au777 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy applies to all personal data collected, stored, and processed by au777 in connection with the operation of the au777 online casino and sports betting platform accessible at au777.onl. It governs data collected through:

• Account registration and profile management on the au777 platform.
• All financial transactions including deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and other supported payment methods.
• Gameplay activity across casino games, live dealer tables, sports betting markets, and specialty games.
• Customer support communications submitted via email, live chat, or any other contact channel.
• Participation in promotions, tournaments, loyalty programmes, and bonus offers.
• Browsing and navigational behaviour on the au777 website and any associated mobile interfaces.

This policy should be read alongside our Terms & Conditions, which together form the full legal framework governing the relationship between au777 and its Players. In the event of any conflict between this Privacy Policy and the Terms & Conditions, the Terms & Conditions shall prevail to the extent of the inconsistency.

au777 is committed to processing personal data in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, integrity and confidentiality. We apply these principles consistently across all Player accounts regardless of the Player's location within Bangladesh — whether in Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, Cox's Bazar, or any other region.

For the purposes of this Privacy Policy, au777 acts as the data controller in respect of all personal data collected from Players. As data controller, au777 determines the purposes for which and the manner in which personal data is processed. All data-related enquiries, access requests, correction requests, and deletion requests should be directed to:

• Contact Method: Email only
• Support Email: [email protected]
• Response Time: Within 5 business days for standard data requests; within 24 hours for urgent security-related matters
• Operating Hours: 24 hours a day, 7 days a week (Bangladesh Standard Time, UTC+6)

Where au777 engages third-party service providers — such as game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, Spribe) or payment processing partners — those providers operate as data processors acting under written data processing agreements that bind them to confidentiality and security obligations consistent with this policy.

au777 collects personal data in three primary ways: data you provide directly, data generated automatically through your use of the platform, and data received from third-party payment or verification providers. The categories of data collected are as follows:

3.1 Data You Provide Directly

• Full legal name as it appears on your government-issued identity document.
• Date of birth (used to verify the 21+ age requirement mandatory for all Players).
• Email address used for account communications, promotional offers (where opted in), and security alerts.
• Mobile phone number, primarily used for account verification and two-factor authentication.
• Residential address including district, division, and postcode within Bangladesh.
• National ID number, passport number, or driving licence number submitted for KYC identity verification.
• Payment method identifiers including bKash account number, Nagad account number, bank account number, or mobile banking reference numbers used for deposit and withdrawal processing.
• Self-reported responsible gaming preferences including deposit limits, session time limits, and cooling-off or self-exclusion requests.

3.2 Data Generated Automatically

• IP address and approximate geolocation derived from IP at the time of login and during active sessions.
• Device identifiers including device type, operating system version, browser type and version, and screen resolution.
• Session data including login timestamps, session duration, pages visited, game titles launched, bet amounts placed, and outcomes recorded.
• Cookies and similar tracking technologies as described in Section 8 of this policy.
• Technical error logs and debugging data generated when platform errors occur during your session.

3.3 Data Received from Third Parties

• Identity verification results from KYC document checking services engaged by au777 to validate submitted documents.
• Transaction confirmation records from payment providers confirming the status, amount, and timestamp of deposit and withdrawal transactions.
• Risk signals from fraud prevention and anti-money-laundering (AML) screening services where applicable to high-value or unusual transaction patterns.

au777 processes your personal data only for specific, documented purposes. The table below outlines each processing purpose, the data categories involved, and the lawful basis on which au777 relies for that processing:

au777 does not use automated decision-making processes — including profiling — that produce legal or similarly significant effects on Players without human oversight. Where automated tools are used to flag potentially problematic gambling behaviour or suspicious transaction patterns, a qualified compliance officer reviews the output before any account action is taken.

au777 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Data is shared only in the following strictly defined circumstances:

• Game Providers: Studios such as Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Ezugi, and Spribe receive the minimum Player session data technically necessary to deliver their games within the au777 platform (typically a session token and anonymised Player ID). These providers do not receive your full name, national ID, or payment details.
• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and City Bank receive only the transaction-specific data required to process a deposit or withdrawal — such as the amount, your registered payment account identifier, and a transaction reference number.
• Identity Verification Services: Third-party KYC providers receive copies of documents you submit for identity verification. These providers are bound by data processing agreements and are prohibited from using your documents for any purpose other than completing the verification check commissioned by au777.
• Fraud and AML Screening Tools: Where required, anonymised or pseudonymised transaction and session data may be shared with fraud prevention services to identify risk patterns. No personally identifiable data is shared unless a confirmed fraud or money-laundering investigation requires it.
• Law Enforcement and Regulatory Authorities: au777 will disclose personal data to law enforcement agencies or regulatory authorities where required to do so by applicable law, a valid court order, or a lawful regulatory request. In such cases, au777 will disclose only the minimum data legally required and will notify the affected Player where permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of assets involving au777, Player data may be transferred to the acquiring entity as part of that transaction. Affected Players will be notified by email in advance of any such transfer that materially changes how their data is handled.

