o9bit Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how o9bit ("we", "us", "our") collects, uses, stores, shares, and protects personal information relating to individuals ("you", "your", "Player") who access or use the o9bit platform, available at https://o9bit.bio, including all associated pages, account management features, casino games, sports betting markets, live dealer tables, and related services (collectively, the "Platform").

o9bit is Bangladesh's trusted online casino and sports betting destination, serving players across Dhaka, Chittagong, Sylhet, Rajshahi, Khulna, Barisal, Rangpur, Mymensingh, Cox's Bazar, and throughout Bangladesh. We understand that the players who choose o9bit place trust in us not just to deliver a world-class gaming experience, but also to handle their personal data responsibly and lawfully.

By registering an account on the o9bit Platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Policy. This Policy should be read together with our Terms & Conditions, which govern the overall contractual relationship between you and o9bit.

02 Data Controller

For the purposes of applicable data protection principles, o9bit acts as the data controller in respect of personal data collected through the Platform. As data controller, o9bit determines the purposes and means of processing your personal data and bears primary responsibility for ensuring that processing is conducted lawfully, fairly, and transparently.

All data protection enquiries, requests to exercise your rights, and formal complaints should be directed to our dedicated privacy contact:

03 Data We Collect

o9bit collects personal data through several channels: directly from you when you register, verify your account, or contact support; automatically through your use of the Platform; and in limited circumstances, from third-party partners involved in payment processing or identity verification.

3.1 Registration & Account Data

When you create an o9bit account, we collect the following information:

• Full legal name (as it appears on your national identity document)
• Date of birth (to verify you are 21 years of age or older)
• Mobile phone number (used as your primary account identifier and for OTP authentication)
• Preferred Mobile Financial Service (MFS) provider: bKash, Nagad, Rocket, or Upay
• MFS account number linked to your o9bit account for deposit and withdrawal purposes
• Account password (stored as a cryptographic hash — never in plain text)

3.2 Verification (KYC) Data

As part of our know-your-customer (KYC) obligations, we may request and collect:

• A copy of your National Identity Card (NID) or other government-issued identity document
• A selfie or live photograph taken at the time of verification to confirm identity document ownership
• Proof of MFS account ownership (e.g., a screenshot of your registered bKash or Nagad account screen)

3.3 Transaction Data

We record all financial transactions associated with your account, including:

• Deposit amounts, timestamps, and MFS transaction reference numbers
• Withdrawal requests, amounts, processing status, and completion timestamps
• Bonus credits applied to your account and associated wagering progress
• Running account balance history

3.4 Gaming Activity Data

We log all gaming and betting activity on the Platform, including game sessions, wager amounts, game outcomes, bet settlement records, and sports betting selections. This data is used for game integrity verification, dispute resolution, responsible gaming monitoring, and regulatory compliance.

3.5 Technical & Device Data

When you access the Platform, we automatically collect certain technical data:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser information
• Session duration, pages visited, and navigation patterns within the Platform
• Crash reports and error logs generated during your session

3.6 Communications Data

When you contact o9bit support via email or live chat, we retain records of those communications, including the content of your messages, timestamps, the support agent who handled your case, and the resolution outcome. These records allow us to maintain service quality and resolve any follow-up queries efficiently.

04 How We Use Your Data

o9bit uses the personal data it collects for the following specific purposes:

• Account Administration: Creating and managing your o9bit account, processing login authentication via OTP, and maintaining your account preferences and settings.
• Identity Verification: Confirming that you are who you claim to be and that you meet the minimum age requirement of 21 years, in accordance with our KYC obligations.
• Payment Processing: Facilitating deposits and withdrawals via bKash, Nagad, Rocket, Upay, and other supported MFS channels. Transaction data is retained for financial record-keeping and reconciliation.
• Game Delivery: Providing access to casino games, sports betting markets, live dealer tables, and other gaming products available on the Platform.
• Fraud Prevention & Security: Detecting and preventing fraudulent account activity, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and triggering intervention tools such as deposit limits and self-exclusion where appropriate.
• Customer Support: Responding to your enquiries, resolving disputes, and managing complaints in a timely and effective manner.
• Legal & Regulatory Compliance: Meeting obligations under applicable laws, including anti-money laundering (AML) requirements, responding to lawful requests from competent authorities, and maintaining records as required by law.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players interact with the Platform and to identify technical issues, UX improvements, and new feature opportunities.
• Promotional Communications: Sending you information about bonuses, promotions, and Platform updates via your registered mobile number — only where you have not opted out of such communications.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, with the exception of automated fraud screening systems where initial flags are always reviewed by a human team member before any account action is taken.

05 Legal Basis for Processing

Each processing activity carried out by o9bit rests on one of the following legal bases:

• Contractual Necessity: Processing required to perform the contract with you — i.e., delivering the o9bit Platform services in accordance with our Terms & Conditions. This covers account creation, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including AML obligations, KYC verification requirements, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing necessary for o9bit's legitimate business interests, including fraud prevention, Platform security, responsible gaming monitoring, and product improvement — provided those interests are not overridden by your fundamental rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in the context of optional promotional communications. You may withdraw consent at any time by contacting [email protected].

06 Cookies & Tracking Technologies

The o9bit Platform uses cookies and similar tracking technologies to deliver a functional and personalised user experience. Cookies are small text files stored on your device by your browser when you access the Platform.

