ra77 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how ra77 ("we", "us", "our", "the Platform") collects, uses, discloses, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the ra77 website at https://ra77.io, including all associated games, sportsbook markets, payment services, live chat support, and promotional features.

ra77 is committed to handling your personal data with the highest standards of care, transparency, and security. This Policy is written in plain formal English and constitutes part of the legal framework governing your use of the ra77 platform, alongside the Terms and Conditions and the Responsible Gaming Policy, both of which are incorporated herein by reference.

By registering an account, making a deposit, or otherwise accessing the ra77 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not consent, you must discontinue use of the platform immediately.

Data Controller

For the purposes of this Privacy Policy, ra77 acts as the data controller in respect of personal data collected through the ra77 platform. As data controller, ra77 determines the purposes and means by which your personal data is processed.

All enquiries, requests, or complaints relating to the processing of your personal data should be directed to the ra77 Data Protection contact via the support channels listed in Section 15 of this Policy. ra77 will acknowledge all data-related communications within two (2) business days of receipt.

Personal Data We Collect

ra77 collects personal data across several categories, each of which serves a defined operational or legal purpose. The categories of personal data we collect are as follows:

3.1 Identity Data

• Full legal name as it appears on your government-issued identity document
• Date of birth
• Gender (where provided voluntarily)
• National Identity Card (NID) number or passport number, collected during KYC verification
• Photographs or scans of identity documents submitted for verification purposes

3.2 Contact Data

• Email address (used for account communications, transaction receipts, and support)
• Bangladeshi mobile phone number (used for account security and support channels)
• City or district of residence within Bangladesh (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar), collected voluntarily

3.3 Financial Data

• Mobile wallet identifiers (bKash, Nagad, Rocket, Upay account numbers associated with your transactions)
• Bank account details where bank transfer is used as a deposit or withdrawal method
• Transaction history including deposit amounts, withdrawal amounts, dates, and method references
• Partial card numbers (last 4 digits only) where Visa or Mastercard is used

3.4 Gaming Activity Data

• Game session records including games played, wager amounts, outcomes, and session durations
• Sportsbook betting history including markets selected, stake amounts, and settlement results
• Bonus and promotion usage records
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

3.5 Technical Data

• IP address at the time of each login and transaction
• Device type, operating system, and browser version
• Cookie identifiers and session tokens (see Section 8)
• Geolocation data at the time of login, derived from IP address
• Platform access logs including timestamps and navigation patterns

3.6 Communications Data

• Live chat transcripts and email correspondence with ra77 support
• Feedback, complaint, and dispute records
• Opt-in and opt-out records for marketing communications

How We Collect Your Data

ra77 collects personal data through the following channels and mechanisms:

• Direct provision: Data you supply when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions.
• Automated collection: Technical and usage data collected automatically when you access the platform, including via cookies, server logs, and session tracking technologies.
• Third-party providers: Identity and age verification data received from third-party KYC service providers upon submission of identity documents. Payment confirmation data received from bKash, Nagad, Rocket, Upay, and bank partners to confirm deposit and withdrawal transactions.
• Game providers: Session data received from licensed game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi necessary to credit winnings, resolve disputes, and maintain game integrity.

Purpose & Legal Basis for Processing

The table below sets out the purposes for which ra77 processes your personal data and the legal basis relied upon for each processing activity.

Data Sharing with Third Parties

ra77 does not sell, rent, or trade personal data to any third party. Data is shared only in the following limited and necessary circumstances:

6.1 Service Providers

ra77 engages trusted third-party service providers who process personal data on our behalf under contractual data processing agreements. These include identity verification and KYC service providers, payment processing partners (bKash, Nagad, Rocket, Upay, Visa/Mastercard acquiring banks), game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi), cloud hosting and infrastructure providers, and customer support platform providers. All such providers are bound by strict confidentiality and data security obligations.

6.2 Legal and Regulatory Disclosure

ra77 may disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or legitimate legal process. ra77 will notify affected players of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of ra77's business assets, personal data held by ra77 may be transferred to a successor entity. Players will be notified of any such transfer and of any changes to this Privacy Policy that arise as a result, with a minimum notice period of 30 days before any transfer takes effect.

Payment Data & Financial Privacy

ra77 takes the security of financial data with particular seriousness. All transactions on the platform are denominated in Bangladeshi Taka (৳ BDT). The following principles govern how payment data is handled:

• ra77 does not store full payment card numbers or CVV codes. Card data is processed exclusively by our PCI-DSS-certified payment partners.
• Mobile wallet identifiers (bKash, Nagad, Rocket, Upay numbers) are stored in encrypted form and are used solely to route withdrawal payments back to the correct player account.
• Bank account details provided for wire transfer withdrawals are encrypted at rest and in transit and are accessible only by ra77's payment operations team on a need-to-know basis.
• Transaction records — including deposit amounts, withdrawal amounts, dates, and method references — are retained for a minimum of five (5) years as required for AML compliance and financial audit purposes.

