Privacy Policy

1. Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

• "365aec", "we", "us", "our" — the 365aec online gaming platform operated at https://365aec.app and all associated sub-domains.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including name, email address, phone number, payment account details, device identifiers, and IP addresses.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Subject" — any registered or prospective player whose personal data is processed by 365aec.
• "Third Party" — any natural person or legal entity that is not the Data Subject or 365aec, including payment processors, identity verification providers, and game content partners.
• "Cookies" — small text files placed on your device by the 365aec platform to store session information, preferences, and analytics data.

2. Scope of This Policy

2.1 This Privacy Policy applies to all personal data collected by 365aec through the platform website at https://365aec.app, including all sub-pages, account registration flows, deposit and withdrawal processes, customer support interactions, and any other touchpoint through which you provide information to 365aec.

2.2 This policy applies equally to all registered players and to visitors who browse the 365aec platform without registering an account.

2.3 This Privacy Policy should be read alongside the 365aec Terms & Conditions and Responsible Gaming Policy. In the event of a conflict between this policy and the Terms & Conditions, the Terms & Conditions shall prevail except in matters that relate exclusively to data protection, where this policy governs.

2.4 This policy does not cover the privacy practices of third-party websites that may be referenced in platform content. 365aec is not responsible for the data handling practices of any third-party operators or service providers beyond the obligations described in Section 6 of this policy.

3. Data We Collect

3.1 Registration Data

When you create a 365aec account, we collect the following information that you provide directly:

• Full legal name;
• Date of birth (to verify that you are aged 18 or above);
• Email address;
• Mobile phone number;
• Preferred username and encrypted password;
• Residential address in Bangladesh.

3.2 Identity Verification Data

To comply with our know-your-customer (KYC) and anti-money laundering obligations, we may request and collect:

• National Identity Card (NID) number and scanned copy;
• Passport or driving licence copy;
• Mobile money account statements (bKash, Nagad, Rocket, Upay, or DBBL) confirming account ownership;
• Proof of address documentation where required.

3.3 Transaction Data

For every deposit and withdrawal transaction processed through your 365aec account, we record:

• Transaction date, time, and amount in BDT;
• Payment method used (bKash, Nagad, Rocket, Upay, or DBBL);
• Mobile wallet account reference (partial, for reconciliation purposes);
• Transaction status and any error codes generated.

3.4 Gaming Activity Data

We automatically record your platform activity, including:

• Games played, bet amounts, game outcomes, and session durations;
• Sports betting market selections, stake values, and settlement outcomes;
• Bonus redemptions and wagering progress;
• Responsible gaming tool usage (deposit limits set, cooling-off periods activated).

3.5 Technical & Device Data

When you access the 365aec platform, our servers automatically collect:

• IP address and approximate geolocation (city/district level);
• Device type, operating system, and browser version;
• Session timestamps, pages visited, and click-path data;
• Cookie identifiers and similar tracking technologies as described in Section 7.

3.6 Support Correspondence Data

When you contact the 365aec support team via live chat or email, we retain records of the conversation, including your account identifier, the date and time of contact, the nature of the query, and the resolution provided. These records are used for quality assurance, dispute resolution, and staff training.

4. How We Use Your Data

365aec processes your personal data for the following specific purposes:

Purpose	Data Used	Legal Basis
Account creation and management	Registration data, device data	Contractual necessity
Identity verification (KYC)	Verification documents, registration data	Legal obligation
Payment processing	Transaction data, registration data	Contractual necessity
Fraud prevention & AML screening	All data categories	Legal obligation / legitimate interest
Platform personalisation	Gaming activity, device data	Legitimate interest
Customer support	Support correspondence, account data	Contractual necessity
Responsible gaming monitoring	Gaming activity, session data	Legal obligation / legitimate interest
Marketing communications	Email, registration data	Consent (opt-in only)
Platform analytics & improvement	Technical data, gaming activity	Legitimate interest

4.1 Marketing Communications: 365aec will only send you promotional emails, SMS notifications, or in-platform messages regarding bonuses and offers if you have explicitly opted in to receive such communications during account registration or through your account preferences settings. You may withdraw consent at any time by updating your notification preferences within the account dashboard or by contacting the support team.

4.2 We do not use your personal data to make fully automated decisions that produce legal or similarly significant effects on you without human review. Any account suspension or closure resulting from automated fraud detection is reviewed by a member of the 365aec compliance team before being made permanent.

5. Legal Basis for Processing

5.1 Contractual Necessity: Processing your registration data, transaction data, and account activity data is necessary to fulfil the contract between you and 365aec — specifically, to provide you with access to the gaming platform and to process your deposits and withdrawals.

5.2 Legal Obligation: Processing your identity verification data and maintaining transaction records is required by applicable anti-money laundering regulations and financial record-keeping obligations. 365aec cannot waive these requirements regardless of player preference.

5.3 Legitimate Interest: Processing technical and behavioural data for fraud prevention, responsible gaming monitoring, and platform improvement serves the legitimate interests of 365aec and its player community, provided that such processing does not override your fundamental privacy rights.

5.4 Consent: Where we send you marketing communications or use non-essential cookies, we do so only with your explicit, freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

6.1 365aec does not sell, rent, or trade personal data to any third party. We share personal data only in the following limited circumstances:

• Payment processors: Your name and mobile wallet reference are shared with bKash, Nagad, Rocket, Upay, and DBBL solely to authorise and reconcile your transactions. These providers process data under their own privacy policies and are contractually bound to use your data only for payment processing.
• Identity verification providers: Where third-party KYC services are used to validate identity documents, the minimum necessary data is shared under strict data processing agreements.
• Game content providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive a session token and anonymised player identifier to serve game content. They do not receive your full name, NID, or payment details.
• Legal and regulatory authorities: We will disclose personal data to law enforcement, financial intelligence units, or regulatory bodies when required to do so by a valid legal process, court order, or applicable law.
• Professional advisers: Lawyers, auditors, and insurers may access personal data on a strictly confidential, need-to-know basis in connection with their professional services to 365aec.

