Privacy Policy — How ace35 Collects, Uses, and Protects Your Data

1 Who We Are

ace35 operates an online casino and sports betting platform accessible at ace35.io, serving players across Bangladesh including Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. For the purposes of this Privacy Policy, "ace35", "we", "us", and "our" refer to the operator of the ace35 platform. "You" and "your" refer to any registered player, prospective player, or visitor who accesses or uses the ace35 platform.

ace35 acts as the data controller in respect of the personal data you provide and that is generated through your use of the platform. As data controller, ace35 is responsible for determining the purposes for which and the means by which your personal data is processed.

2 Information We Collect

ace35 collects personal data through several channels: directly from you when you register an account or complete verification, automatically through your use of the platform, and in certain cases from third-party sources such as payment processors and identity verification providers. The categories of personal data we collect are described below.

2.1 Registration Data

When you create an ace35 account, we collect your full legal name, date of birth, residential address, email address, and the mobile number associated with your preferred payment method (such as bKash, Nagad, Rocket, or Upay). You will also create a username and password, which are stored in encrypted form.

2.2 Identity Verification (KYC) Data

Before processing withdrawal requests, and in certain cases before accepting deposits above specified thresholds, ace35 applies Know Your Customer (KYC) verification. This may require you to submit copies of a government-issued photo ID (National Identity Card, passport, or driver's licence), proof of residential address (utility bill or bank statement dated within 90 days), and proof of payment method ownership. These documents are stored securely and used solely for verification purposes.

2.3 Financial Transaction Data

We collect records of all deposits and withdrawals made through your ace35 Wallet, including transaction amounts in Bangladeshi Taka (BDT / ৳), timestamps, payment method references (e.g., bKash transaction IDs, Nagad reference numbers, bank transfer confirmations), and transaction status. Full payment card or mobile banking account credentials are never stored directly by ace35 — see Section 6 for details.

2.4 Gameplay and Betting Data

We collect records of your activity on the platform, including casino game sessions (game title, provider, stake, outcome, RTP achieved), sports betting activity (market selected, odds, stake, settlement result), session durations, and responsible gaming tool usage (deposit limits set, cooling-off periods activated, self-exclusion requests).

2.5 Technical and Device Data

When you access the ace35 platform, we automatically collect certain technical information, including your IP address, device type and operating system, browser type and version, referring URL, pages viewed, and session duration. This data is used for platform security, fraud prevention, and service optimisation.

2.6 Communications Data

If you contact the ace35 support team — via live chat, email, or any other channel — we retain records of those communications, including the content of your messages, timestamps, and any attachments you provide. This data is used for support quality assurance, dispute resolution, and fraud investigation purposes.

3 How We Use Your Data

ace35 uses the personal data we collect for the following purposes:

ace35 does not use your personal data for automated decision-making that produces significant legal effects without human review. Where automated checks are applied (for example, initial fraud-flag screening), any decision that adversely affects your account will be reviewed by a human member of the ace35 compliance team before action is taken.

4 Legal Basis for Processing

ace35 processes your personal data on one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual necessity: Processing that is necessary to perform the contract between you and ace35 — including account registration, deposits, withdrawals, game delivery, and Loyalty Program operation.
• Legal obligation: Processing that is required to comply with applicable legal or regulatory obligations, including anti-money laundering (AML) checks, KYC verification, and cooperation with lawful authority requests.
• Legitimate interests: Processing that is necessary for ace35's legitimate business interests, provided those interests are not overridden by your rights — including fraud prevention, platform security, service improvement, and responsible gaming monitoring.
• Consent: Where we rely on your consent as the legal basis (for example, for optional marketing communications), you have the right to withdraw that consent at any time by contacting the support team at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5 Data Sharing and Disclosure

ace35 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We share your personal data only in the following limited and controlled circumstances:

5.1 Game Providers

To deliver casino games and live dealer services, ace35 shares session-level data with licensed game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. The data shared is limited to session tokens, stake amounts, and game outcomes — no full KYC documents or payment credentials are shared with game providers.

5.2 Payment Processors

To process deposits and withdrawals, ace35 shares the minimum necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, and other supported payment partners. These providers handle payment data under their own privacy policies and security standards.

5.3 Identity Verification Providers

ace35 may engage specialist third-party KYC and identity verification service providers to assist in the verification of documents submitted by players. These providers process your KYC data solely on our behalf and under strict data processing agreements that prohibit any use of your data beyond the scope of the verification service.

5.4 Legal and Regulatory Authorities

ace35 may disclose personal data to relevant authorities, law enforcement bodies, or other third parties when required to do so by law, court order, or where disclosure is necessary to prevent or detect fraud, money laundering, or other criminal conduct. In such circumstances, ace35 will disclose only the minimum data necessary to satisfy the applicable legal obligation.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of ace35's assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material changes to data handling practices that result from it.

6 Payment Data

ace35 takes particular care with the handling of financial data. When you make a deposit or request a withdrawal using bKash, Nagad, Rocket, Upay, or a bank transfer, the actual processing of the payment is handled by the relevant payment service provider. ace35 receives a transaction confirmation and reference number from the provider but does not store your full mobile banking PIN, bank account password, or complete payment credentials.

Transaction records stored by ace35 — including deposit and withdrawal amounts in BDT, timestamps, and payment reference numbers — are retained for a minimum of five years in accordance with financial record-keeping obligations. These records are used solely for account management, dispute resolution, and regulatory compliance purposes.

