ac677 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1. Data We Collect

ac677 collects personal data from players in Bangladesh at several points throughout the registration and gameplay lifecycle. The categories of personal data we collect, and the specific data points within each category, are set out in the table below.

Data Category	Specific Data Points	Collection Trigger
Identity Data	Full legal name, date of birth, national identity card (NID) number, passport number (if provided)	Account registration and KYC verification
Contact Data	Bangladesh mobile telephone number, email address, residential city (e.g., Dhaka, Chittagong, Sylhet)	Account registration
Financial Data	bKash account number, Nagad account number, Rocket number, bank account name and number (for bank transfer players), transaction history in BDT	First deposit or withdrawal request
Technical Data	IP address, device type, operating system, browser type and version, screen resolution, session duration	Each platform visit (via cookies and server logs)
Gameplay Data	Bet history, game sessions played, casino game outcomes, sports betting selections, bonus usage records	Continuous during active gameplay
Communications Data	Live chat transcripts, support email content, survey responses, complaint records	When you contact ac677 support or respond to communications

Data You Provide Voluntarily: The majority of personal data ac677 holds is provided directly by you during the registration process, during KYC identity verification, when making deposits or withdrawals, or when contacting our support team. You are not legally obligated to provide this data; however, failure to provide mandatory fields (such as name, mobile number, and date of birth) means we are unable to create or maintain your ac677 account.

Data We Collect Automatically: When you visit ac677.com or use our mobile platform, we automatically collect certain technical data via cookies, web beacons, and server-side logging. This technical data is used primarily for platform security, fraud detection, and performance optimisation. Please see the Cookies & Tracking section below for full details.

Data From Third Parties: In certain circumstances, ac677 may receive data about you from third-party identity verification services used to validate your NID during KYC, or from payment providers such as bKash, Nagad, and Rocket in the course of processing your transactions. This data is used solely for the purpose for which it was shared and is not combined with your gameplay data for marketing profiling.

2. How We Use Your Data

ac677 processes your personal data only for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which ac677 uses your personal data are as follows:

• Account Creation and Management: To register your ac677 account, verify your identity, maintain your account preferences, and enable secure login from your registered devices
• Payment Processing: To process deposits from and withdrawals to your bKash, Nagad, Rocket, Upay, or bank account; to verify that payments originate from accounts registered in your own name; and to maintain an accurate ledger of your transaction history in BDT
• KYC and Age Verification: To verify that you are at least 18 years of age, that you are the person you claim to be, and that your account is not being used for money laundering or fraud. 18+
• Platform Delivery: To serve the correct game content, odds feeds, and promotional offers to your device; to maintain session continuity; and to remember your in-platform preferences such as language and odds format
• Customer Support: To respond to your enquiries, investigate complaints, and provide technical assistance — all of which require access to your account history and contact data
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour and to apply self-exclusion, deposit limit, or session time-out restrictions as requested by you or as required by our responsible gaming obligations
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity including duplicate account creation, bonus abuse, money laundering, and unauthorised access to player accounts
• Legal Compliance: To meet our obligations under applicable anti-money laundering requirements, to respond to lawful requests from competent authorities, and to retain records for the minimum periods required by applicable law
• Marketing Communications: To send you promotional emails, SMS notifications, and in-platform messages about ac677 bonuses, BPL cricket promotions, new game launches, and seasonal offers — provided you have not opted out of such communications
• Platform Improvement: To analyse aggregated, anonymised gameplay and navigation data to improve the performance, layout, and content of ac677.com and our mobile platform

Legal Basis for Processing: ac677 processes your personal data on the following legal bases: (a) contractual necessity — processing required to fulfil our obligations under the player account agreement; (b) legitimate interests — fraud prevention, platform security, and responsible gaming monitoring; (c) legal obligation — KYC, anti-money laundering record-keeping, and compliance with lawful authority requests; and (d) consent — marketing communications, where consent may be withdrawn at any time without affecting the lawfulness of prior processing.

3. Cookies & Tracking

ac677 uses cookies and similar tracking technologies on ac677.com and our mobile web platform. Cookies are small text files placed on your device that allow our platform to recognise returning users, maintain session security, and analyse how players navigate the site.