6.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. You cannot opt out of these without disabling the Platform entirely.
• Functional Cookies: Store your preferences such as language settings, preferred game categories, and remembered login state. These improve your experience but are not required for basic Platform operation.
• Analytics Cookies: Collect anonymised data about how players navigate the Platform — page visit frequency, session duration, feature engagement. This data is aggregated and used solely for internal Platform improvement.
• Security Cookies: Support our fraud detection and abuse prevention systems by establishing device fingerprints used to identify anomalous login behaviour.

6.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling functional cookies may impair certain features of the o9bit Platform. Strictly necessary cookies cannot be disabled without preventing you from using the Platform. For detailed guidance on managing cookies in your specific browser, refer to the browser's official help documentation.

07 Data Sharing

o9bit does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We share personal data only in the following specific circumstances:

7.1 Game Providers

To deliver casino games and live dealer experiences, o9bit works with licensed Game Providers including Evolution Gaming, Pragmatic Play, Ezugi, Spribe, and others. These providers may receive your account identifier and session data to authenticate your access to their game engines. They are contractually prohibited from using this data for any purpose other than game delivery.

7.2 Payment Partners

Transaction data is shared with your selected MFS provider — bKash, Nagad, Rocket, or Upay — to the extent required to process your deposits and withdrawals. These institutions are independently regulated financial entities with their own privacy obligations.

7.3 Identity Verification Services

Where o9bit uses a third-party KYC verification service to assist with identity document checking, your submitted KYC documents may be processed by that service. All such providers are bound by strict data processing agreements.

7.4 Fraud Prevention & AML Partners

o9bit may share transaction and behavioural data with specialist fraud prevention and anti-money laundering screening services to fulfil our legal obligations and protect the integrity of the Platform.

7.5 Legal & Regulatory Disclosure

We may disclose personal data to competent governmental authorities, regulators, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction. In such cases, we will disclose only the minimum data required to satisfy the legal request.

08 International Data Transfers

The o9bit Platform primarily stores and processes personal data within infrastructure serving the Bangladesh region. However, certain Game Providers and technical service partners operate globally and may process data on servers located outside Bangladesh.

Where personal data is transferred internationally, o9bit ensures that appropriate safeguards are in place, including data processing agreements that incorporate standard contractual clauses requiring the recipient to protect personal data to standards equivalent to those applied by o9bit. Transfers to Game Providers are limited to the minimum data required for game session authentication and are governed by the providers' own certified data protection programmes.

If you have concerns about the international transfer of your personal data, please contact us at [email protected] for further information about the specific safeguards applicable to your data.

09 Data Retention

o9bit retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, after which it is securely deleted or irreversibly anonymised. The following retention periods apply as a general guide:

Where a legal obligation requires us to retain data for longer than the periods above, we will retain the data for the legally mandated period. At the end of any retention period, data is deleted using secure deletion methods appropriate to its sensitivity level.

10 Your Rights

As a player using the o9bit Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Request — [Your Account ID]". We will respond within 30 calendar days.

Please note that some rights are subject to limitations where o9bit has overriding legal obligations — for example, we cannot delete transaction records that we are legally required to retain for AML compliance purposes. In such cases, we will explain the specific reason why your request cannot be fully fulfilled.

11 Children's Privacy

The o9bit Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from any person under the age of 21. Our registration process requires date-of-birth entry, and accounts where the provided date of birth indicates the user is under 21 are refused at the point of registration.

If o9bit becomes aware that personal data has been collected from a person under the age of 21 — whether through a false date of birth provided at registration or any other means — the relevant account will be immediately suspended, all associated data will be securely deleted, and any funds in the account will be handled in accordance with applicable regulatory requirements.

12 Data Security

o9bit takes the security of your personal data seriously and has implemented a range of technical and organisational measures designed to protect your data against unauthorised access, accidental loss, alteration, or disclosure.

• Encryption in Transit: All data transmitted between your device and the o9bit Platform is encrypted using TLS 1.3. The Platform enforces HTTPS-only access and applies HSTS headers to prevent protocol downgrade attacks.
• Encryption at Rest: Sensitive personal data stored in our databases is encrypted at rest using AES-256 encryption. KYC documents are stored in an encrypted object store with access restricted to authorised verification personnel.
• Password Security: Account passwords are never stored in plain text. They are processed using a strong cryptographic hashing algorithm with per-account salting to prevent rainbow table attacks.
• OTP Authentication: Sensitive account operations, including login, withdrawal requests, and account changes, are authenticated via one-time passcodes sent to your registered mobile number, adding a second factor of authentication.
• Access Controls: Internal access to personal data is governed by role-based access controls. Staff access to raw player data is logged, audited, and restricted to the minimum necessary for job function.
• Incident Response: o9bit maintains a documented data breach response plan. In the event of a data breach that poses a risk to player rights, affected players will be notified promptly with details of the breach and recommended protective actions.

While o9bit employs robust security measures, no system is entirely immune to risk. You are encouraged to use a strong, unique password for your o9bit account and to never share your login credentials or OTP codes with any third party.

13 Changes to This Privacy Policy

o9bit reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or Platform features. When material changes are made, we will notify registered players via their registered mobile number and will update the "Last Reviewed" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the o9bit Platform following the publication of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should stop using the Platform and request account closure by contacting [email protected].

Minor changes — such as corrections of typographical errors or clarifications that do not materially alter the substance of the Policy — may be made without proactive notification, though the "Last Reviewed" date will always be updated to reflect any edit, however small.

14 Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or the way o9bit handles your personal data, please reach out to our privacy team through the following channel:

Our support team is available 24 hours a day, 7 days a week, including Bangladesh public holidays (Bangladesh Standard Time, UTC+6).

Effective Date: 1 January 2026  |  Last Reviewed: 1 January 2026  |  Version: 1.0