Privacy Policy — How va8 Protects Your Personal Data

va8 collects personal data from you through multiple points of interaction with our platform. The categories of data collected, and the circumstances in which they are collected, are set out below.

1.1 Registration Data

When you create a va8 account, we collect the following information, which is necessary to establish and manage your account:

• Full legal name — used for identity verification and payment matching;
• Email address — used for account communications, security alerts, and (with your consent) promotional messages;
• Bangladesh mobile number — used for SMS-based two-factor authentication and mobile wallet payment processing;
• Date of birth — used for mandatory age verification to confirm you are 18 years of age or older;
• Username — your chosen display identifier on the platform;
• Password — stored exclusively as a salted cryptographic hash; va8 staff cannot access or recover your plaintext password.

1.2 Identity Verification (KYC) Data

To comply with our Know Your Customer (KYC) obligations and prevent underage gambling and financial crime, va8 may request the following documentary evidence from you:

• A copy of a government-issued photo identity document such as a Bangladesh National Identity Card (NID), passport, or driver's licence;
• Proof of address such as a recent utility bill, bank statement, or mobile financial services statement issued in Bangladesh;
• Proof of payment method ownership (e.g., a screenshot of your registered bKash or Nagad account showing the account holder name matches your va8 registration);
• In some cases, a recent selfie photograph alongside your identity document to perform a liveness check.

KYC documents are stored securely and are not used for any purpose other than identity verification and regulatory compliance. They are never shared with third-party marketers.

1.3 Financial Transaction Data

When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, or bank transfer, va8 records transaction data including the transaction reference number, amount in BDT, date and time (Bangladesh Standard Time, UTC+6), payment method used, and transaction status. va8 does not store full payment account credentials — mobile wallet PINs and bank account passwords are never transmitted to or stored by va8.

1.4 Betting and Gaming Activity Data

va8 maintains a full log of your platform activity, including every bet placed, game session initiated, deposit and withdrawal made, bonus claimed, and responsible gaming tool activated. This data is used for account management, dispute resolution, fraud detection, and responsible gaming monitoring. It is retained for the periods described in Section 6 of this policy.

1.5 Technical and Device Data

When you visit va8.org, our servers automatically collect certain technical information, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, time spent on each page, and session duration. This data is used for platform security, fraud detection, performance optimisation, and aggregate analytics.

1.6 Communications Data

If you contact va8 via live chat or email ([email protected]), we retain records of those communications, including the content of your messages, timestamps, and the resolution outcome. These records are used to improve our support quality, resolve disputes, and maintain an audit trail of customer interactions.

3.1 Service Providers

va8 works with a limited number of trusted third-party service providers who process personal data strictly on our behalf and under our instructions. These providers include:

• Payment processors — bKash, Nagad, Rocket, and Upay process your mobile wallet transaction data as independent data controllers under their own privacy policies. Bank transfer data is processed by the relevant Bangladesh financial institution.
• KYC and identity verification providers — va8 may use a third-party identity verification service to assist with document checks. All such providers are contractually bound to process your data only for the purpose of KYC verification.
• Game software providers — Casino game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data necessary for game delivery, fairness auditing, and technical support. These providers do not receive your personal identity or financial data.
• Cloud infrastructure and hosting providers — va8's platform is hosted on secure cloud infrastructure. Our hosting provider has access to server-level data only and is contractually prohibited from processing it for any independent purpose.
• Customer support tooling — Our live chat support system may store transcripts of your support conversations in a third-party helpdesk platform. This data is used solely for support quality and dispute resolution purposes.

3.2 Legal Disclosures

va8 may disclose your personal data to government authorities, law enforcement agencies, financial intelligence units, or regulatory bodies where we are legally required to do so, including in response to a valid legal order, court order, or regulatory investigation. va8 will comply with all lawful disclosure requirements and will notify you where legally permitted to do so.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of va8's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer via platform notification and email prior to the transfer taking effect, and you will be given the opportunity to close your account and request data deletion before the transfer occurs.

5.1 Technical Security Measures

va8 implements a comprehensive set of technical security controls to protect the personal data of all Bangladesh players on our platform:

• SSL/TLS Encryption: All data transmitted between your browser and va8.org is encrypted using 256-bit SSL/TLS. The padlock icon in your browser's address bar confirms that your connection is secure.
• Data Encryption at Rest: Sensitive data stored in va8's databases, including identity documents and financial records, is encrypted at rest using AES-256 encryption.
• Password Hashing: Your account password is never stored in plaintext. It is stored exclusively as a salted bcrypt hash. Even in the unlikely event of a data breach, your plaintext password cannot be recovered from our stored data.
• Two-Factor Authentication (2FA): va8 strongly recommends enabling SMS-based 2FA on your account, which provides a critical additional layer of protection against unauthorised access even if your password is compromised.
• Access Controls: Internal access to personal data is strictly restricted to va8 personnel with a legitimate operational need. All internal data access is logged and audited.
• Regular Security Audits: va8 conducts periodic security assessments, including vulnerability scans and penetration testing, to proactively identify and address potential weaknesses in our systems.

5.2 Data Breach Response

Despite our robust security measures, no online platform can guarantee absolute security against all possible threats. In the event of a personal data breach that poses a risk to the rights and freedoms of affected users, va8 will assess the breach, take immediate containment measures, and notify affected users via email as promptly as possible. The notification will describe the nature of the breach, the data affected, the likely consequences, and the steps va8 is taking to address it.

5.3 Your Responsibility for Account Security

You play a critical role in keeping your va8 account secure. va8 recommends the following best practices for all Bangladesh players:

• Use a strong, unique password for your va8 account that is not shared with any other online service;
• Enable SMS-based two-factor authentication via your account security settings;
• Never share your login credentials with any other person, including family members;
• Log out of your va8 account after each session, especially on shared or public devices;
• Be vigilant against phishing attempts — va8 will never ask for your password via email, live chat, or any other channel.