6.2 Any third party that receives personal data from 365aec is required to implement technical and organisational security measures equivalent to or exceeding those described in Section 12 of this policy, and to process data only for the specific purpose for which it was shared.

6.3 In the event that 365aec undergoes a corporate restructuring, merger, or acquisition, your personal data may be transferred to the acquiring entity. In such circumstances, you will be notified via your registered email address no less than 30 days prior to the transfer, and the acquiring entity will be bound by the terms of this Privacy Policy.

7. Cookies & Tracking Technologies

7.1 Types of Cookies We Use

The 365aec platform uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: Store your preferences such as language settings and remembered login state to improve your experience across sessions.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate and use the platform, helping us identify areas for improvement. These cookies are activated only with your consent.
• Security Cookies: Used for fraud detection and bot prevention by analysing device fingerprint signals and interaction patterns.

7.2 Managing Cookies

You can manage non-essential cookie preferences through your browser settings at any time. Please note that disabling functional or analytics cookies will not prevent you from using the 365aec platform, but may affect the quality of your experience. Disabling strictly necessary cookies will impair core platform functionality and is not recommended.

7.3 365aec does not use cross-site tracking cookies, third-party advertising cookies, or any cookie technology that tracks your activity on websites other than the 365aec platform itself.

8. Data Retention

8.1 365aec retains personal data only for as long as necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by applicable law.

8.2 The following standard retention periods apply:

• Account registration and KYC data: Retained for the lifetime of your account and for a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Gaming activity logs: Retained for 2 years from the date of each session, unless required for an ongoing dispute or investigation.
• Support correspondence: Retained for 2 years from the date of the interaction.
• Marketing consent records: Retained for the duration of your consent and for 1 year following withdrawal of consent.
• Technical and device data: Retained for 12 months on a rolling basis.

8.3 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identifiable individual.

9. Your Data Rights

As a 365aec player, you have the following rights in relation to your personal data. To exercise any of these rights, contact us using the details in Section 14.

9.1 We will respond to all verifiable data rights requests within 30 calendar days of receipt. In complex cases we may extend this by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

9.2 We reserve the right to verify your identity before processing a data rights request to prevent unauthorised disclosure of another person's data. Verification may require you to confirm details already held on your account or to provide a copy of your identity document.

10. Children's Privacy

10.1 The 365aec platform is strictly intended for adults aged 18 years and above. We do not knowingly collect, store, or process personal data from individuals under the age of 18.

10.2 If 365aec becomes aware that personal data has been collected from a person under the age of 18, that data will be deleted immediately and the associated account will be permanently closed. Any deposits made by an underage player will be returned to the originating payment method, less any amounts required to be withheld by applicable law.

10.3 If you believe that a minor may have accessed the 365aec platform using your account or another account, please contact our support team immediately via live chat or at the email address in Section 14 so that we can investigate and take appropriate action.

11. Third-Party Services

11.1 The 365aec platform integrates third-party services to deliver game content, process payments, and maintain platform security. These include, but may not be limited to: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi (game content); bKash, Nagad, Rocket, Upay, DBBL (payment processing); and specialist KYC and fraud detection providers.

11.2 Each third-party provider operates under its own privacy policy and data processing terms. 365aec performs due diligence on all third-party partners before integration and requires contractual commitments to data security and minimum data processing standards as a condition of the commercial relationship.

11.3 365aec is not responsible for the content, privacy practices, or security of any third-party website or service that is not directly operated by 365aec, even if a link to such a service appears within the platform. Users who access third-party services do so at their own risk and are subject to those services' own terms and privacy policies.

12. Security Measures

12.1 365aec implements the following technical and organisational measures to protect your personal data:

• AES-256 encryption for all data stored in our databases;
• TLS 1.3 for all data transmitted between your device and our servers;
• Role-based access control (RBAC) limiting staff access to data on a strict need-to-know basis;
• Multi-factor authentication (MFA) required for all internal administrative system access;
• Regular penetration testing conducted by independent security specialists;
• Intrusion detection systems (IDS) monitoring for anomalous access patterns in real time;
• Secure data disposal procedures for physical and digital media at end of retention period.

12.2 While 365aec implements industry-standard security measures, no system is completely immune to risk. We encourage all players to use strong, unique passwords for their 365aec accounts and to enable any available two-factor authentication features to further protect account access.

13. Updates to This Privacy Policy

13.1 365aec reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. The effective date at the top of this document will be updated whenever a new version is published.

13.2 Where an amendment is material — meaning it changes how we collect, use, or share your personal data in a way that may affect your rights — we will notify you via the email address registered to your account at least 14 days before the amendment takes effect.

13.3 Your continued use of the 365aec platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept a material amendment, you may request account closure by contacting our support team before the amendment comes into effect.

13.4 The most current version of this Privacy Policy is always available at https://365aec.app/privacy-policy. We recommend that you review this page periodically to stay informed of any changes.

14. Contact Information

If you wish to exercise any of your data rights, raise a privacy concern, or ask a question about this Privacy Policy, please contact the 365aec data team through the following channels:

The email address above is displayed as plain text only. Please copy it manually into your email client. 365aec does not use clickable mailto links for security reasons.