aca44 Privacy Policy

This Privacy Policy ("Policy") is issued by aca44 ("aca44", "we", "us", or "our"), the operator of the online sports betting and casino platform available at https://aca44.io (the "Platform"). This Policy applies to all registered players, visitors, and prospective players who interact with the Platform in any way.

aca44 is committed to processing personal data responsibly, transparently, and in accordance with all applicable data protection principles. This Policy describes in full detail: the categories of personal data we collect; the purposes and legal bases for which that data is processed; the parties with whom data may be shared; the security measures in place to protect it; the retention periods applied; and the rights available to you as a data subject.

By registering an account with aca44, by using the Platform, or by submitting any personal data to aca44 through any channel, you acknowledge that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact [email protected] to request account closure.

This Policy should be read together with the aca44 Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and those documents, this Policy shall prevail in matters relating to personal data.

aca44 collects the following categories of personal data. The specific data points collected in each category depend on your level of interaction with the Platform:

aca44 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide actively when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated Technical Collection: Data collected automatically when you visit or use the Platform, including through server logs, cookies, pixel tags, and session-tracking technologies. See Section 7 (Cookies & Tracking) for full details.
• Payment Partners: Confirmation data returned by payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard, and participating Bangladeshi banks) when a transaction is initiated or completed — including transaction reference numbers and payment status notifications.
• KYC Verification Providers: Identity verification results and document authenticity scores returned by aca44's third-party KYC service partners, used to confirm your identity and age in compliance with our 21+ policy.
• Third-Party Analytics: Aggregated, anonymised usage statistics gathered through analytics tools to help aca44 understand platform performance and improve the player experience. These analytics do not identify individual players.
• Communications: Any personal data you include voluntarily in messages sent to aca44 support via email, live chat, or support ticket systems.

aca44 processes personal data only where a valid legal basis exists. The legal bases relied upon for the principal processing activities are as follows:

• Contract Performance: Processing necessary to register your account, process deposits and withdrawals, settle bets, and provide all other core platform services you have contracted for by agreeing to the aca44 Terms & Conditions.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including Know Your Customer (KYC) identity verification, anti-money-laundering (AML) transaction monitoring, and age verification to enforce the 21+ policy.
• Legitimate Interests: Processing necessary for aca44's legitimate business interests, including fraud detection and prevention, platform security, responsible gaming monitoring, and improving service quality — provided such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — principally for sending marketing communications and for the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

aca44 uses the personal data it collects for the following specific purposes:

• Account Management: Creating and maintaining your aca44 player account, verifying your identity and age, managing your login credentials, and processing any account closure requests.
• Service Delivery: Processing your deposits and withdrawals in BDT via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, or bank transfer), settling your sports bets, crediting casino game winnings, and issuing bonus funds.
• Regulatory Compliance: Fulfilling KYC and AML obligations, including verifying the source of funds for large transactions, monitoring for suspicious betting patterns, and retaining records as required by applicable regulations.
• Responsible Gaming: Monitoring your gameplay and deposit patterns to identify potential problem gambling behaviours, enforcing self-exclusion periods you have requested, applying deposit limits you have set, and proactively reaching out where responsible gaming concerns are identified.
• Customer Support: Responding to your queries, resolving complaints, processing verification requests, and providing 24/7 support via email and live chat.
• Fraud Prevention & Security: Detecting and investigating suspected fraud, unauthorised account access, multi-accounting, bonus abuse, and other prohibited conduct as defined in the Terms & Conditions.
• Platform Improvement: Analysing anonymised usage data to improve Platform features, fix technical issues, and optimise the betting and gaming experience for players across Bangladesh.
• Marketing: Sending promotional communications about aca44 bonuses, seasonal promotions (BPL, IPL, T20 World Cup, Eid, Pohela Boishakh), and new features — but only where you have opted in to receive such communications.

aca44 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or notifying you of the new purpose in an updated version of this Policy.