7 Cookies and Tracking Technologies

ace35 uses cookies and similar tracking technologies to operate the platform, improve user experience, and support security functions. A cookie is a small text file placed on your device when you visit the ace35 platform. Cookies allow the platform to recognise your browser across sessions and to retain certain preferences.

7.1 Types of Cookies We Use

• Essential cookies: Required for core platform functionality, including maintaining your logged-in session, securing your account, and processing transactions. These cookies cannot be disabled without preventing the platform from functioning correctly.
• Functional cookies: Used to remember your preferences and settings, such as your preferred language and responsible gaming tool configurations.
• Analytics cookies: Used to understand how players interact with the ace35 platform, which pages are most frequently visited, and where technical issues occur. Analytics data is aggregated and anonymised where possible.
• Security cookies: Used to detect and prevent fraudulent activity, including bot traffic, unusual login patterns, and suspicious account behaviour.

7.2 Managing Cookies

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the performance of the ace35 platform and may prevent some features from functioning correctly. Detailed instructions for managing cookies are available in your browser's help documentation. Essential and security cookies cannot be disabled as they are necessary for the safe operation of your account.

8 Data Retention

ace35 retains your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, and in any event for the minimum periods required by applicable legal and regulatory obligations. The general retention periods applied by ace35 are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, it may be retained indefinitely in aggregated form for statistical and analytical purposes, as it can no longer be used to identify any individual player.

9 Data Security

ace35 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the ace35 platform is encrypted using industry-standard Secure Socket Layer (SSL) / Transport Layer Security (TLS) protocols. You can verify this by checking for the padlock icon in your browser's address bar.
• Password hashing: Account passwords are stored using one-way cryptographic hashing algorithms. ace35 staff cannot view your plain-text password under any circumstances.
• Two-step verification: Players are strongly encouraged to enable two-step verification (2SV) within their account security settings. When enabled, a one-time code is required in addition to your password each time you log in from an unrecognised device.
• Access controls: Access to personal data within the ace35 organisation is restricted to staff who require it to perform their job functions. All access is logged and audited on a regular basis.
• Intrusion detection: The ace35 platform is monitored continuously for suspicious activity, including unusual login patterns, automated bot behaviour, and indicators of account compromise.
• Vendor security standards: Third-party service providers who process data on ace35's behalf are required to maintain security standards comparable to those applied by ace35, as confirmed through contractual obligations.

Notwithstanding these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and interests, ace35 will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

10 Your Rights

As a player whose personal data is processed by ace35, you hold the following rights in relation to your data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". ace35 will acknowledge your request within 3 business days (Bangladesh Standard Time) and aim to provide a substantive response within 30 days.

• Right of access: You have the right to request a copy of the personal data that ace35 holds about you, together with information about how it is used and with whom it is shared.
• Right to rectification: You have the right to request that inaccurate or incomplete personal data held about you be corrected. For registration data, you may update certain fields directly within your account profile; other corrections require a support request.
• Right to erasure: You may request that ace35 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that this right is subject to ace35's legal retention obligations — we cannot delete data we are required by law to retain.
• Right to restriction: You have the right to request that ace35 restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is contested or while a complaint is under investigation.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on ace35's legitimate interests, including profiling for fraud prevention purposes. ace35 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

11 Children and Minors

The ace35 platform is strictly restricted to individuals who are 21 years of age or older. ace35 does not knowingly collect or process personal data relating to individuals under the age of 21. If you become aware that a minor has registered an account or provided personal data to ace35, please notify the support team at [email protected] immediately. Upon confirmation, ace35 will close the account, delete all associated personal data, and return any balance held in accordance with our verification findings.

ace35 applies age verification checks during the registration and KYC process precisely to prevent underage access to the platform. Players who provide false date-of-birth information at registration in order to circumvent the age restriction are in breach of the ace35 Terms & Conditions and may have their account suspended and balance forfeited.

12 Third-Party Links

The ace35 platform may contain references to or integrations with third-party services, including game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) and payment partners (bKash, Nagad, Rocket, Upay). While ace35 selects its service providers carefully, we are not responsible for the privacy practices of third-party services that you access independently of the ace35 platform. When you interact directly with a third-party service, that service's own privacy policy governs the handling of your data.

13 Policy Amendments

ace35 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Where a material change is made to this Policy, ace35 will notify registered players via a platform notification or an email to the registered account address at least 7 days before the change takes effect, except where an immediate update is required to address a security risk or legal obligation.

The effective date displayed at the top of this Policy will be updated to reflect the date on which the most recent version came into force. Your continued use of the ace35 platform after the stated effective date of any amended Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. We encourage you to review this Policy periodically to stay informed about how ace35 protects your personal information.

14 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, the personal data ace35 holds about you, or how that data is processed, please contact our privacy team through the following channels:

• Email: [email protected] — use subject line "Privacy Request — [Your Username]"
• Live Chat: Available 24/7 within the ace35 platform after login — target response time under 15 minutes.
• Support Hours: 24 hours a day, 365 days a year, operating on Bangladesh Standard Time (BST, UTC+6).

ace35 is committed to resolving all privacy-related enquiries promptly and transparently. If you believe that ace35 has not adequately addressed your privacy concern, you retain the right to raise the matter through any applicable consumer protection or data protection channels available to you under the laws of Bangladesh.