Privacy Policy — How rc77 Protects Your Data

This Privacy Policy (hereinafter referred to as the "Policy") describes how rc77 (hereinafter referred to as "rc77", "we", "us", or "the Platform") collects, uses, stores, shares, and protects the personal data of individuals who access or use the rc77 online casino and sports betting platform at https://rc77.io, including all associated subdomains, mobile interfaces, and related digital services (collectively, the "Platform").

This Policy applies to all users of the rc77 Platform, including registered players, account applicants, and visitors who browse the Platform without registering. By accessing the Platform or registering an account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read alongside the rc77 Terms & Conditions, which are incorporated into this Policy by reference. Together, these documents form the complete legal framework governing your use of the rc77 Platform.

For the purposes of applicable data protection legislation, rc77 acts as the data controller in respect of the personal data collected through the Platform. As data controller, rc77 determines the purposes for which and the means by which personal data is processed.

All inquiries, requests, or complaints relating to the processing of your personal data should be directed to the rc77 Data Privacy team using the contact details set out in Section 13 of this Policy. We are committed to responding to all data-related communications within a reasonable timeframe and in accordance with applicable obligations.

rc77 collects personal data through several channels, including directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party service providers involved in delivering Platform services. The categories of personal data we collect are set out below.

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (to verify that you meet the minimum age requirement of 21 years)
• Email address (used as your primary account identifier and communication channel)
• Residential address, including city, district, and postal code
• Mobile phone number (used for two-factor authentication and account security alerts)
• Username and encrypted account password

3.2 Identity Verification (KYC) Data

• Scanned or photographed copy of your National Identity Card (NID) or passport
• Selfie photograph taken alongside the submitted identity document
• Proof of residential address (utility bill, bank statement, or official correspondence dated within the last three months)
• Proof of payment method ownership (e.g., screenshot of registered bKash or Nagad account)

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts (in ৳), timestamps, and payment method identifiers
• bKash, Nagad, Rocket, Upay, or bank account reference numbers associated with transactions
• Bonus credits, wagering activity, and promotional redemption history
• Running account balance history

3.4 Gameplay & Betting Data

• Game session records, including games played, bet amounts, outcomes, and session durations
• Sports betting market selections, stake amounts, and settlement outcomes
• Responsible gaming tool usage (deposit limits set, self-exclusion periods, time-out activations)

3.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser version
• Session log data, including login timestamps and navigation activity within the Platform
• Cookie and similar tracking technology data (see Section 7 for full details)

3.6 Communications Data

• Records of live chat conversations, email correspondence, and support ticket interactions with the rc77 customer support team
• Feedback and survey responses submitted voluntarily through the Platform

rc77 uses the personal data it collects for the following specific purposes. We process your data only where a lawful basis exists for doing so (see Section 5).

rc77 does not use personal data for automated decision-making processes that produce legal or similarly significant effects on players, except where required by law or explicitly disclosed in connection with specific platform features.

rc77 processes your personal data only where a valid legal basis exists. The legal bases on which rc77 relies are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and rc77 — including account creation, payment processing, gameplay delivery, and withdrawal processing.
• Legal Obligation: Processing that is required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and fraud prevention mandates.
• Legitimate Interests: Processing that is necessary for rc77's legitimate business interests, including platform security, fraud detection, abuse prevention, and improvement of Platform services, provided these interests are not overridden by your rights and interests.
• Consent: Processing for purposes that are not strictly necessary for the performance of the contract — such as sending promotional communications, offers, and personalised bonus notifications — where rc77 relies on your explicit consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

rc77 does not sell, rent, or trade your personal data to any third party. Data is shared externally only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive transactional data necessary to process deposits and withdrawals on your behalf. These providers are bound by their own privacy and security obligations.
• Identity Verification Partners: Third-party KYC and AML service providers may process identity documents and verification data on rc77's behalf. All such providers operate under strict data processing agreements.
• Game Content Providers: Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive session identifiers and anonymised gameplay data to facilitate game delivery and resolve technical disputes. These providers do not receive your full personal profile.
• Customer Support Tools: Third-party live chat and support ticketing platforms may process your communications data on rc77's behalf to facilitate customer service interactions.
• Legal & Regulatory Authorities: rc77 may disclose personal data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or in response to a legally valid request.
• Business Transfers: In the event of a merger, acquisition, or transfer of rc77's business assets, personal data held by rc77 may be transferred to the acquiring entity, subject to that entity assuming the same data protection obligations as described in this Policy.

rc77 uses cookies and similar tracking technologies on the Platform to enhance user experience, maintain session state, and collect analytical data about Platform usage. A cookie is a small text file placed on your device when you visit the Platform.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the operation of the Platform. They enable core functions such as user authentication, session management, and security. These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform, including which pages are visited most frequently and whether error messages are received. This data helps rc77 improve Platform performance.
• Functional Cookies: These cookies allow the Platform to remember your preferences and settings — such as your preferred language or previously selected game categories — to provide a more personalised experience.
• Marketing Cookies: With your consent, rc77 may use cookies to deliver promotional content that is relevant to your interests based on your activity on the Platform. You may opt out of marketing cookies at any time.

7.2 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or receive a warning before a cookie is stored. Please note that disabling strictly necessary cookies may prevent you from accessing certain areas of the rc77 Platform or impair account functionality.

rc77 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with rc77, plus a minimum period of five (5) years following account closure to satisfy AML and legal record-keeping obligations.
• KYC & Identity Documents: Retained for a minimum of five (5) years following the closure of your account or the completion of the relevant KYC verification process, as required by applicable financial regulations.
• Transaction Records: Retained for a minimum of five (5) years following each transaction, in compliance with financial record-keeping requirements.
• Customer Support Records: Communications data is retained for a period of three (3) years following the resolution of each support interaction, to facilitate audit and dispute resolution processes.
• Technical & Session Logs: Typically retained for up to twelve (12) months, except where specific records are required in connection with an ongoing security investigation or legal matter.
• Marketing Preferences: Retained until you withdraw consent for marketing communications or for a period of two (2) years from your last Platform activity, whichever is earlier.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents recovery or re-identification.

rc77 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• SSL/TLS Encryption in Transit: All data transmitted between your device and the rc77 servers is encrypted using industry-standard SSL/TLS protocols, preventing interception by unauthorised third parties.
• AES-256 Encryption at Rest: Sensitive personal data stored on rc77 servers — including identity documents and payment references — is encrypted using AES-256, the same standard used by leading financial institutions worldwide.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. rc77 employees and contractors who handle personal data are bound by confidentiality obligations and receive regular data protection training.
• Two-Factor Authentication: rc77 offers two-factor authentication for all player accounts, providing an additional layer of security beyond password protection.
• Intrusion Detection & Monitoring: The Platform operates real-time intrusion detection systems and security monitoring protocols to identify and respond to potential threats without delay.
• Penetration Testing: rc77 conducts regular third-party penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

As a user of the rc77 Platform, you hold the following rights in relation to the personal data that rc77 holds about you. To exercise any of these rights, please contact the rc77 Data Privacy team at [email protected] with the subject line "Data Privacy Request".

• Right of Access: You have the right to request a copy of the personal data rc77 holds about you, along with information about how it is being used. Requests will be fulfilled within 30 days of receipt.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data held about you. Many basic account details can be updated directly through your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully. This right is subject to rc77's legal obligations to retain certain records.
• Right to Restriction of Processing: You may request that rc77 temporarily restrict the processing of your personal data — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where rc77 relies on legitimate interests as its legal basis. You also have an unconditional right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The rc77 Platform is strictly intended for adults aged 21 and above. rc77 does not knowingly collect, process, or retain personal data from individuals under the age of 21. The collection of data from minors is strictly prohibited, and rc77 takes active steps to prevent it through its mandatory age verification process during registration.

If rc77 becomes aware that personal data has been collected from a person under the age of 21 — whether through a misrepresentation at registration or any other means — it will immediately suspend the relevant account, delete the collected data to the extent permitted by law, and refer the matter for investigation. Any funds deposited by an underage user will be handled in accordance with applicable legal requirements.

Parents and guardians who believe that a minor in their care has registered on the rc77 Platform should contact the support team immediately at [email protected].

rc77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. When material changes are made, rc77 will update the "Effective Date" at the top of this Policy and, where the changes are significant, notify registered players via email or in-platform notification.

Your continued use of the rc77 Platform following the publication of any revised Privacy Policy constitutes your acknowledgement of the changes and your agreement to be bound by the updated terms. If you do not agree with any amendment to this Policy, you should cease using the Platform and contact the support team to arrange account closure.

rc77 recommends reviewing this Privacy Policy periodically to stay informed about how your personal data is being protected. The date at the top of this page always reflects the most recent version.

If you have any questions, concerns, or complaints about this Privacy Policy or about how rc77 handles your personal data, please contact our Data Privacy team using the details below. All communications are handled in English, 24 hours a day, 7 days a week.

• Email: [email protected] — please include "Data Privacy Request" in the subject line
• Live Chat: Available 24/7 from within your rc77 account dashboard
• Response Time: Acknowledgement within 72 hours; full response within 30 calendar days