Privacy Policy — Your Data & Rights

365ace ("we", "us", "our", or "the Platform") operates the online casino and sports betting platform accessible at https://365ace.vu. We are committed to protecting the privacy and security of the personal data belonging to all registered players and visitors to our platform, including those based in Bangladesh and other jurisdictions.

This Privacy Policy sets out in clear and precise terms: what categories of personal data 365ace collects; the purposes for which that data is processed; the legal bases that justify such processing; the parties with whom data may be shared; the period for which data is retained; the technical and organisational measures we deploy to keep your data secure; and the rights available to you as a data subject.

This Policy applies to all data processing activities conducted by 365ace in connection with the operation of the platform, including account registration, identity verification, payment processing, customer support, marketing communications (where you have opted in), and responsible gambling compliance. It does not apply to third-party websites or services that may be linked to or integrated with the 365ace platform — those third parties operate under their own privacy arrangements.

365ace collects personal data in the following categories, depending on how you interact with the platform:

We collect only the data that is necessary for the specific purposes described. We do not collect sensitive categories of personal data such as biometric data, health data, racial or ethnic origin, religious beliefs, or political opinions, except where a verification document incidentally contains such information (in which case it is not stored separately or processed for that purpose).

365ace collects personal data through the following channels and mechanisms:

• Direct input at registration: When you create a 365ace account, you provide identity and contact data directly through the registration form.
• Account activity: As you use the platform — placing bets, depositing funds, playing casino games, contacting support — we record usage and transaction data automatically.
• Identity verification submissions: When you submit documents for KYC verification, we receive and process those documents and the data contained within them.
• Payment processors: When you transact via bKash, Nagad, Rocket, Upay, or any other supported payment method, transaction confirmation data is shared with us by the payment provider.
• Cookies and tracking technologies: Our platform uses cookies, web beacons, and similar technologies to collect technical and usage data automatically when you access the site. See Section 9 for full details.
• Third-party verification providers: Where we use external identity verification or fraud-detection services, those services may return data to us as part of the verification workflow.
• Correspondence: If you contact us via live chat, email, or WhatsApp, we retain a record of that communication.

365ace processes your personal data for the following specific purposes:

• Account creation and management: To register your account, verify your identity and age, maintain your account settings, and communicate account-related information to you.
• Service delivery: To provide access to sports betting markets, casino games, crash games, and all other features of the 365ace platform, and to process your bets and gaming activity accurately.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard, and to maintain accurate financial records of all transactions.
• Regulatory and legal compliance: To comply with anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, responsible gambling obligations, and any other applicable legal or regulatory requirements.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account takeover, identity theft, bonus abuse, and other security threats to the platform and its players.
• Responsible gambling: To monitor gameplay patterns for signs of problem gambling behaviour and, where appropriate, to intervene proactively with player safety measures including deposit limits and self-exclusion enforcement.
• Customer support: To respond to your enquiries, resolve complaints, and provide technical assistance.
• Platform improvement: To analyse aggregated usage data and improve the performance, reliability, and user experience of the 365ace platform.
• Marketing communications: Where you have provided explicit consent, to send you information about promotions, bonuses, and new features. You may withdraw consent at any time by contacting support.

365ace does not use your personal data for automated decision-making that produces significant legal effects without human review, except in standard fraud-detection scoring workflows where a flagged account is always subject to manual review before any action is taken.

Every data processing activity conducted by 365ace is grounded in one of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and 365ace — including account registration, game access, and payment processing — is carried out because it is necessary to deliver the services you have requested.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML, KYC, age verification, and regulatory reporting obligations.
• Legitimate interests: Processing carried out in pursuit of 365ace's legitimate business interests — such as fraud prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily for direct marketing communications. You have the right to withdraw consent at any time, which will not affect the lawfulness of processing carried out prior to withdrawal.

365ace does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment service providers: Financial transaction data is shared with bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard as necessary to process your deposits and withdrawals.
• Identity verification providers: Identity and document data is shared with third-party KYC and AML screening services to fulfil our verification obligations.
• Game content providers: Technical session identifiers are shared with game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — solely for the purpose of delivering their games within the 365ace platform. These providers do not receive your full identity or financial data.
• IT infrastructure and cloud providers: Operational data is processed by hosting and infrastructure providers under strict data processing agreements that prohibit independent use of your data.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory direction, 365ace will disclose personal data to the relevant authority. We will notify you of such a disclosure to the extent permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the 365ace business, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the privacy terms applicable to it before it occurs.

365ace retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the full duration of your account relationship with 365ace, plus a minimum of five (5) years following account closure to satisfy AML record-keeping obligations.
• Transaction records: Financial transaction records are retained for a minimum of seven (7) years in accordance with standard financial record-keeping requirements.
• Identity verification documents: Retained for five (5) years following account closure, or longer if required by applicable regulatory obligations at the time of closure.
• Customer support communications: Retained for three (3) years from the date of the communication, unless the subject matter is connected to an ongoing dispute, investigation, or legal proceeding.
• Marketing consent records: Retained for the duration of the consent period plus three (3) years as evidence of consent, even after consent has been withdrawn.
• Technical and log data: Typically retained for twelve (12) months for security and fraud analysis purposes, after which it is anonymised or deleted.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised aggregate data may be retained indefinitely for analytical purposes.

