acf67 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

acf67 is an online casino and sports betting platform operating at https://acf67.io, serving players across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. acf67 is the data controller responsible for the personal data of all registered players on the platform.

As the data controller, acf67 determines the purposes and means by which your personal data is collected and processed. Where acf67 engages third-party service providers who process data on its behalf, those providers act as data processors and are bound by contractual obligations that require them to protect your data to the same standard as acf67 itself.

For all privacy-related enquiries, data access requests, and concerns, you may contact the acf67 data protection team directly at [email protected] (plain text — not a clickable link). All correspondence is handled in English and responses are provided within 5 business days, Bangladesh Standard Time (BST, UTC+6).

acf67 collects the following categories of personal data from registered players. Data is collected only to the extent necessary for the purposes described in Section 4 of this policy.

acf67 collects personal data through the following channels and mechanisms:

• Direct submission by you: Data you actively provide during account registration, KYC document upload, deposit/withdrawal requests, support communications, and account settings updates.
• Automated platform tracking: Technical data such as IP address, device fingerprint, browser type, and session data is collected automatically each time you access the acf67 platform, using server logs and session management systems.
• Cookies and similar technologies: acf67 uses first-party cookies and similar tracking technologies to maintain session state, personalise your platform experience, remember your preferences, and analyse aggregate platform usage patterns. See Section 7 for full details.
• Payment processors: When you initiate a deposit or withdrawal via bKash, Nagad, Rocket, or Upay, the relevant payment provider confirms transaction status to acf67's payment integration layer. acf67 receives confirmation data including transaction reference numbers and mobile wallet identifiers necessary to credit or debit your BDT Wallet.
• KYC and identity verification partners: Where acf67 engages third-party KYC verification services to confirm the authenticity of documents you submit, those services process your identity data and return a verification result to acf67. acf67 does not retain raw document scans beyond the minimum period required for compliance.
• Fraud detection and security services: acf67's fraud prevention systems analyse transactional and behavioural data in real time to identify patterns consistent with fraud, bonus abuse, or money laundering. This analysis is conducted using data already held by acf67 and is not shared externally for this purpose.

acf67 uses the personal data it collects for the following specific purposes. Where the legal basis for processing differs by purpose, this is noted in Section 5.

• Account creation and management: To register your account, verify your identity, maintain your profile, and enable you to log in securely to the acf67 platform.
• KYC compliance: To verify that you meet the eligibility requirements to use acf67, including the 21+ age requirement, and to comply with applicable anti-money laundering (AML) and know-your-customer (KYC) obligations.
• Payment processing: To process BDT deposits via bKash, Nagad, Rocket, and Upay; to process withdrawal requests to your registered payment method; and to maintain an accurate transaction history in your BDT Wallet.
• Platform delivery and game integrity: To deliver casino games, cricket betting markets, and all other acf67 services; to record game outcomes and settle bets accurately; and to maintain the integrity of the platform against technical failures and manipulation.
• Responsible gaming monitoring: To monitor gaming activity for indicators of problem gambling behaviour; to enforce deposit limits, session limits, cooling-off periods, and self-exclusion requests; and to fulfil acf67's duty of care to all registered players.
• Fraud prevention and security: To detect and prevent unauthorised account access, bonus abuse, multi-accounting, money laundering, and other forms of fraud or prohibited conduct as described in the acf67 Terms & Conditions.
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality assurance and compliance purposes.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive marketing communications. You may withdraw this consent at any time through your account settings or by contacting support.
• Legal compliance and reporting: To comply with applicable laws and regulations, respond to lawful requests from competent authorities, and maintain records required by applicable financial crime legislation.

acf67 processes personal data only where it has a valid legal basis to do so. The primary legal bases applicable to acf67's data processing activities are as follows:

• Contractual necessity: Processing required to fulfil acf67's obligations under the player account agreement — including account registration, payment processing, game delivery, and customer support — is carried out on the basis that it is necessary to perform the contract between you and acf67.
• Legal obligation: Processing required to comply with applicable laws — including KYC verification, AML record-keeping, age verification, and responses to lawful authority requests — is carried out on the basis of legal obligation.
• Legitimate interests: Processing conducted for fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics is carried out on the basis of acf67's legitimate interests in operating a safe and compliant platform, where those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications is carried out on the basis of your freely given, specific, and informed consent at the time of registration or subsequently through your account settings. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

acf67 does not sell, rent, or share your personal data with third parties for their own independent marketing purposes. Personal data is shared with third parties only in the following strictly defined circumstances:

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum data necessary to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and are independently regulated.
• KYC and identity verification providers: Where acf67 uses a third-party KYC service to verify identity documents submitted by players, that provider receives the relevant identity data solely for the purpose of returning a verification result to acf67.
• Game providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive a player session token and game-interaction data necessary to deliver their game content through the acf67 platform. These providers do not receive your full identity profile.
• Fraud detection and cybersecurity services: acf67 may engage third-party security providers who process technical and behavioural data on acf67's behalf to detect fraud, abuse, and security threats. These providers act as data processors under contractual data protection terms.
• Legal and regulatory authorities: acf67 will disclose personal data to competent legal or regulatory authorities where required to do so by applicable law, court order, or lawful regulatory request. acf67 will, where permitted by law, notify the affected player of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the acf67 business, player data may be transferred as part of that transaction. Affected players will be notified in advance of such a transfer and of any resulting changes to this Privacy Policy.

acf67 uses cookies and similar first-party tracking technologies on its platform. These technologies are small data files stored on your device that enable the platform to function correctly and deliver a personalised experience. acf67 does not use third-party advertising cookies or cross-site tracking technologies.

The categories of cookies used by acf67 are as follows:

• Strictly necessary cookies: These are essential for the acf67 platform to function. They maintain your login session, remember your language preference, and ensure that your BDT Wallet balance is displayed correctly. These cookies cannot be disabled without preventing the platform from functioning.
• Performance and analytics cookies: These cookies collect anonymised, aggregated data about how players use the acf67 platform — which pages are visited most frequently, where players encounter errors, and how navigation flows are used. This data is used to improve the platform experience. Individual players are not identifiable from this data.
• Functional cookies: These cookies remember your preferences — such as your preferred game category, display settings, and responsible gaming tool configurations — so that your experience is consistent across sessions.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the acf67 platform. Disabling performance or functional cookies will not prevent you from using the platform but may reduce the quality of your experience.

acf67 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Account data and KYC documents: Retained for a minimum of 5 years following the date of account closure, in compliance with applicable anti-money laundering legislation.
• Transaction records: Retained for a minimum of 5 years following the date of the transaction, in compliance with applicable financial record-keeping requirements.
• Gaming activity data: Retained for a minimum of 3 years following the date of the activity, for the purposes of dispute resolution, responsible gaming monitoring, and regulatory compliance.
• Support communications: Retained for 2 years following the resolution of the relevant support interaction, for quality assurance and dispute resolution purposes.
• Marketing preference data: Retained for 12 months from the date of last activity on your account, or until you withdraw consent to marketing communications, whichever occurs first.
• Technical and log data: IP address logs and session data are retained for 90 days for the purposes of fraud detection and platform security, after which they are automatically deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data derived from personal data may be retained indefinitely for statistical and platform improvement purposes, as it can no longer be linked to any individual player.

As a registered player on the acf67 platform, you hold the following rights in relation to the personal data acf67 holds about you. To exercise any of these rights, contact the acf67 data protection team at [email protected] (plain text — not a clickable link). All requests are processed within 5 business days at no charge.

• Right of Access
  Request a copy of all personal data acf67 holds about you.
• Right to Rectification
  Request correction of inaccurate or incomplete personal data.
• Right to Erasure
  Request deletion of your data where no legal basis for retention exists.
• Right to Restrict Processing
  Request that acf67 limits how your data is used in certain circumstances.
• Right to Data Portability
  Receive your data in a structured, machine-readable format.
• Right to Object
  Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent
  Withdraw marketing consent at any time, without affecting past processing.
• Right to Self-Exclusion
  Request permanent exclusion from the acf67 platform via support.