aca44 does not sell your personal data. We share personal data only in the circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: Your financial data is shared with our payment processing partners — including bKash, Nagad, Rocket, Upay, Visa, Mastercard, and participating Bangladeshi banks (Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank) — solely for the purpose of executing your requested deposit or withdrawal transactions.
• KYC & Identity Verification Providers: Your identity documents and personal details are shared with third-party KYC service providers for the sole purpose of verifying your identity and age in compliance with our 21+ policy and applicable AML regulations.
• Game Content Providers: Certain game-related data (player session ID, stake, and win amounts) is shared with our game studio partners — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe — strictly to enable game functionality, calculate RTP, and resolve disputes.
• Fraud Prevention Services: Device fingerprinting data and behavioural signals may be shared with specialist fraud detection providers to identify and prevent bonus abuse, multi-accounting, and other prohibited conduct.
• Legal & Regulatory Authorities: aca44 will disclose personal data to competent authorities, law enforcement agencies, or courts where required to do so by applicable law, or where aca44 reasonably believes disclosure is necessary to prevent fraud, money laundering, or other serious criminal activity.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of aca44's business assets, personal data held by aca44 may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

All third-party data processors engaged by aca44 are bound by written data-processing agreements that require them to process personal data only on aca44's documented instructions, to implement appropriate technical and organisational security measures, and to delete or return data upon termination of the agreement.

aca44 uses cookies and similar tracking technologies to operate the Platform, improve performance, and — where you have consented — to deliver relevant promotional content. The following categories of cookies are used:

• Essential Cookies: Strictly necessary for the Platform to function. These include session authentication cookies (to keep you logged in), security cookies (to detect suspicious activity), and load-balancing cookies (to ensure stable performance). Essential cookies cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Used to remember your preferences such as your preferred language, display settings, and last-used payment method, to provide a more personalised experience. These cookies do not track your activity outside of aca44.
• Performance & Analytics Cookies: Used to collect anonymised, aggregated information about how players use the Platform — such as which pages are visited most frequently and how long sessions last. This data is used exclusively to improve the Platform. No individual player is identified through these cookies.
• Marketing Cookies: Used only where you have explicitly consented, to deliver promotional content relevant to your interests. You may withdraw consent for marketing cookies at any time by updating your browser cookie settings or by contacting [email protected].

Most web browsers are configured to accept cookies by default. You can choose to block or delete cookies through your browser settings at any time; however, disabling essential cookies will prevent you from logging into your aca44 account and using core Platform features.

aca44 does not use cross-site tracking technologies to follow your activity across other websites or applications. Our cookies are scoped exclusively to the aca44.io domain.

aca44 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls include:

• TLS/SSL Encryption: All data transmitted between your browser or device and the aca44 Platform is encrypted using Transport Layer Security (TLS 1.2 or higher). The aca44.io domain is SSL-certified and enforces HTTPS on all pages.
• Data Encryption at Rest: Sensitive personal data stored on aca44 servers — including identity documents, payment details, and account credentials — is encrypted using AES-256 encryption.
• Access Controls: Access to personal data within aca44's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and subject to periodic audit.
• Password Security: Account passwords are stored in hashed form using industry-standard cryptographic hashing algorithms. aca44 does not have access to your plaintext password at any time.
• Two-Factor Authentication (2FA): aca44 supports optional two-factor authentication on player accounts for additional login security. We strongly recommend enabling 2FA in your account settings.
• Penetration Testing: aca44 conducts periodic independent security assessments and penetration tests to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident Response: In the event of a confirmed personal data breach that is likely to result in a risk to your rights and freedoms, aca44 will notify affected players without undue delay and take immediate steps to contain and remediate the breach.

While aca44 employs robust security measures, no system is completely immune to risk. You are responsible for maintaining the security of your own device, keeping your aca44 login credentials confidential, and logging out of the Platform when using a shared or public device.

aca44 retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Where anonymisation is not technically feasible, data is securely destroyed.

As a data subject, you have the following rights with respect to the personal data that aca44 holds about you. To exercise any of these rights, please contact [email protected] with your full name, registered mobile number, and a clear description of your request:

• Right of Access: You have the right to request a copy of the personal data aca44 holds about you, together with information about how it is processed. aca44 will respond to valid access requests within 14 calendar days.
• Right to Rectification: If any personal data aca44 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or supplemented without undue delay.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Please note that aca44 may be required to retain certain data for regulatory compliance purposes even after an erasure request.
• Right to Restriction: You have the right to request that aca44 restrict processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing pending verification of whether aca44's legitimate grounds override your interests.
• Right to Portability: Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object at any time to processing of your personal data for direct marketing purposes. You also have the right to object to processing based on aca44's legitimate interests, subject to aca44 demonstrating compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.