All third-party processors engaged by au777 are subject to written data processing agreements that require them to implement security measures at least equivalent to those described in Section 7 of this policy and to process Player data only for the purposes specified by au777.

au777 retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply:

• Account Data (name, email, address, date of birth): Retained for the duration of the active account relationship and for a period of five (5) years following account closure, to satisfy record-keeping obligations and to handle any post-closure disputes or regulatory enquiries.
• KYC Documents (national ID, passport, proof of address): Retained for five (5) years from the date of submission, or five (5) years from the date of account closure, whichever is later. This retention period reflects standard AML record-keeping requirements.
• Transaction Records (deposit and withdrawal history): Retained for seven (7) years from the date of the transaction. This extended period reflects financial record-keeping standards applicable to online gaming platforms.
• Customer Support Communications: Retained for three (3) years from the date the support ticket was closed.
• Session and Gameplay Logs: Retained for two (2) years from the date of the session. Anonymised aggregated analytics data derived from these logs may be retained indefinitely.
• Marketing Consent Records: Retained for the duration of the active marketing relationship plus two (2) years following opt-out, to evidence the history of consent and withdrawal.
• Self-Exclusion Records: Retained for a minimum of seven (7) years regardless of account status, to prevent circumvention of self-exclusion by re-registration.

At the expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be attributed to any identifiable individual. Backup copies of data are subject to the same deletion schedules, applied within 90 days of the live data deletion date.

au777 implements a multi-layered security architecture to protect Player personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The primary security measures in place include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your browser or app and the au777 servers is encrypted using 256-bit SSL/TLS protocol — the same standard applied by major international banking institutions. This protects your login credentials, payment details, and personal information from interception during transmission.
• Encrypted Data-at-Rest: Sensitive personal data stored in au777's databases, including KYC documents and payment identifiers, is encrypted at rest using AES-256 encryption to protect against unauthorised access at the storage layer.
• Access Controls: Access to Player personal data within au777's internal systems is restricted on a strict need-to-know basis. Staff members are assigned the minimum data access permissions required to perform their specific role. All internal data access events are logged for audit purposes.
• Two-Factor Authentication: au777 offers two-factor authentication (2FA) to all registered Players as an additional layer of account security. Players are strongly encouraged to enable 2FA via the account security settings panel.
• Regular Security Audits: au777's platform infrastructure is subject to periodic internal security reviews and, where applicable, independent third-party penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Procedures: In the event of a data breach that affects Player personal data, au777 has established incident response procedures that include containment, assessment, notification, and post-incident review. Affected Players will be notified by email within 72 hours of au777 becoming aware of a confirmed breach that poses a risk to their rights.

While au777 takes all reasonable technical and organisational measures to protect your data, no online platform can guarantee absolute security against all possible threats. Players are encouraged to use a strong, unique password for their au777 account and to enable two-factor authentication as described in our Terms & Conditions.

au777 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and gather anonymised analytics data to improve the player experience. The categories of cookies used on the au777 platform are as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They maintain your authenticated login session, store your language and currency preferences, and ensure security features such as CSRF protection operate correctly. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred game lobby view, table limits, and responsible gaming settings — so that you do not need to re-configure them on every visit. Disabling functional cookies may result in a less personalised experience.
• Analytics Cookies: These cookies collect anonymised, aggregated data about how Players navigate the platform — which pages are visited most frequently, where sessions typically begin and end, and which game categories attract the most engagement. This data is used exclusively to improve platform design and content. No individual Player is identifiable from this analytics data.
• Performance Cookies: These cookies help au777 identify and resolve technical performance issues by tracking page load times, error rates, and server response metrics. The data is aggregated and anonymised.

au777 does not use third-party advertising cookies or behavioural tracking cookies that share your browsing data with external advertisers. The platform does not serve banner advertisements from third-party ad networks.

