bl88 Privacy Policy — Your Data, Your Rights
This Privacy Policy explains what personal data bl88 collects, why we collect it, how we use and protect it, and what rights you have over your information. We are committed to handling your data with transparency and care.
Overview
Introduction — Who We Are and Why This Policy Exists
bl88 ("bl88", "we", "us", "our") operates the online casino and sports betting platform at bl88.games, serving players across Bangladesh. In order to provide our services — including account registration, payment processing, game delivery, customer support, and responsible gaming tools — we necessarily collect and process certain personal data about you. This Privacy Policy ("Policy") sets out, in plain language, exactly what data we collect, the legal basis on which we process it, how long we keep it, and the choices available to you.
This Policy applies to all personal data collected through the bl88 website, any associated mobile web interface, and through communications you have with us (including support chat, email, and any feedback forms). By using bl88, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please do not use the platform.
bl88 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Your data is used solely to operate the platform, process your transactions, keep your account secure, and comply with our legal obligations.
Our Commitments
Four Privacy Commitments bl88 Makes to Every Player
Before diving into the full policy text, here is a plain-language summary of the four core commitments that guide how bl88 handles your personal data.
Data We Collect
Categories of Personal Data bl88 Collects
Information You Provide Directly
When you register an account on bl88, you provide us with information that we need to create and manage your account. This includes your full name, mobile phone number (which also serves as your login identifier), date of birth (for age verification), and your preferred payment method details. During the KYC verification process, you may also be asked to provide a copy of a government-issued identity document such as your National ID (NID) card or passport, and in some cases a recent utility bill or bank statement to verify your address.
Information Collected Automatically
When you visit and use the bl88 platform, we automatically collect certain technical information about your device and usage. This includes your IP address, browser type and version, operating system, device model, session timestamps (time and duration of each login), pages visited within the platform, game sessions (game title, stake amounts, results, and duration), and the referral source through which you arrived at bl88. This technical data is used primarily for security monitoring, fraud prevention, and improving platform performance.
Payment and Transaction Data
bl88 records all deposits and withdrawals associated with your account, including transaction amounts, timestamps, payment method used, and transaction reference numbers provided by your mobile wallet or bank. bl88 does not store your full bKash PIN, Nagad PIN, or card CVV/CVN. Payment instrument authentication is handled by your mobile wallet provider or card network — bl88 only receives the transaction confirmation and the tokenised reference required to process your withdrawal.
| Data Category | Examples | Legal Basis |
|---|---|---|
| Identity Data | Name, mobile number, date of birth, NID / passport copy | Contract performance; legal obligation (KYC) |
| Contact Data | Mobile number, email address (if provided) | Contract performance; legitimate interest |
| Financial Data | Transaction history, deposit amounts, withdrawal records, payment method tokens | Contract performance; legal obligation (AML) |
| Technical Data | IP address, device model, browser, session logs, game history | Legitimate interest (security, fraud prevention) |
| Communications Data | Support chat logs, email correspondence, feedback submissions | Contract performance; legitimate interest (quality assurance) |
Data Use
How bl88 Uses the Information It Collects
Providing and Operating the Platform
The primary purpose for which bl88 processes your personal data is to deliver the services you have contracted for: creating and maintaining your account, processing deposits and withdrawals, delivering games, calculating and crediting winnings, and providing customer support. Without this processing, we cannot offer you the services described at bl88.games.
Security, Fraud Prevention, and AML Compliance
bl88 processes technical data, transaction data, and identity data for the purposes of detecting and preventing fraudulent activity, money laundering, and bonus abuse. This includes automated monitoring of account activity patterns, cross-referencing of device fingerprints and IP addresses to identify duplicate accounts, and screening of transaction data against standard anti-money-laundering (AML) indicators. Where suspicious activity is identified, we are required to report it to the relevant financial intelligence authorities without notifying the account holder.
Responsible Gaming Monitoring
bl88 uses account activity data — including session frequency, session duration, deposit patterns, and game-play velocity — to identify players who may be showing signs of problem gambling. This monitoring is conducted as part of our responsible gaming programme. Where indicators suggest a player may be at risk, our player welfare team may proactively reach out via your registered mobile number. You may opt out of proactive responsible gaming outreach, but doing so does not disable the monitoring itself, which is a legal obligation.
Marketing Communications
bl88 may use your registered mobile number to send you promotional SMS messages about bonuses, new game launches, tournament announcements, and seasonal offers relevant to Bangladesh (such as Eid or BPL season promotions). You may opt out of marketing SMS at any time by replying STOP to any marketing message or by updating your communication preferences in your account settings. Opting out of marketing does not affect transactional messages (deposit confirmations, withdrawal updates, security alerts).
Data Sharing
When and With Whom bl88 Shares Your Data
Service Providers
bl88 shares personal data with a limited set of third-party service providers who help us operate the platform. These include payment processors (bKash, Nagad, Rocket, and our card payment gateway provider), KYC verification service providers, game content providers (such as Evolution Gaming, Pragmatic Play, Spribe, and Ezugi — who receive only the technical session data necessary to deliver the game, not your identity data), and our cloud infrastructure provider. All service providers are bound by data processing agreements that prohibit them from using your data for any purpose other than the specific service they provide to bl88.
Legal and Regulatory Disclosures
bl88 may be required to disclose your personal data to law enforcement authorities, financial intelligence units, or regulatory bodies where we are legally compelled to do so — for example, in response to a lawful court order, subpoena, or AML reporting obligation. bl88 will not voluntarily disclose your data to government authorities beyond what is required by law. Where permitted by law, we will endeavour to notify you before complying with such a request.
Business Transfers
In the event that bl88 undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the successor entity as part of that transaction. In such circumstances, the successor entity will be bound by privacy obligations no less protective than those set out in this Policy, and you will be notified via your registered mobile number prior to the transfer taking effect.
Payment Provider Data Sharing
When you initiate a deposit via bKash or Nagad, the mobile wallet provider independently verifies your identity against their own records. bl88 receives only the transaction confirmation and the anonymised token for the payment instrument. We do not have access to your bKash or Nagad account balance, transaction history outside of bl88 transactions, or your mobile wallet PIN. The sharing of data between bl88 and your mobile wallet provider at the time of a transaction is governed by your agreement with that mobile wallet provider.
Cookies
Cookies, Local Storage, and Tracking Technologies
What Cookies bl88 Uses
bl88 uses cookies and similar browser storage technologies (including localStorage and sessionStorage) to operate the platform. Strictly necessary cookies are used to maintain your login session, remember your language preference, and prevent cross-site request forgery (CSRF). Performance cookies collect anonymous analytics about how players navigate the platform — which sections are most visited, average session duration, and drop-off points — to help us improve the product. bl88 does not use advertising or retargeting cookies.
Managing Your Cookie Preferences
Most modern mobile browsers allow you to view and delete cookies, block third-party cookies, or browse in private/ incognito mode. Disabling strictly necessary cookies will prevent you from logging in to bl88. You can manage cookies through your browser settings. On Android Chrome: Settings → Site Settings → Cookies. On iOS Safari: Settings → Safari → Privacy & Security.
Session Storage and Login Tokens
bl88 stores a secure, time-limited session token in your browser's sessionStorage when you log in. This token authenticates your requests to the server during your active session and expires automatically when you close the browser tab or after a period of inactivity (typically 30 minutes). The session token does not contain your personal data — it is a randomly generated cryptographic string that maps to your session on our server. It is transmitted exclusively over HTTPS and is protected against cross-site scripting (XSS) by strict Content Security Policy headers.
Security
How bl88 Protects Your Personal Data
bl88 implements a layered security architecture to protect the personal data we hold about you. Data in transit between your device and our servers is encrypted using TLS 1.2 or higher (commonly described as SSL encryption). Stored personal data — including identity documents, payment records, and account credentials — is encrypted at rest using industry-standard AES-256 encryption. Access to personal data within our organisation is restricted on a strict need-to-know basis: only staff members whose roles require access to specific data categories are granted access, and all access events are logged and audited.
Despite these measures, no data transmission over the internet or electronic storage method is 100% secure. bl88 cannot guarantee absolute security of your data. If you become aware of any security vulnerability affecting your account — such as an unauthorised login, an unexpected password reset, or suspicious transaction activity — you must notify our support team immediately so that we can take prompt action to protect your account.
SSL / TLS Encryption
All data exchanged between your browser and bl88.games is encrypted via TLS. Look for the padlock icon in your browser's address bar to confirm the secure connection is active.
Two-Factor Authentication (2FA)
bl88 supports two-factor authentication via OTP (one-time password) sent to your registered mobile number. Enabling 2FA significantly reduces the risk of unauthorised account access. We strongly recommend enabling 2FA from your account security settings.
Data Breach Response
In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected players, bl88 will notify affected users via their registered mobile number within 72 hours of becoming aware of the breach, describing the nature of the breach, the data involved, and the steps being taken to address it.
