11bad Privacy Policy

This Privacy Policy sets out the basis on which 11bad ("we", "us", "our") collects, processes, stores, and shares personal data relating to individuals ("you", "your") who access, register on, or otherwise interact with the 11bad online casino and sports betting platform at https://11bad.io (the "Platform").

11bad is Bangladesh's trusted online entertainment platform, offering a premium selection of live casino games, cricket and sports betting markets, slots, card games, and promotional features. Because our Services involve financial transactions and identity verification, we collect a range of personal data that is necessary to operate safely and responsibly.

We are committed to handling your personal data with transparency, integrity, and security. This Policy is written in plain English and is designed to give you a clear understanding of our data practices. We encourage you to read it carefully before registering an account or making any deposit on the 11bad platform.

For the purposes of this Privacy Policy, 11bad acts as the data controller in respect of all personal data collected through the Platform. As data controller, 11bad determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

All data protection enquiries, access requests, erasure requests, and consent withdrawal notices should be directed to our dedicated privacy contact:

• Contact Email: [email protected] (plain text — not a clickable link)
• Subject Line for Privacy Matters: "Privacy Enquiry — [Your Username]"
• Response Time: Within 30 calendar days for data subject rights requests; within 5 business days for general privacy enquiries.
• Operating Hours: 06:00–22:00 Bangladesh Standard Time (BST, UTC+6), seven days a week.

All formal privacy communications with 11bad are conducted in English. Where a Player submits a request in another language, 11bad will respond in English and may request that the Player resubmit their request in English to ensure accuracy.

11bad collects personal data through multiple touchpoints across the Platform. The categories of data we collect, and the context in which each category is collected, are described below.

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data) except where a Player voluntarily discloses such information in a support communication. Where this occurs, such data is used solely to resolve the specific enquiry and is not retained beyond the resolution of that enquiry.

We do not collect data from or about individuals we know to be under the age of 21. If we become aware that personal data has been submitted by a person under 21, we will delete that data and close the associated account immediately.

11bad uses personal data for the following specific purposes. Each purpose is linked to a lawful basis for processing, which is set out in full in Section 5 of this Policy.

• Account Creation and Management: We use Identity Data and Contact Data to create, maintain, and administer your 11bad account, including processing your login credentials and enabling access to all Platform features.
• Identity and Age Verification (KYC): We use Identity Data and Financial Data to verify that you are who you claim to be and that you are at least 21 years of age. This is a regulatory and responsible gaming obligation that we take seriously.
• Payment Processing: We use Financial Data to process deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard. All transaction processing is conducted through verified payment service providers.
• Fraud Prevention and Anti-Money Laundering (AML): We use Technical Data, Financial Data, and Usage Data to detect and investigate suspicious patterns, including account takeover attempts, bonus abuse, and money laundering activity.
• Responsible Gaming Monitoring: We use Usage Data and Preference Data to identify players who may be exhibiting signs of harmful gambling behaviour and to enforce any self-exclusion, deposit limit, or session time limit tools that you have activated on your account.
• Customer Support: We use Communications Data, Identity Data, and Financial Data to respond to your support requests, resolve disputes, and improve the quality of our support services.
• Marketing Communications: Where you have given explicit consent, we use Contact Data and Preference Data to send you promotional offers, bonus notifications, and platform updates by email or SMS. You may withdraw this consent at any time.
• Platform Analytics and Improvement: We use Usage Data and Technical Data in aggregated, anonymised form to understand how the Platform is used, identify technical issues, and inform product development decisions.
• Legal and Regulatory Compliance: We use Identity Data, Financial Data, and Communications Data to comply with applicable legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions.

Every instance of personal data processing carried out by 11bad is grounded in one of the following lawful bases. We do not process personal data without a clear and documented legal justification:

• Contractual Necessity: Processing that is necessary to perform the contract between you and 11bad — specifically, to provide you with the gaming and betting services you have registered to access. This covers account management, payment processing, and KYC verification.
• Legitimate Interests: Processing that is necessary for the legitimate business interests of 11bad, where those interests are not overridden by your rights and interests. This covers fraud detection, AML monitoring, platform security, customer support, and analytics for product improvement.
• Legal Obligation: Processing that is required in order to comply with a legal or regulatory obligation applicable to 11bad. This covers data retention requirements, responses to law enforcement requests, and responsible gaming obligations.
• Consent: Processing for which you have provided a clear, freely given, and informed consent. This covers marketing communications by email and SMS. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11bad does not sell, rent, or trade your personal data with third-party marketers or data brokers. We share personal data with third parties only in the following specific and controlled circumstances:

• Payment Service Providers: We share Financial Data with payment processors (including bKash, Nagad, Rocket, Upay, and card scheme providers) solely to facilitate deposits and withdrawals. These providers process your payment data under their own privacy policies and contractual data protection obligations with 11bad.
• Game Content Providers: Technical session data is shared with our game providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) to the extent necessary to load and operate their games within the 11bad platform. Game providers do not receive Identity Data or Financial Data.
• Identity Verification Partners: Where automated KYC checks are performed, Identity Data may be shared with a third-party identity verification service for the sole purpose of verifying your age and identity. All such providers are contractually bound to data minimisation and security standards.
• Fraud Detection and AML Services: Technical Data and Financial Data may be shared with specialised fraud detection and AML compliance platforms to enable real-time risk scoring and transaction monitoring.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of 11bad, our players, or the public.
• Professional Advisors: We may share personal data with legal, financial, or security advisors where strictly necessary for obtaining professional advice in connection with the operation of the 11bad platform.

All third-party service providers with whom 11bad shares personal data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for their own commercial purposes.