Please note that certain rights — particularly the right to erasure — may be limited where acf67 is required by law to retain specific data for compliance purposes, such as AML record-keeping requirements. Where a right cannot be fully exercised due to a legal obligation, acf67 will explain the specific reason in its response to your request.

acf67 implements a layered approach to data security that covers technical, organisational, and procedural controls. The following security measures are in place to protect your personal data:

• Encryption in transit: All data transmitted between your device and the acf67 platform servers is encrypted using 256-bit SSL/TLS protocols. This applies to all platform interactions including login, deposit, withdrawal, and live chat communications.
• Encryption at rest: Sensitive personal data — including identity documents, payment method identifiers, and password credentials — is encrypted at rest on acf67's servers using industry-standard encryption algorithms.
• Access controls: Access to personal data held in acf67's systems is restricted to authorised personnel who require access to perform their specific job functions. Access is controlled through role-based permissions and is subject to regular access reviews.
• Password security: Player passwords are stored exclusively as salted, hashed values. acf67 does not store plain-text passwords and cannot retrieve your password — only reset it through the verified account recovery process.
• Intrusion detection and monitoring: acf67's platform infrastructure is monitored continuously for unauthorised access attempts, anomalous activity, and potential security incidents. Security alerts are triaged by the acf67 technical team on a 24/7 basis.
• Data breach response: In the event of a confirmed personal data breach that poses a risk to affected players, acf67 will notify affected players without undue delay and will take all technically feasible steps to contain, remediate, and prevent recurrence of the breach.

While acf67 takes all reasonable technical and organisational measures to protect your personal data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your own account credentials. acf67 will never ask for your password through any channel.

The acf67 platform is strictly intended for adults aged 21 and above. acf67 does not knowingly collect personal data from individuals under the age of 21 and does not permit individuals under 21 to register accounts or use any acf67 service.

Where acf67 has reasonable grounds to believe that a registered player is under the age of 21, the account will be suspended immediately, all associated personal data will be used solely for the purpose of confirming the player's age and processing the refund of any deposited funds, and the account will be permanently closed thereafter. All data associated with the underage account will be securely deleted following closure, subject only to any minimum legal retention requirements.

If you have reason to believe that a person under the age of 21 has registered an account on the acf67 platform, please contact the acf67 support team immediately at [email protected] (plain text — not a clickable link). acf67 takes underage access concerns with the utmost seriousness and will investigate and act on all credible reports promptly.

The acf67 platform integrates with a number of third-party service providers whose products and services are necessary to deliver the acf67 platform experience. These include game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi), payment method providers (bKash, Nagad, Rocket, Upay), and technical infrastructure providers.

Where these third-party services are embedded within the acf67 platform interface — for example, live dealer game streams delivered by Evolution Gaming — those providers may collect limited technical data such as your session token and game interaction data directly. acf67 ensures, through contractual data processing agreements, that such data is used exclusively to deliver the service within the acf67 platform and not for the provider's independent purposes.

The acf67 Privacy Policy applies solely to the acf67 platform at https://acf67.io. acf67 is not responsible for the privacy practices of third-party service providers. Players who interact with third-party payment platforms such as bKash or Nagad outside of the acf67 deposit/withdrawal flow are subject to those providers' independent privacy policies.

acf67 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, changes in acf67's data processing practices, or changes to the services offered on the platform. The effective date at the top of this document is updated each time a revision is published.

Where an amendment is material — meaning it substantively affects how acf67 collects, uses, or shares your personal data — acf67 will notify all registered players by email to their registered address and by a prominent notice on the acf67 platform at least 14 days before the amendment takes effect. For amendments that require fresh consent (for example, a new marketing communications category), acf67 will seek that consent before processing begins under the new basis.

Continued use of the acf67 platform after the effective date of any amendment constitutes acknowledgement of the updated Privacy Policy. The most current version of this policy is always available at https://acf67.io/privacy-policy.

For all privacy-related matters — including data access requests, rectification requests, erasure requests, consent withdrawal, and general privacy enquiries — please contact the acf67 data protection team using the details below:

• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" to ensure prompt routing to the data protection team.
• Live Chat: Available 24/7 directly within the acf67 platform. For formal data rights requests, we recommend email to ensure a written record is maintained for your protection.
• Response time: All privacy requests are acknowledged within 24 hours and fully responded to within 5 business days, Bangladesh Standard Time (BST, UTC+6).
• Identification: To protect your data, acf67 will ask you to verify your identity before processing any data rights request. This is to ensure that personal data is disclosed only to the person it relates to.

acf67 does not charge a fee for processing data rights requests except in cases of requests that are manifestly unfounded or excessive in nature, in which case a reasonable administrative fee may be applied. acf67 will inform you in advance if a fee is applicable before processing your request.