Data Retention
How Long bl88 Retains Your Personal Data
Retention During Active Account
bl88 retains your personal data for as long as your account remains open and for a period after closure as required by our legal obligations. Specifically: identity and KYC documents are retained for a minimum of five years following account closure, in accordance with standard AML record-keeping requirements. Transaction records (deposit and withdrawal history) are retained for a minimum of five years from the date of each transaction. Game session logs are retained for two years. Marketing consent records are retained for three years from the date of consent or withdrawal of consent, whichever is later.
Deletion After Retention Period
When the applicable retention period for a category of personal data expires, bl88 will securely delete or anonymise that data so that it can no longer be linked to you as an individual. Anonymised data (from which all personal identifiers have been removed) may be retained indefinitely for statistical and product improvement purposes, as it no longer constitutes personal data under applicable privacy law.
You may request early deletion of your personal data at any time by contacting our support team. We will process deletion requests within 30 days. Note that some data (such as financial transaction records) cannot be deleted before the mandatory legal retention period has elapsed, regardless of your request.
Your Rights
Your Data Rights as a bl88 Player
bl88 respects your rights over your personal data. The following rights are available to all bl88 players. To exercise any of these rights, contact our support team with your registered mobile number and a clear description of your request. We will respond within 30 days.
Right of Access
You have the right to request a copy of all personal data bl88 holds about you. We will provide this in a structured, machine-readable format (JSON or CSV) within 30 days of receiving your verified request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. For account details such as your registered name, you will be required to provide documentary evidence of the correct information (e.g. a government-issued ID) before we make the correction.
Right to Erasure
You have the right to request the deletion of your personal data. This right is subject to our legal retention obligations — we cannot delete financial records before the mandatory five-year AML retention period has passed. When deletion is not immediately possible due to a legal hold, we will restrict processing of the data to only what is legally required and delete it as soon as the retention period expires.
Right to Opt Out of Marketing
You have the right to withdraw your consent to receiving marketing communications at any time. Reply STOP to any bl88 promotional SMS, or contact support with a written opt-out request. Marketing opt-outs are processed within 5 business days. Note that withdrawing marketing consent does not affect the lawfulness of processing that occurred before your withdrawal.
Age Policy
Children's Privacy and Minimum Age Policy
bl88 is strictly an adults-only platform. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes a date-of-birth field and a self-declaration of age eligibility. Where we have reason to believe that a registered account belongs to a person under 21 years of age — whether identified through our KYC process, a third-party age verification check, or a report from another user — we will immediately suspend the account, void any winnings, and initiate the return of deposited funds to the original payment source.
Parents and guardians who believe that a minor in their household may have registered on bl88 should contact our support team immediately. We will prioritise the review and closure of any account identified as belonging to a minor. We support the use of parental control software on shared devices to prevent underage access to gambling websites.
Third Parties
Third-Party Services, Game Providers, and External Links
Game Provider Interfaces
Many games on bl88 are delivered via iframes provided by third-party game studios such as Evolution Gaming, Pragmatic Play, Spribe, and Ezugi. When you launch a game, a session token (not containing your personal identity data) is passed to the game provider so they can deliver the game content. The game provider's own privacy policy governs any data processing that occurs within their game interface. bl88 does not control the data practices of third-party game providers. We recommend reviewing the privacy policies of game studios whose games you play regularly.
No External Links Policy
bl88 does not include outbound links to third-party websites on its platform pages. All navigation on bl88 remains within the bl88.games domain. If you navigate away from bl88 to an external site through any other means (such as a search engine result), please be aware that this Privacy Policy does not apply to the external site and that bl88 has no responsibility for the privacy practices of external websites.
Updates
Changes to This Privacy Policy and How to Contact Us
Policy Updates
bl88 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When we make a material change to this Policy, we will update the "Last updated" date at the top of the page and, where the change significantly affects your rights or our use of your data, we will notify you via your registered mobile number. Your continued use of the platform following the effective date of any revision constitutes your acceptance of the updated Policy.
Contact Us About Privacy
If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a privacy concern, please contact our support team by writing to [email protected]. Include your registered mobile number and a clear description of your request so that we can verify your identity and respond promptly. We aim to respond to all privacy-related enquiries within 5 business days and to complete substantive requests (such as data access or deletion) within 30 calendar days.
For urgent account security concerns — such as suspected unauthorised access or a compromised password — contact support immediately and reference "SECURITY" in your message subject. Security reports are escalated and handled with priority response times.
Questions About Your Privacy?
Check our FAQ for quick answers, or head to the bl88 Casino to start playing safely today. Your data is protected every step of the way.
Read the FAQ Explore bl88 Casino