ace355 Privacy Policy

This Privacy Policy applies to all users of the ace355 platform, including the website at ace355.bid and any related services (collectively, the "Platform"). It sets out what personal data we collect, why we collect it, how we use and protect it, and the rights you have in relation to that data.

ace355 is the data controller for personal data collected through the Platform. By registering an account or continuing to use the Platform after this policy has been made available to you, you acknowledge that you have read and understood how your data is handled as described in this document.

This policy should be read alongside the ace355 Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall framework governing your use of the Platform.

ace355 collects personal data that is necessary to provide a secure, compliant, and personalised betting and casino experience for players across Bangladesh. The categories of data we collect are described below.

2.1 Identity & Contact Data

• Full legal name
• Date of birth
• Mobile telephone number (primary contact and account identifier)
• Email address (where provided)
• Residential address or city (e.g., Dhaka, Chittagong, Sylhet, Khulna)
• Government-issued ID details (National ID card number, passport number, or driving licence number) — collected only during KYC verification

2.2 Financial Data

• Payment method type (e.g., bKash, Nagad, Rocket, Upay, bank name)
• Registered mobile number or account number associated with your payment method
• Transaction history including deposit amounts, withdrawal amounts, dates, and reference numbers
• Account balance and wagering history

2.3 Technical & Usage Data

• IP address and approximate geographic location derived from it
• Device type, operating system, and browser type and version
• Session start and end times, pages visited, and features used within the Platform
• Login timestamps and frequency of access
• Game play logs including games played, stake amounts, and outcomes

2.4 Communications Data

• Records of messages sent to and received from ace355 customer support via live chat or email
• Dispute and complaint correspondence
• Responses to surveys or feedback requests (where you choose to participate)

ace355 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical data collected automatically as you navigate and interact with the Platform, including via cookies, server logs, and analytics tools. See Section 7 for details on cookies.
• Third-party sources: Identity and fraud-screening data provided by KYC verification partners where ace355 has engaged a third-party service to assist with identity confirmation. Payment confirmation data received from payment providers such as bKash, Nagad, Rocket, and Upay when you initiate a transaction.

ace355 does not purchase personal data from data brokers or third-party marketing databases. All data collected relates directly to your use of the ace355 Platform or is required for legal compliance purposes.

ace355 uses the personal data we collect for the purposes set out in the table below. We do not use your data for any purpose that is incompatible with the purpose for which it was originally collected without first obtaining your consent or where otherwise permitted by applicable law.

You may opt out of receiving promotional communications at any time by contacting customer support at [email protected]. Opting out of marketing communications does not affect transactional or account-related notifications, which are necessary for the operation of your account.

ace355 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and ace355, including account registration, payment processing, and bet settlement.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, age verification requirements, and fraud prevention mandates.
• Legitimate interests: Processing carried out in pursuit of ace355's legitimate business interests, including platform security, fraud detection, responsible gaming monitoring, and analytics — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent, including sending optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

ace355 does not sell or rent your personal data to third parties. We may share your personal data with the following categories of recipient only to the extent necessary for the stated purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and other financial institutions — to process your deposits and withdrawals and verify payment ownership.
• KYC and identity verification partners: Third-party verification services engaged by ace355 to confirm your identity and age as required for compliance purposes.
• Game content providers: Studios including Evolution Gaming, Ezugi, Pragmatic Play, NetEnt, Microgaming, and Spribe receive the minimum data necessary (typically a session token and stake data) to deliver game content within the Platform.
• IT and hosting service providers: Cloud infrastructure and security service providers that host and maintain the ace355 Platform under strict data processing agreements that prohibit any independent use of your data.
• Legal and regulatory authorities: Law enforcement agencies, regulatory bodies, or courts where ace355 is required by law or court order to disclose information, or where disclosure is necessary to protect the rights, property, or safety of ace355, its users, or the public.
• Fraud prevention agencies: Where ace355 has reasonable grounds to suspect fraudulent activity, relevant data may be shared with fraud prevention and AML screening services.

ace355 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device that allow the Platform to recognise your browser and remember certain information about your session and preferences.

The categories of cookies used by ace355 are as follows:

• Strictly necessary cookies: These are essential for the Platform to function. They enable secure login sessions, maintain your account state across page navigations, and support payment flow integrity. These cookies cannot be disabled.
• Performance and analytics cookies: These cookies collect anonymised data about how users interact with the Platform — such as which pages are most visited and how users navigate between sections. This information helps ace355 improve the Platform experience. These cookies do not identify you personally.
• Functionality cookies: These cookies remember your preferences, such as preferred language settings or display options, to provide a more personalised experience on return visits.
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and other security threats to the Platform.