365ace implements robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• SSL/TLS encryption: All data transmitted between your device and the 365ace platform is encrypted in transit using industry-standard SSL/TLS protocols.
• Encryption at rest: Sensitive data fields — including payment details and identity document records — are encrypted at the database level using AES-256 encryption.
• Access controls: Access to personal data within 365ace is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and audited.
• Two-factor authentication: Internal system access for 365ace staff requires multi-factor authentication. Players are also strongly encouraged to enable two-factor authentication on their accounts.
• Regular security assessments: The platform undergoes periodic security reviews and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, 365ace will notify affected players without undue delay and will take all reasonable steps to contain and remediate the incident.

While 365ace takes every reasonable precaution to protect your data, no system is entirely immune to risk. You are responsible for keeping your account credentials confidential and for notifying 365ace immediately if you suspect any unauthorised access to your account.

365ace uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used by 365ace:

• Strictly necessary cookies: These are essential for the platform to function. They enable core features such as session management, account authentication, and security. These cookies cannot be disabled without preventing you from using the platform.
• Functional cookies: These remember your preferences — such as language settings and display options — to provide a more personalised experience. Disabling them may affect some platform features.
• Analytics cookies: These collect aggregated, anonymised data about how visitors use the platform — which pages are visited most, where users drop off, and how navigation flows. This information is used solely to improve the platform.
• Security and fraud-detection cookies: These help us identify unusual access patterns and protect your account from automated attacks and fraudulent activity.

365ace does not use third-party advertising cookies or behavioural tracking cookies that profile you for targeted advertising purposes on other websites. Most web browsers allow you to control cookies through their settings. Restricting strictly necessary cookies will impair platform functionality; restricting other cookie types will not prevent you from using the core service.

As a data subject, you have the following rights in relation to your personal data held by 365ace. To exercise any of these rights, contact us using the details in Section 14. We will respond to all valid requests within 30 days.

• Right of access: You may request a copy of the personal data we hold about you, together with information about how it is being processed.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected.
• Right to erasure: In certain circumstances, you may request that we delete your personal data. This right is subject to limitations where retention is required by law (e.g., AML record-keeping obligations).
• Right to restriction of processing: You may request that we restrict processing of your personal data in certain circumstances, such as while a dispute about its accuracy is resolved.
• Right to data portability: Where processing is based on your consent or contractual necessity, you may request that we provide your personal data to you in a structured, machine-readable format.
• Right to object: Where processing is based on legitimate interests, you may object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

365ace is an adults-only platform. We do not knowingly collect personal data from any person under the age of 18. If we become aware that an account has been registered by or on behalf of a minor, that account will be immediately closed, all associated personal data will be deleted, and any funds held will be handled in accordance with our Terms & Conditions.

If you are a parent or guardian and you believe your child has registered an account with 365ace, please contact us immediately using the details in Section 14. We will investigate and take appropriate action without delay.

The 365ace platform integrates services provided by third-party game studios, payment processors, and technical infrastructure providers. While these integrations are necessary to deliver the full 365ace experience, each third-party provider operates under its own privacy policy and data practices, which are independent of this Policy.

365ace does not control and is not responsible for the privacy practices of third-party providers. We select our partners carefully and require them to maintain appropriate data protection standards through contractual obligations. However, we encourage you to review the privacy policies of any third-party service you interact with independently through the 365ace platform.

This Policy does not apply to any website or service that is not directly operated by 365ace, even if a link to that service appears on our platform.

365ace may update this Privacy Policy from time to time to reflect changes in our data practices, changes in applicable law, or improvements to the platform. Material changes will be communicated to registered players via the contact method on file, and the revised Policy will be published on this page with an updated effective date at the top of the document.

Your continued use of the 365ace platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any change to this Policy, you must discontinue use of the platform and contact support to close your account. We recommend reviewing this page periodically to stay informed of how 365ace handles your personal data.

If you have any questions about this Privacy Policy, wish to exercise a privacy right, or have a concern about how 365ace has handled your personal data, please contact the 365ace Data & Privacy team through the following channels:

• Live Chat: Available 24/7 from inside your account dashboard. Select "Privacy / Data Request" as the enquiry type.
• Email: support at 365ace.vu — please include "Privacy Request" in the subject line.
• WhatsApp: Available 08:00 – 00:00 BST (UTC+6). State that your message relates to a data privacy matter.

We aim to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 30 calendar days of receiving a valid, verified request. Complex requests may require additional time; in such cases, we will notify you of the extended timeline.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the appropriate data protection authority in your jurisdiction.