon as practicable, subject to any overriding legal retention obligations;
• Return any net deposits to the payment method from which they were made, following verification that the return can be processed safely.

14.3 Reporting Underage Registration. If you have reason to believe that a minor is using or has registered an ac366 account, please contact [email protected] immediately with the subject line "Underage Account Report". ac366 treats all such reports with the highest priority.

The ac366 platform may display the names, logos, or interfaces of third-party game providers, payment processors, and sports data providers in the course of delivering its services. Where accessing a third-party game or payment interface results in data being passed to that third party, this is described in Section 7 of this Policy.

This Privacy Policy does not govern the data practices of any third party. Players who interact with third-party services accessible via or in connection with ac366 — including game provider interfaces, payment provider portals, and any external resources — should review the respective privacy policies of those third parties. ac366 accepts no responsibility or liability for the data practices of third-party services.

ac366 does not embed third-party social media widgets, advertising networks, or tracking pixels on any page of the ac366 platform. Players can verify the absence of such elements using standard browser developer tools.

16.1 Right to Update. ac366 reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing practices, applicable law, platform features, or industry standards. The date of the most recent revision is displayed at the top of this document.

16.2 Notification of Material Changes. Where a proposed change is material — meaning it significantly affects how ac366 collects, uses, or shares player data — ac366 will notify all registered players by email to their registered address at least 7 calendar days before the change takes effect. The updated Policy will also be published on this page with an updated "Last Updated" date.

16.3 Minor Changes. Non-material changes (such as corrections of typographical errors, clarifications of existing practices, or updates to contact details) may be made without advance notice. The updated document will be published on this page and the revision date updated accordingly.

16.4 Continued Use. Continued use of the ac366 platform following the effective date of any updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree to the updated Policy, you should cease using the ac366 platform and may request account closure by contacting [email protected].

For all privacy-related queries, data subject access requests, rectification requests, deletion requests, or formal privacy complaints, players should contact ac366 through the following channels:

• Email: [email protected] — use the subject line "Privacy Request — [type of request]" to ensure your message is routed directly to the data protection team.
• Live Chat: Available 24/7 on the ac366 platform. For complex data requests, the support agent will escalate your request to the data protection team and provide you with a reference number.
• Response Time: ac366 will acknowledge all privacy requests within 5 business days (Bangladesh Standard Time, UTC+6) and will aim to resolve them fully within 30 calendar days of receipt of a verified request.
• Identity Verification: To protect your privacy, ac366 will require verification of your identity before processing any data subject request. This may involve confirming account details or providing a copy of an identity document. This step ensures that personal data is not disclosed to or altered by unauthorised parties.

If you are not satisfied with ac366's response to a privacy request or complaint, you may seek independent advice or pursue remedies through applicable consumer protection or data protection channels available in your jurisdiction.