11bad uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your session state, and to support our fraud prevention and analytics capabilities. The following categories of cookies are in use on the 11bad platform:

• Strictly Necessary Cookies: These cookies are essential for the Platform to operate. They manage your login session, maintain your account state between pages, and support security features such as CSRF protection. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your language setting, responsible gaming tool configurations, and notification preferences — so that you do not need to re-enter them on each visit.
• Analytics Cookies: We use anonymised analytics cookies to understand aggregated usage patterns on the Platform. These cookies do not identify individual users and are used solely to improve the Platform's design and performance.
• Security and Fraud Prevention Cookies: These cookies support our fraud detection systems by helping us identify unusual login patterns, bot activity, and account takeover attempts.

We do not use advertising cookies or behavioural tracking cookies for the purposes of serving targeted advertising on third-party websites. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent you from accessing your 11bad account.

11bad retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of your active account relationship with 11bad, plus a minimum of 5 years following account closure. This retention period supports AML compliance obligations and enables us to respond to post-closure disputes.
• Financial Transaction Data: Retained for a minimum of 7 years following the date of each transaction to comply with financial record-keeping requirements applicable to payment service operations.
• KYC Verification Documents: Retained for the duration of your account plus 5 years following account closure. Document copies are stored in encrypted form and access is restricted to authorised compliance personnel.
• Usage and Analytics Data: Retained in anonymised, aggregated form indefinitely for platform analytics purposes. Raw session-level usage logs are retained for a maximum of 24 months before being anonymised.
• Customer Support Communications: Retained for 3 years from the date of the most recent communication in a support thread, or longer where the communication relates to an unresolved or formally disputed matter.
• Marketing Consent Records: Retained for the duration of your account relationship and for 3 years following consent withdrawal, to demonstrate compliance with consent obligations.

11bad implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to, the following:

• Transport Layer Security: All data in transit between your device and 11bad's servers is encrypted using TLS 1.2 or higher (256-bit encryption). Our SSL certificate is validated and renewed continuously.
• Password Security: User passwords are stored using bcrypt hashing with a per-user salt. Passwords are never stored or logged in plaintext and are not accessible to any 11bad employee or system.
• Two-Factor Authentication: 11bad supports two-factor authentication (2FA) for all registered accounts. We strongly encourage all Players to activate 2FA via their Account security settings to add a second layer of protection against unauthorised login.
• Access Controls: Access to personal data within 11bad's internal systems is governed by role-based access controls. Only personnel with a documented operational need to access specific data categories are granted that access. All internal data access is logged and audited.
• Penetration Testing: 11bad's platform infrastructure undergoes regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to Players, 11bad will notify affected Players at their registered email address within 72 hours of becoming aware of the breach and will outline the nature of the breach, the data affected, and the steps taken to contain and remediate it.

While 11bad employs robust technical and organisational security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for notifying us promptly at [email protected] if you suspect any unauthorised access to your account.

As a registered Player on the 11bad platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the relevant subject line indicated below:

• Right of Access: You have the right to request a copy of all personal data that 11bad holds about you. Subject line: "Data Access Request — [Username]". We will respond within 30 calendar days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. For standard account details, many fields can be updated directly through your Account profile. Subject line: "Data Rectification Request — [Username]".
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Subject line: "Data Erasure Request — [Username]".
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data while we verify it. Subject line: "Processing Restriction Request — [Username]".
• Right to Data Portability: You have the right to receive a copy of the personal data you have provided to 11bad in a structured, commonly used, machine-readable format. Subject line: "Data Portability Request — [Username]".
• Right to Object: You have the right to object to processing of your personal data where that processing is based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests. Subject line: "Processing Objection — [Username]".
• Right to Withdraw Consent: Where processing is based on your consent (specifically, marketing communications), you may withdraw that consent at any time via your Account notification settings or by emailing [email protected]. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

11bad will not charge a fee for handling any data rights request unless the request is manifestly unfounded or excessive. In such cases, we will inform you of any applicable fee before proceeding. All requests are handled in English.

11bad's services are strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21. Our registration process includes mandatory age verification fields, and our KYC procedures are designed to detect and reject registrations by underage individuals.

If you are a parent or guardian and you believe that a person under the age of 21 has submitted personal data to 11bad and created an account, please contact us immediately at [email protected] with the subject line "Underage Account Report". We will investigate and, where confirmed, immediately close the account, delete all associated personal data, and refund any deposited funds to the payment method of origin.

11bad reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes to this Policy, we will provide notice to registered Players via the email address associated with their account at least 7 days before the amended Policy takes effect.

Non-material changes — such as typographic corrections, minor clarifications, or structural reorganisation that does not alter the substance of how data is processed — may be published without prior notice. The effective date displayed at the top of this document will always reflect the date on which the current version took effect.

Continued use of the 11bad platform after the effective date of any amended Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes to this Policy, you should stop using the platform and request account closure by contacting [email protected] before the amended Policy takes effect.

All previous versions of this Privacy Policy are superseded by the current version. We do not maintain an archive of previous policy versions for public viewing, but registered Players may request a copy of the previous version by contacting our privacy team within 30 days of an amendment taking effect.

If you have any questions, concerns, or requests relating to this Privacy Policy or 11bad's data practices, please reach out to our privacy team using the contact details below. All communications should be in English and include your registered account username where relevant.

• Privacy Contact Email: [email protected] (plain text — not a clickable link)
• General Enquiries Subject Line: "Privacy Enquiry — [Username]"
• Data Rights Requests Subject Line: See Section 10 for subject line format by request type.
• Response Time: Within 30 calendar days for formal data rights requests; within 5 business days for general privacy enquiries.
• Support Hours: 06:00–22:00 BST (UTC+6), seven days a week.
• Platform: https://11bad.io