The aca44 Platform is strictly intended for adults aged 21 years and above. aca44 does not knowingly collect personal data from any person under the age of 21. The Platform employs mandatory age verification during registration and KYC processes to prevent underage access.

If aca44 discovers or has reasonable grounds to believe that personal data has been submitted by or on behalf of an individual under the age of 21, aca44 will:

• Immediately suspend the relevant account pending investigation.
• Void any bets placed or games played by the underage individual.
• Withhold any associated winnings in accordance with the Terms & Conditions.
• Delete all personal data collected from the underage individual as soon as practicably possible, subject only to any mandatory legal retention obligations.

If you are a parent or guardian and believe that your child has registered an aca44 account or submitted personal data to the Platform, please contact [email protected] immediately so that appropriate action can be taken.

The aca44 Platform may contain references to the names and brands of third-party service providers such as game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, Spribe) and payment partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard). These are operational partners integrated into the aca44 Platform, not separate websites you are redirected to browse independently.

Where the Platform does contain hyperlinks to external websites (for example, links to payment partner help centres), aca44 is not responsible for the privacy practices or content of those external sites. Each external website operates under its own privacy policy, which you should review independently before submitting any personal data to that site.

aca44 does not endorse, guarantee, or make any representations about the privacy standards of any third-party website. Your use of any third-party website is entirely at your own risk and is governed by that website's own terms and privacy policy.

aca44 may send you promotional communications about bonuses, seasonal offers, new game launches, sports betting opportunities (including BPL, IPL, T20 World Cup, and other major cricket events), and other aca44 services — but only where you have explicitly opted in to receive such communications at the time of registration or at any subsequent point via your account preferences.

Marketing communications from aca44 may be delivered via the following channels:

• Email to your registered email address
• SMS to your registered Bangladeshi mobile number
• In-Platform notifications within your aca44 account dashboard

You have the right to opt out of marketing communications at any time, free of charge, by any of the following methods:

• Clicking the "Unsubscribe" link included in any aca44 marketing email
• Updating your communication preferences in your aca44 account settings
• Emailing [email protected] with the subject line "Marketing Opt-Out" and your registered mobile number

Please allow up to 5 business days for opt-out requests to take effect across all communication channels. Opting out of marketing communications does not affect transactional communications — aca44 will continue to send you account-related notifications such as deposit confirmations, withdrawal updates, and security alerts, as these are necessary to deliver the Platform service.

aca44 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or our Platform features. All updates are effective immediately upon publication at https://aca44.io/privacy-policy, unless a later effective date is expressly stated in the updated Policy.

When material changes are made to this Policy — that is, changes that meaningfully affect how we use your personal data or the rights available to you — aca44 will notify registered players by email to the address on file and by displaying a prominent notice on the Platform for a minimum of 14 days following publication of the updated Policy.

Minor or administrative updates (such as corrections of typographical errors, clarifications that do not change the substance of the Policy, or updates to contact details) may be made without individual notification, though the "Last Updated" date at the top of the Policy will always be revised to reflect any change.

Your continued use of the aca44 Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should discontinue use of the Platform and contact [email protected] to arrange account closure and, if applicable, to exercise your data rights under Section 10.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights under Section 10, or have concerns about how aca44 processes your personal data, please contact the aca44 Data Protection team using the details below:

• Email: [email protected] (subject line: "Privacy Enquiry" or "Data Rights Request")
• Support Hours: Available 24/7, 365 days a year
• Response Time: aca44 aims to acknowledge all privacy-related enquiries within 2 business days and to provide a full response within 14 calendar days

If you are not satisfied with aca44's response to your privacy concern, or if you believe that aca44 is processing your personal data in a manner inconsistent with applicable data protection principles, you have the right to escalate your complaint through the appropriate channels available in your jurisdiction.

aca44 takes all privacy complaints seriously and is committed to resolving them promptly, fairly, and in accordance with the principles set out in this Policy. We encourage you to contact us directly in the first instance so that we have the opportunity to address your concern before you escalate to a supervisory authority.