Cookies & Tracking Technologies

ra77 uses cookies and similar tracking technologies to operate the platform effectively, maintain your session state, detect fraudulent activity, and improve platform performance. The categories of cookies used are as follows:

8.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. They maintain your login session, store your language preferences, and protect against cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without preventing you from using the platform.

8.2 Analytical Cookies

ra77 uses anonymised analytical cookies to understand how players navigate the platform, which features are most used, and where technical errors occur. This data is aggregated and is not linked to individual player identities. You may opt out of analytical cookies via your browser settings.

8.3 Fraud Detection Cookies

Certain cookies and device fingerprinting technologies are used to detect and prevent account fraud, multi-account creation, and automated bot activity. These are considered strictly necessary for platform security and cannot be disabled.

Data Retention

ra77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following standard retention periods apply:

Once the applicable retention period expires, personal data is either securely deleted using industry-standard deletion protocols or irreversibly anonymised such that it can no longer be linked to any individual.

Data Security

ra77 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your browser and ra77 servers
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment identifiers
• Role-based access control (RBAC) ensuring that staff can only access personal data relevant to their specific job function
• Multi-factor authentication (MFA) required for all ra77 staff accessing systems that contain personal data
• Intrusion detection and prevention systems (IDS/IPS) monitoring for anomalous access patterns in real time
• Regular penetration testing conducted by independent third-party security firms on a scheduled basis
• Full audit logging of all access events involving personal player data, reviewed by ra77's security team

In the event of a personal data breach that poses a risk to your rights and freedoms, ra77 will notify affected players without undue delay and will take all reasonably practicable steps to contain and remediate the breach.

Your Data Rights

As a player on the ra77 platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact the ra77 support team using the details in Section 15. ra77 will respond to all verified requests within 30 calendar days.

Right of Access

You have the right to request a copy of all personal data that ra77 holds about you. This is sometimes called a Subject Access Request (SAR). ra77 will provide a structured, machine-readable export of your data upon verified request.

Right to Rectification

If any personal data ra77 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Certain data fields (such as your registered name) can only be corrected through the KYC re-verification process to maintain identity integrity.

Right to Erasure

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing and there is no overriding legitimate interest. Note that ra77 is required by law to retain certain categories of data (e.g., AML transaction records) for defined minimum periods even after account closure, during which erasure requests for those categories cannot be fulfilled.

Right to Restrict Processing

You may request that ra77 restricts the processing of your personal data in certain circumstances — for example, while a correction request is being evaluated, or where you have objected to processing pending verification of legitimate grounds.

Right to Data Portability

Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).

Right to Object

You have the right to object to the processing of your personal data where ra77 relies on legitimate interests as the legal basis. ra77 will cease processing upon receipt of a valid objection unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Minors & Age Protection

The ra77 platform is strictly intended for individuals aged 21 years and above. ra77 does not knowingly collect or process personal data belonging to individuals under the age of 21. If ra77 becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed.

Parents and guardians who believe that a minor has registered on or accessed the ra77 platform should contact support immediately at [email protected] (plain text — not a clickable link). ra77 will investigate and take appropriate action within 24 hours of such a report.

International Data Transfers

In order to deliver its services, ra77 may transfer your personal data to servers or service providers located outside Bangladesh. Such transfers may occur in connection with our cloud hosting infrastructure, game studio data feeds, or international payment processing networks.

Where personal data is transferred internationally, ra77 takes steps to ensure that an adequate level of protection is applied to that data, consistent with the protections described in this Policy. This may include entering into contractual data protection clauses with recipient entities, or relying on recognised frameworks for international data transfers.

All international data transfers by ra77 are governed by the same security, access control, and retention standards described in this Policy, regardless of the geographic location of the processing.

Changes to This Privacy Policy

ra77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. The "Last updated" date at the top of this document will be revised on each update.

Where changes to this Policy are material — meaning they significantly affect how your personal data is collected, used, or shared — ra77 will notify you by email to your registered address and by a prominent notice on the platform at least 14 days before the changes take effect.

Your continued use of the ra77 platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you must cease using the platform and may request account closure by contacting support.

Contact Us About Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ra77, please reach out through any of the following channels:

• Live Chat: Available 24/7 inside your ra77 account dashboard — select "Privacy / Data Request" as the subject when prompted
• WhatsApp: Available Sunday–Thursday, 09:00–22:00 BST (UTC+6)
• Email: [email protected] — please include "Privacy Request" in your subject line (plain text address — not a clickable link)

ra77 acknowledges all privacy-related enquiries within two (2) business days and aims to provide a substantive response within 30 calendar days of receiving a verified request. For complex requests, ra77 may extend this period by a further 30 days, in which case you will be notified of the extension and the reason for it.