Most browsers allow you to control cookie settings through their preferences or settings menu. Please note that disabling certain categories of cookies may affect the functionality of the Platform, including your ability to log in or complete transactions.

ace355 retains your personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status and for a period of 5 years following account closure, in accordance with standard financial record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years following the end of the business relationship, in line with anti-money laundering regulatory requirements.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Customer support and dispute records: Retained for 3 years from the date of the final resolution of the support interaction or dispute.
• Marketing consent records: Retained until you withdraw consent and for 1 year thereafter as a record of the opt-out.
• Technical and log data: Typically retained for 12 months from the date of collection, unless a longer period is required for an ongoing security investigation.

When your personal data is no longer required for any of the purposes described above, ace355 will securely delete or anonymise it so that it can no longer be associated with you as an individual.

The specific security measures applied by ace355 include:

• SSL/TLS encryption: All data transmitted between your device and the ace355 Platform is encrypted using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology, ensuring that your data cannot be intercepted in transit.
• Password hashing: Account passwords are stored using one-way cryptographic hashing algorithms. ace355 staff cannot view your plaintext password; in the event of a data breach, your password is not exposed in a usable form.
• Access controls: Access to personal data within ace355's systems is restricted on a need-to-know basis. Only staff with a legitimate operational requirement can access specific categories of data, and all access is logged and audited.
• Two-factor authentication (2FA): ace355 supports or requires additional authentication steps for sensitive account actions such as password changes and withdrawal requests.
• Fraud and anomaly detection: Automated systems monitor account activity for patterns indicative of unauthorised access, fraud, or money laundering, and trigger alerts or account restrictions when suspicious activity is detected.
• Regular security reviews: ace355 conducts periodic internal reviews of its data security practices and engages external security assessments to identify and remediate vulnerabilities.

While ace355 takes all reasonable steps to protect your personal data, no internet-based service can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying ace355 immediately if you suspect that your account has been accessed without your authorisation.

You have the following rights in relation to the personal data that ace355 holds about you. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and a clear description of the right you wish to exercise along with your registered account mobile number for identification purposes.

• Right of access: You have the right to request a copy of the personal data ace355 holds about you and information about how it is being processed.
• Right to rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You may also update basic account information directly through your account dashboard.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where ace355 has no other lawful basis for continued processing. Note that this right is subject to ace355's legal obligations to retain certain data for regulatory compliance purposes.
• Right to restrict processing: You may request that ace355 restricts processing of your data in certain circumstances, such as while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on ace355's legitimate interests, and to object to the use of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

ace355 will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case ace355 will notify you of the extension and the reason for it within the initial 30-day period.

ace355 enforces age verification at the point of registration and at subsequent stages as part of its KYC process. If ace355 becomes aware that it has collected personal data from an individual who is under 18 years of age, it will take immediate steps to close that account, return any real-money balance where applicable, and securely delete all associated personal data.

If you believe that a minor may have registered an account on ace355 or that personal data of a minor is being processed by ace355 without proper authorisation, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

ace355 primarily processes and stores data within server infrastructure serving the Bangladesh market. In some circumstances, personal data may be transferred to, processed by, or stored with service providers or game studio partners located in other countries, including countries that may not have data protection laws equivalent to those applicable in Bangladesh.

Where such international transfers take place, ace355 ensures that appropriate safeguards are in place to protect your personal data, including entering into data processing agreements with the relevant service providers that impose equivalent data protection obligations and restrict the use of your data to the stated purpose only.

By registering an account with ace355, you acknowledge and agree to the transfer of your personal data as described in this section, subject to the safeguards described above.

ace355 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the nature of the Platform's services. When material changes are made, ace355 will notify registered users via the mobile number or email address associated with their account, and/or by displaying a prominent notice on the Platform, at least 7 days before the updated policy takes effect.

The most current version of this Privacy Policy is always available at /privacy-policy. The effective date at the top of this document indicates when the current version was last revised. Continued use of the Platform after a revised Privacy Policy takes effect constitutes your acceptance of the updated terms.

For changes that are required urgently due to legal or security reasons, the updated policy may take effect immediately. In such cases, notice will be provided as promptly as possible following publication of the change.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ace355 handles your personal data, please contact our privacy team using the details below:

• Email: [email protected] — include "Privacy Policy" or "Data Rights Request" in the subject line
• Live Chat: Available 24/7 through the ace355 Platform
• Response Time: ace355 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days, consistent with the timeframes described in Section 10

Please include your registered account mobile number in all written correspondence to assist us in locating your account records and responding to your query efficiently. ace355 will never ask you to provide your password or payment PIN via email or live chat.