ace4 Privacy Policy — How We Protect Your Data

ace4 is the data controller responsible for the personal information collected from players who access and use the ace4 online casino and sports betting platform at ace4.app. As data controller, ace4 determines the purposes and means by which your personal data is processed in connection with the delivery of its gambling services to players in Bangladesh.

All data protection queries, rights requests, and privacy-related complaints should be directed to the ace4 privacy support channel at [email protected]. ace4 aims to acknowledge all privacy-related communications within 48 hours of receipt and to provide a substantive response within 30 calendar days.

This Privacy Policy applies to all personal data processed by ace4 in connection with the ace4 website, mobile-optimised platform, customer support communications, and promotional campaigns. It does not apply to the privacy practices of third-party game providers, payment processors, or other external services whose own privacy policies govern their independent data processing activities.

ace4 collects personal data only to the extent necessary for the lawful and effective delivery of its gambling services, compliance with applicable legal obligations, and the protection of the platform against fraud and misuse. The data we collect falls into the following categories:

2.1 Sensitive Personal Data

ace4 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data except where strictly required by law or where you voluntarily provide such information in a support communication. Where sensitive data is received, it is handled with additional care and is not used for any purpose other than the specific purpose for which it was provided.

2.2 Data Collected from Minors

ace4 does not knowingly collect personal data from individuals under 18 years of age. If ace4 determines that a player account belongs to a person under 18, all personal data associated with that account will be securely deleted in accordance with the underage account procedures described in the ace4 Terms & Conditions. If you believe a minor has registered on ace4, please notify us immediately at [email protected].

ace4 uses the personal data it collects for the following specific purposes. In each case, the use is tied to a clear legal basis described in Section 4 of this Privacy Policy.

3.1 Account Registration and Management

Identity data, contact data, and account credentials collected during registration are used to create and maintain your ace4 player account, enable you to log in securely, deliver account-related notifications (including withdrawal confirmations, bonus credits, and security alerts), and communicate with you regarding your account status.

3.2 Identity and Age Verification (KYC)

Identity documents such as your National Identity Card or passport are used to verify that you are at least 18 years old and that the information you provided at registration matches your legal identity. KYC verification is also conducted to confirm that the payment methods registered on your account are registered in your own name, as required by anti-money laundering obligations.

3.3 Payment Processing

Financial data, including your bKash, Nagad, Rocket, or bank account details, is used to process deposits into your ace4 account and to execute withdrawal requests back to your verified payment method. ace4 shares the minimum necessary financial data with payment processors to complete each transaction.

3.4 Service Delivery and Platform Personalisation

Gaming data and technical data are used to deliver the betting and casino services you have requested, to maintain the security and integrity of the platform, to identify and investigate suspicious activity, and to personalise your platform experience — for example, by remembering your language and display preferences.

3.5 Responsible Gaming

Account and gaming data — including session frequency, deposit patterns, and win/loss ratios — are monitored by ace4 as part of its responsible gaming obligations to identify players who may be exhibiting signs of problem gambling behaviour. Where such patterns are identified, ace4 may contact the player with information about self-exclusion tools and support resources available in Bangladesh.

3.6 Marketing and Promotions

Where you have provided consent, ace4 may use your contact data (mobile number or email address) to send you information about relevant promotions, bonuses, and seasonal offers — such as BPL season betting promotions, Eid bonus campaigns, or T20 World Cup special offers. You may withdraw this consent at any time by contacting support at [email protected]. Withdrawal of marketing consent does not affect your ability to use the ace4 Services.

3.7 Legal and Regulatory Compliance

ace4 processes personal data where required to comply with applicable legal obligations, including anti-money laundering requirements, fraud prevention obligations, and responses to lawful requests from relevant authorities. In such cases, legal compliance overrides consent as the basis for processing.

ace4 processes your personal data only where a valid legal basis for doing so exists. The legal bases on which ace4 relies for the processing activities described in this Privacy Policy are as follows:

• Contractual necessity: Processing required to create and manage your player account, process deposits and withdrawals, deliver the betting and casino services you have requested, and communicate with you regarding your account. Without this processing, ace4 cannot provide the Services to you.
• Legal obligation: Processing required to comply with anti-money laundering obligations, age verification requirements, fraud reporting duties, and any other applicable legal or regulatory requirements. ace4 does not require your consent for this processing — it is mandatory.
• Legitimate interests: Processing for fraud detection, platform security, abuse prevention, responsible gaming monitoring, and improvement of the ace4 platform, where such interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications (promotional emails, SMS notifications about bonuses and offers). You may withdraw this consent at any time without affecting your right to use the Services.