Most web browsers allow you to control cookie settings through the browser preferences menu. You may set your browser to refuse cookies, or to alert you when cookies are being set. Please note that disabling strictly necessary cookies will prevent you from logging into your au777 account and accessing the full platform. Instructions for managing cookie settings in common browsers are available through the help documentation of your browser provider.

As a Player whose personal data is processed by au777, you hold the following rights in respect of your data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered username and a description of the right you wish to exercise.

• Right of Access: You have the right to request a copy of all personal data au777 holds about you. au777 will provide this in a structured, commonly used format within 30 days of receiving a valid request.
• Right to Rectification: If any personal data held by au777 is inaccurate or incomplete, you have the right to request that it be corrected. Identity-critical data corrections (such as name or date of birth changes) may require supporting documentation for verification purposes.
• Right to Erasure: In certain circumstances, you may request that au777 delete your personal data. This right is subject to retention obligations described in Section 6 — au777 cannot delete data it is legally required to retain for AML, KYC, or financial record-keeping purposes even following an erasure request.
• Right to Restriction of Processing: You may request that au777 restrict the processing of your personal data in specific circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: You have the right to receive personal data you have provided to au777 in a machine-readable format (such as JSON or CSV) and, where technically feasible, to have that data transmitted directly to another controller.
• Right to Object: Where processing is based on legitimate interests, you have the right to object to that processing. au777 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or the processing is required for legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (such as promotional email communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

au777 will respond to all valid data rights requests within 30 days. Where a request is complex or numerous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

au777 sends promotional communications — including bonus offers, tournament invitations, seasonal promotions tied to events such as Eid, Pohela Boishakh, Victory Day (December 16), the BPL, IPL, and T20 World Cup — only to Players who have explicitly opted in to marketing communications during or after the account registration process.

If you have opted in to marketing communications but subsequently wish to unsubscribe, you may do so by:

• Clicking the "Unsubscribe" link included in the footer of every promotional email sent by au777.
• Updating your communication preferences in the notification settings section of your au777 account dashboard.
• Submitting a written unsubscribe request to [email protected] with the subject line "Unsubscribe Request".

Unsubscribe requests are processed within 5 business days. Please note that even after unsubscribing from promotional communications, you will continue to receive transactional and account-related communications (such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts) as these are required for the delivery of the service under your account agreement.

The au777 platform is strictly for adults aged 21 and above. au777 does not knowingly collect personal data from any individual under the age of 21. The 21+ age requirement is enforced through the mandatory date-of-birth field during account registration and through the KYC identity verification process which requires submission of a government-issued photo ID.

If au777 discovers at any point that a Player account is held by an individual under the age of 21, the account will be immediately suspended, all funds held in the account will be frozen pending a review, and all personal data associated with the account will be deleted as soon as it is no longer required for the purposes of the investigation and any related legal obligations.

If you believe that an individual under 21 has registered an account on the au777 platform, please report this immediately to [email protected]. We will investigate all such reports as a matter of priority.

au777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or platform features. When material changes are made, au777 will:

• Update the "Effective Date" displayed at the top of this page and in the document details sidebar.
• Notify registered Players by email to the address associated with their account at least seven (7) days before the revised policy takes effect.
• Display a prominent notice on the au777 platform homepage for the seven-day notification period.

Your continued use of the au777 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes to this policy, you should cease using the platform and may request account closure along with withdrawal of any remaining real-money balance by contacting our support team.

The current version of this Privacy Policy is always accessible at au777.onl/privacy-policy. Players are encouraged to revisit this page periodically to stay informed of how their personal data is being handled.

For any questions, concerns, or formal requests relating to this Privacy Policy or the handling of your personal data by au777, please use the following contact details:

• Contact Email: [email protected] (plain text — not a clickable link)
• Subject Line for Data Requests: "Data Rights Request — [Your Username]"
• Subject Line for Privacy Complaints: "Privacy Complaint — [Your Username]"
• Response Commitment: Acknowledgement within 24 hours; substantive response within 5 business days for general queries; within 30 days for formal data rights requests
• Support Hours: 24 hours a day, 7 days a week
• Time Zone: Bangladesh Standard Time (BST, UTC+6)

When submitting a data rights request, please include your registered username and a clear description of the specific right you wish to exercise or the concern you wish to raise. Providing sufficient detail at the outset allows our team to process your request as efficiently as possible.