Categories of Cookies Used by ac677

Strictly Necessary Cookies: These cookies are essential for the ac677 platform to function. They maintain your login session, remember your account authentication state, and support the secure processing of financial transactions. These cookies cannot be disabled without breaking core platform functionality.

Performance and Analytics Cookies: ac677 uses anonymised analytics cookies to understand how players use the platform — which pages are visited most frequently, where players drop off during the registration flow, and how long sessions last on average. This data is used exclusively in aggregated, anonymised form to improve platform performance. Individual player data is never extracted from analytics reporting.

Functional Cookies: These cookies remember your in-platform preferences, including your chosen odds display format, notification settings, and any responsible gaming limits you have set. Disabling functional cookies may result in your preferences not being saved between sessions.

Security Cookies: ac677 uses security cookies for device fingerprinting, to detect new or unrecognised device logins, to enforce our one-account-per-player policy, and to identify IP addresses or device profiles associated with fraudulent activity. These cookies are strictly necessary for the security of the platform and player funds.

4. Data Sharing & Third Parties

ac677 does not sell, rent, or trade your personal data to any third party. However, in order to deliver the ac677 platform and comply with our legal obligations, we share specific categories of data with the following carefully selected third-party categories:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the minimum financial data required to process your deposit or withdrawal transactions. These providers operate under their own privacy policies and are subject to Bangladesh financial sector regulations.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive anonymised session identifiers to deliver their game content within the ac677 platform. These providers do not receive your name, NID, or payment account details.
• Identity Verification Services: Third-party KYC providers receive your identity documents (NID copy, passport copy) for the purpose of automated identity and age verification. These providers are contractually bound to process your data only for verification purposes and to delete documents promptly after verification is complete.
• Technology Infrastructure Providers: Cloud hosting, content delivery network (CDN), and cybersecurity service providers that support the operation of ac677.com may have access to server logs containing technical data. These providers operate under strict data processing agreements with ac677.
• Legal and Regulatory Authorities: ac677 will disclose personal data to competent legal or regulatory authorities when required to do so by a lawful order, court mandate, or in connection with the investigation of serious crime including money laundering and fraud.

All third-party data processors engaged by ac677 are required to: (a) process data only on ac677's documented instructions; (b) implement technical and organisational security measures appropriate to the risk; (c) notify ac677 without undue delay in the event of a data security incident affecting ac677 player data; and (d) delete or return all player data upon termination of the service agreement.

International Data Transfers: Some of ac677's technology infrastructure and game content partners operate servers outside Bangladesh. Where data is transferred internationally, ac677 ensures that appropriate contractual safeguards are in place to maintain data protection standards equivalent to those applied within Bangladesh.

5. Data Retention

ac677 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Personal data associated with an active ac677 account is retained for the full duration of the account's active status, plus a minimum period of five years following permanent account closure. This retention period supports our anti-money laundering, fraud investigation, and audit obligations.
• KYC Identity Documents: Copies of NID, passport, or driving licence documents submitted for KYC verification are retained for a minimum of five years from the date of submission. Original document images are stored in an encrypted document management system with access restricted to authorised compliance personnel only.
• Transaction Records: All deposit and withdrawal records, including transaction amounts in BDT, timestamps, payment method references, and approval status, are retained for a minimum of seven years from the date of the transaction.
• Support Communications: Live chat transcripts, support email threads, and complaint records are retained for three years from the date of the final communication in each case.
• Gameplay Records: Detailed bet-by-bet gameplay records are retained for a minimum of three years. Aggregated, anonymised gameplay statistics derived from these records may be retained indefinitely for platform analytics purposes.
• Anonymised Analytics Data: Technical and performance data that has been fully anonymised (i.e., from which no individual player can be identified) is not subject to a defined retention limit.

When personal data reaches the end of its retention period, ac677 securely deletes or anonymises the data in accordance with industry-standard data destruction practices. Players who request early erasure (see Your Privacy Rights below) will be advised of any retention obligations that prevent immediate deletion.

6. Your Privacy Rights

As an ac677 player, you hold the following rights in respect of the personal data we hold about you. To exercise any of these rights, submit a written request to [email protected] with the subject line "Privacy Rights Request" and include your registered email address and mobile number for verification purposes. ac677 will acknowledge all rights requests within 24 hours and provide a full response within five business days.