Where ace4 relies on legitimate interests as the legal basis for processing, a balancing test is conducted to ensure that the interests pursued do not outweigh your fundamental privacy rights. If you wish to object to processing conducted on the basis of legitimate interests, please contact us at [email protected].

ace4 does not sell your personal data to any third party. ace4 shares personal data with external parties only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

5.1 Payment Processing Partners

To process your deposits and withdrawals, ace4 shares the minimum necessary transaction and identity data with the relevant payment service providers, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and Visa/Mastercard processing networks. These providers are independent data controllers for the data they receive and their own privacy policies govern their use of that data.

5.2 Game Technology Providers

Game providers integrated into the ace4 platform — including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Ezugi — may receive session and game-play data necessary to deliver the game functionality you are using. This data sharing is limited to what is technically required and governed by ace4's contracts with those providers, which include appropriate data protection obligations.

5.3 Identity Verification Services

For KYC purposes, ace4 may use third-party identity verification service providers to confirm the authenticity of documents you submit. These providers process your identity documents in accordance with their own certified security standards and are contractually bound to use the data only for the verification purpose.

5.4 Legal and Regulatory Authorities

ace4 may disclose personal data to law enforcement agencies, regulatory bodies, or other public authorities where required to do so by applicable law, a valid court order, or a legitimate law enforcement request. In such cases, ace4 will disclose only the data specifically requested and will inform you of the disclosure where legally permitted to do so.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of ace4's business, personal data held about players may be transferred to the acquiring entity as part of the transaction. In such circumstances, ace4 will take reasonable steps to ensure that the acquiring entity is bound by privacy obligations consistent with this Privacy Policy, and will notify affected players of any material change in how their data is handled.

The ace4 website uses cookies and similar tracking technologies to enable the platform to function correctly, to remember your preferences, and to help ace4 understand how the website is used. This section explains the types of cookies used and how you can manage them.

6.1 Types of Cookies Used by ace4

6.2 Managing Cookies

You can manage or disable cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies from specific websites. Note that disabling strictly necessary cookies will prevent the ace4 platform from functioning correctly — you will not be able to log in or conduct transactions with these cookies disabled. Disabling functional or analytics cookies will not prevent you from using the core Services but may affect platform personalisation and session continuity.

6.3 Third-Party Cookies

Some ace4 game integrations — particularly live casino streams from Evolution Gaming and Pragmatic Play Live — may set their own technical cookies required for the delivery of the game content. ace4 does not control these third-party cookies and recommends that you review the relevant game provider's privacy policy if you have concerns about their use of cookies.

ace4 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal obligations. The following retention periods apply to the main categories of personal data held by ace4:

• Account and identity data: Retained for the lifetime of your active ace4 account, plus a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years following each transaction, in accordance with financial record-keeping obligations applicable to payment service-adjacent platforms operating in Bangladesh.
• KYC documents: Retained for the lifetime of your account plus five (5) years following closure. Where documents are submitted but the account is never activated (e.g., failed verification), documents are deleted within 90 days of the failed verification outcome.
• Gaming and betting records: Retained for five (5) years following account closure, for dispute resolution, regulatory compliance, and responsible gaming record purposes.
• Support communications: Retained for three (3) years following the closure of the relevant support ticket or dispute, after which they are securely deleted or anonymised.
• Marketing consent records: Retained for the lifetime of your account or until consent is withdrawn, whichever is earlier — plus one (1) year thereafter as evidence of consent.
• Analytics and technical data: Anonymised within 24 months of collection. Once anonymised, the data no longer constitutes personal data and is no longer subject to this Privacy Policy.

At the end of each applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with ace4's internal data disposal procedures. No personal data subject to a retention obligation will be deleted prematurely in response to a deletion request — in such cases, ace4 will explain to the requesting player which data must be retained and for how long.

To exercise any of the rights listed above, please contact ace4 at [email protected] with the subject line "Data Rights Request" and include your registered ace4 username, your Bangladesh mobile number, and a clear description of the right you wish to exercise. ace4 may need to verify your identity before processing the request to ensure the request is made by the account holder.

ace4 implements a range of technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures are regularly reviewed and updated in line with industry best practices for online gambling platforms.

9.1 Technical Safeguards

All data transmitted between players and the ace4 platform is protected using TLS 1.2 or higher encryption. Player passwords are stored using industry-standard one-way hashing algorithms — ace4 support staff cannot view your password, only reset it. Payment credentials for bKash, Nagad, and Rocket transactions are processed via the providers' own secure API channels and are not stored on ace4 servers.

Access to ace4's internal systems and databases is restricted to authorised personnel only, on a need-to-know basis. All internal access is logged and subject to regular security audit review. ace4 deploys firewall protections, intrusion detection systems, and rate-limiting controls to protect against automated attacks on player accounts.

9.2 Organisational Safeguards

All ace4 staff with access to player personal data are subject to confidentiality obligations as a condition of their engagement. Access rights are reviewed regularly and revoked promptly upon a staff member's departure or change of role. ace4 conducts regular internal training on data protection obligations and incident response procedures.

9.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, ace4 will take immediate steps to contain and remediate the breach and will notify affected players without undue delay, providing details of the nature of the breach, the data affected, and the steps players should take to protect themselves.

9.4 Your Role in Account Security

While ace4 takes all reasonable steps to protect your personal data, the security of your account also depends on the steps you take to protect your login credentials. ace4 strongly recommends that all players:

• Use a strong, unique password for your ace4 account that is not shared with any other website or service
• Never share your ace4 username or password with any third party, including individuals claiming to represent ace4 support
• Log out of your ace4 account after each session, particularly when using a shared or public device
• Contact ace4 support immediately at [email protected] if you suspect that your account has been accessed by an unauthorised person
• Never respond to unsolicited communications requesting your ace4 password, OTP codes, or payment PINs — ace4 will never ask for these via email, SMS, or live chat

The ace4 platform integrates third-party game content from providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. While ace4 takes care to partner with reputable providers who maintain appropriate data protection standards, these providers operate their own systems and are subject to their own privacy policies. ace4 is not responsible for the privacy practices of third-party game providers, payment processors, or any other external service accessed through the ace4 platform.

ace4 does not include outbound links to external websites for advertising or affiliate marketing purposes. Any links present on the ace4.app domain point exclusively to internal pages of the ace4 platform. If you navigate away from ace4.app to a third-party website by any means, the privacy policy of that third-party site governs your interaction with it, not this Privacy Policy.

Payment providers such as bKash, Nagad, Rocket, and Upay are independent companies operating under their own privacy policies and security standards as regulated by Bangladesh Bank. ace4 has no control over how these providers process the data they independently collect from you when you use their services to deposit or withdraw funds, and encourages you to review their respective privacy policies directly.

ace4 reserves the right to update or amend this Privacy Policy at any time to reflect changes in its data processing practices, changes in applicable law or regulatory guidance, the introduction of new platform features, or any other reason at ace4's reasonable discretion. The updated policy will always be published at ace4.app/privacy-policy with a revised effective date displayed prominently at the top of the document.

Where a change to this Privacy Policy is material — meaning it significantly affects how ace4 processes your personal data or reduces your privacy rights — ace4 will endeavour to notify registered players via the mobile number or email address associated with their account at least 14 days before the change takes effect. For minor, non-material changes such as typographical corrections or clarifications of existing practices, the updated policy will take effect immediately upon publication without specific notice.

Your continued use of the ace4 platform after a revised Privacy Policy has been published constitutes your acceptance of the revised terms. If you do not agree with the revised Privacy Policy, you should stop using the ace4 Services and may request account closure in accordance with the account closure procedures described in the ace4 Terms & Conditions. Any personal data already collected prior to your account closure will continue to be retained for the applicable statutory retention periods as described in Section 7 above.

ace4 recommends that all players review this Privacy Policy periodically to stay informed about how their personal data is being used and protected. The version history of this Privacy Policy, showing the effective dates of previous versions, is available upon request from ace4 support.

All privacy queries and data rights requests should be submitted in English to [email protected] with the subject line "Privacy Query" or "Data Rights Request" as appropriate. Please include your registered ace4 username and Bangladesh mobile number in all privacy-related communications so that ace4 can verify your identity and locate your account records efficiently.

ace4 aims to acknowledge all privacy-related communications within 48 hours of receipt during normal business hours (Bangladesh Standard Time, UTC+6), and to provide a full substantive response within 30 calendar days. Where a request is complex or involves a high volume of data, the response period may be extended by a further 30 days with written notice to you explaining the reason for the extension.

If you are not satisfied with ace4's response to your privacy complaint or data rights request, you may escalate the matter to ace4's senior privacy review team by replying to the original response and clearly indicating that you wish to escalate. Escalated privacy complaints will be reviewed independently and a final written decision will be provided within 20 business days of the escalation being received.