• Right of Access: You have the right to request a copy of all personal data ac677 holds about you. This is sometimes referred to as a Subject Access Request (SAR). ac677 will provide the data in a structured, readable format.
• Right to Rectification: If any personal data ac677 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections (e.g., a telephone number update) can be made directly through your ac677 account settings.
• Right to Erasure: In certain circumstances, you have the right to request that ac677 delete your personal data. Please note that this right is subject to our legal retention obligations; data that must be retained for anti-money laundering or audit purposes cannot be erased on request until the relevant retention period has elapsed.
• Right to Restrict Processing: You may request that ac677 restrict the processing of your personal data in specific circumstances — for example, if you contest the accuracy of the data or object to a particular processing activity while your objection is under review.
• Right to Data Portability: Where processing is based on your consent or on a contract with you, and is carried out by automated means, you may request that ac677 provide your personal data in a machine-readable format suitable for transfer to another service provider.
• Right to Object: You have the right to object at any time to the processing of your personal data for direct marketing purposes. Upon receipt of a valid objection, ac677 will cease all marketing communications to you within 48 hours.
• Right to Withdraw Consent: Where ac677 processes your data on the basis of your consent (primarily for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

7. Data Security

ac677 implements a multi-layered security framework to protect all personal data held on the platform. The following technical and organisational measures are in place:

• 256-Bit SSL Encryption: All data in transit between your device and ac677 servers is encrypted using industry-standard 256-bit SSL/TLS encryption. The padlock indicator in your browser confirms that your connection to ac677.com is secure at all times.
• Encrypted Data Storage: Personal data stored in ac677's databases — including identity documents, financial account references, and transaction records — is encrypted at rest using AES-256 encryption. Database access is restricted to authorised ac677 technical and compliance personnel only.
• Access Controls: ac677 operates strict role-based access controls (RBAC) across all internal systems. Staff members access only the player data categories required for their specific job function. Access logs are maintained and reviewed regularly for anomalies.
• Device Fingerprinting and Login Security: ac677 uses device fingerprinting to detect new device logins and alert players via SMS OTP. Repeated failed login attempts trigger a temporary account lockout to prevent brute-force access.
• Regular Security Audits: ac677 conducts regular internal security reviews and engages third-party penetration testing specialists to identify and remediate vulnerabilities in our platform infrastructure before they can be exploited.
• Staff Training: All ac677 staff who handle player data receive regular data protection and security awareness training. Unauthorised disclosure of player data by staff is a disciplinary offence and may result in immediate termination and referral to relevant authorities.

Data Breach Response: In the event of a personal data breach affecting ac677 player accounts, ac677 will: (a) contain and investigate the breach as a priority; (b) notify affected players by email within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to players' rights and interests; and (c) take all reasonable steps to prevent recurrence. Notifications will describe the nature of the breach, the categories of data affected, and the remedial steps taken.

Player Responsibilities: While ac677 takes all reasonable steps to secure your data, the security of your ac677 account also depends on the strength and confidentiality of your login credentials. ac677 strongly recommends choosing a strong, unique password and never sharing it with any other person. ac677 will never contact you by phone, email, or live chat to ask for your password or PIN.

8. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or wish to raise a concern about how ac677 has handled your personal data, please contact our Data Protection team using the details below.

Privacy and Data Protection Queries:
Email: [email protected]
Subject Line: "Privacy Policy Query" or "Privacy Rights Request"
Response Time: Acknowledged within 24 hours; full response within 5 business days
Support Hours: 24 hours a day, 7 days a week, Bangladesh Standard Time (UTC+6)

Complaints: If you are dissatisfied with ac677's response to a privacy rights request or data protection complaint, you may escalate the matter by replying to ac677's response email and requesting escalation to a senior member of the compliance team. ac677 undertakes to provide a final written response to escalated complaints within 10 business days of the escalation request.

Policy Updates: ac677 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable legal requirements. When material changes are made, ac677 will notify registered players by email and display a prominent notice on ac677.com. The effective date at the top of this document will be updated accordingly. Continued use of the ac677 platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms.

This Privacy Policy was last reviewed and updated on 1 January 2026. It applies to all personal data collected via ac677.com and the ac677 mobile platform from players across Bangladesh, including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar.