baggo Privacy Policy

1. Introduction

baggo ("we", "us", "our", or "the Platform") is committed to protecting the privacy and security of all personal data that we collect and process in connection with the operation of the baggo online gaming and sports betting platform. This Privacy Policy ("Policy") sets out the legal basis on which we process your personal data, the categories of data we hold, the purposes for which that data is used, and the rights you hold as a data subject.

This Policy applies to all users of the baggo website and any associated mobile applications or services (collectively, "the Platform"), including registered account holders, prospective players who browse the Platform without registering, and individuals who contact baggo's support team. This Policy should be read alongside the baggo Terms & Conditions.

This Policy was last reviewed and updated on 1 January 2026. We encourage you to review this Policy periodically. Where material changes are made, we will notify registered account holders by email or via a prominent notice on the Platform prior to the change taking effect.

2. Personal Data We Collect

baggo collects the following categories of personal data in connection with the operation of its services:

2.1 Identity Data

Full legal name, date of birth, gender, and copies of government-issued identity documents such as your National Identity Card (NID), Passport, or Driving Licence. This data is collected during the account registration and Know Your Customer (KYC) verification process.

2.2 Contact Data

Email address, mobile phone number, and residential postal address. This data is used to communicate with you about your account, transactions, and platform updates.

2.3 Financial Data

Payment method details sufficient to process deposits and withdrawals (e.g., bKash wallet number, Nagad account reference, Rocket number, Upay account identifier, bank account details, or masked card numbers). baggo does not store full payment card numbers — card processing is handled by PCI-DSS compliant payment processors.

2.4 Transaction Data

Records of all deposits, withdrawals, bets placed, game sessions, bonus credits and redemptions, and related financial activity on your baggo account. Transaction records are retained for a minimum of five years for financial compliance purposes.

2.5 Technical Data

IP address, device type and model, operating system, browser type and version, screen resolution, time zone, session duration, pages visited, and clickstream data. This data is collected automatically when you access the Platform and is used for security monitoring, fraud detection, and platform optimisation.

2.6 Communications Data

Records of communications between you and baggo's support team, including live chat transcripts, email correspondence, and any documents you submit in connection with a complaint, verification request, or responsible gaming interaction.

3. How We Collect Your Data

baggo collects personal data through the following channels:

• Direct submission: Data you provide when completing registration forms, submitting KYC documents, making a deposit or withdrawal request, or contacting support.
• Automated collection: Technical and usage data collected automatically via cookies, web server logs, and similar tracking technologies when you browse or interact with the Platform.
• Third-party sources: Identity verification data returned by KYC service providers; fraud and sanctions screening data from compliance data providers; and payment transaction confirmations from payment processors including bKash, Nagad, Rocket, and Upay.
• Publicly available sources: In limited circumstances, information from public registers or publicly accessible sources may be used to supplement identity or address verification.

4. Why We Use Your Personal Data

baggo processes your personal data only where a lawful basis exists for doing so. The table below sets out the primary purposes for which we process personal data and the corresponding legal basis for that processing:

Processing Purpose	Data Categories Used	Lawful Basis
Account registration and management	Identity, Contact	Contractual necessity
Identity and age verification (KYC)	Identity, Contact	Legal obligation; contractual necessity
Processing deposits and withdrawals	Financial, Transaction	Contractual necessity
Fraud prevention and security monitoring	Technical, Transaction, Identity	Legitimate interests; legal obligation
Responsible gaming monitoring and interventions	Transaction, Communications	Legal obligation; legitimate interests
Customer support and complaint resolution	Identity, Contact, Communications	Contractual necessity; legitimate interests
Platform analytics and improvement	Technical	Legitimate interests
Marketing communications (opted-in users only)	Contact	Consent
Legal and regulatory compliance	All categories as required	Legal obligation

Where baggo relies on legitimate interests as the legal basis for processing, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object to processing carried out on the basis of legitimate interests — see Section 9 for details.

5. Sharing Your Personal Data

baggo does not sell your personal data to third parties. We share personal data only in the following limited circumstances:

5.1 Service Providers

baggo engages third-party service providers to assist with platform operations, including payment processors (bKash, Nagad, Rocket, Upay, and banking partners), KYC and identity verification providers, fraud and sanctions screening services, IT infrastructure and hosting providers, and customer support platforms. All service providers are bound by contractual data-processing agreements that restrict them to processing data solely on baggo's documented instructions and for no other purpose.

5.2 Legal and Regulatory Disclosure

baggo may disclose your personal data to law enforcement agencies, financial intelligence units, courts, or regulatory bodies where required or permitted by applicable law, including in connection with the investigation of fraud, money laundering, or other financial crime. Where legally permissible, baggo will attempt to notify you of such disclosure before it occurs.

5.3 Business Transfers

In the event that baggo undergoes a merger, acquisition, or sale of all or a substantial portion of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to how your data is processed that result from it.

5.4 With Your Consent

baggo will share your personal data with third parties outside the categories described above only with your prior explicit consent, which you may withdraw at any time by contacting [email protected].

6. Data Retention

baggo retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. The following minimum retention periods apply:

• Account and identity data: Retained for the lifetime of your account plus a minimum of five years following account closure, in compliance with applicable financial record-keeping requirements.
• Transaction records: Retained for a minimum of five years from the date of the transaction.
• KYC documents: Retained for a minimum of five years from account closure or the date of the last transaction, whichever is later.
• Support communications: Retained for three years from the date of the last communication in a support thread.
• Technical and log data: Retained for up to 12 months, after which it is anonymised or deleted.
• Marketing consent records: Retained for as long as you remain opted in, plus one year following opt-out to evidence the withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with baggo's internal data disposal procedures.

7. Data Security

baggo implements technical and organisational measures appropriate to the sensitivity of the data we process. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the baggo Platform.
• Encryption of sensitive data fields at rest, including stored payment references and identity document images.
• Secure password hashing using modern cryptographic algorithms; baggo staff cannot view your plaintext password.
• Role-based access controls ensuring that baggo staff can access personal data only to the extent necessary for their specific job function.
• Automated fraud detection and intrusion detection systems that monitor Platform activity in real time.
• Regular security reviews and vulnerability assessments of Platform infrastructure.
• Staff training on data protection and information security responsibilities.

While baggo takes all reasonable precautions to safeguard your data, no system is completely immune to security threats. You are responsible for maintaining the confidentiality of your account credentials and for notifying baggo promptly at [email protected] if you suspect that your account has been compromised.

8. Cookies & Tracking Technologies

baggo uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These enable you to log in, maintain a session, and navigate between pages. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences, such as language settings and display options, to provide a more personalised experience across sessions.
• Analytics Cookies: Collect anonymised or pseudonymised data about how users interact with the Platform — such as pages visited, time spent, and navigation paths — to help baggo identify areas for improvement.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and other security threats.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling other cookie categories will not prevent you from accessing the Platform but may reduce personalisation and analytics functionality.

9. Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by baggo:

• Right of Access: You may request a copy of the personal data baggo holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction: You may request that we restrict the processing of your data in certain circumstances, for example while a complaint is being investigated.
• Right to Object: You may object to processing based on legitimate interests. You also have an absolute right to object to the use of your personal data for direct marketing purposes at any time.
• Right to Data Portability: Where processing is carried out by automated means on the basis of consent or contractual necessity, you may request that your data be provided to you in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and include your account username and a description of your request. baggo will acknowledge receipt within 5 business days and aim to fulfil verified requests within 30 days. In complex cases, this period may be extended by a further 30 days, and you will be notified accordingly.

Please note that certain rights are subject to exceptions. For example, baggo cannot erase data that must be retained to comply with legal obligations such as financial record-keeping requirements or anti-money-laundering regulations.

10. Children's Privacy

The baggo Platform is strictly intended for adults aged 18 and above. baggo does not knowingly collect personal data from individuals under the age of 18. If you have reason to believe that a minor has registered an account or submitted personal data to baggo, please notify us immediately at [email protected]. Upon confirmation, baggo will close the account and delete all associated personal data as promptly as possible, subject to any overriding legal retention obligations.

Age verification checks are conducted as part of the KYC process to enforce this requirement. Where baggo identifies that an account holder is or was under 18 at the time of registration, the account will be closed immediately and any deposited funds will be returned to the original payment method after deducting applicable transaction costs.

11. Cross-Border Data Transfers

baggo's primary operations and data processing activities are directed at players based in Bangladesh. Where personal data is transferred to, stored in, or processed by service providers or infrastructure located outside Bangladesh, baggo ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. Such safeguards may include contractual clauses that impose data protection obligations on the recipient, or reliance on the recipient country's recognised adequacy status.

If you would like further information about the safeguards applied to cross-border data transfers, please contact us at [email protected].

12. Changes to This Privacy Policy

baggo reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Where a material change is made, we will notify registered account holders via their registered email address or via a prominent notice on the Platform at least 14 days before the updated Policy takes effect.

The date at the top of this Policy ("Effective") reflects the most recent review date. Your continued use of the baggo Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept the revised Policy, please cease using the Platform and contact us to close your account.

13. Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the baggo data team using the details below:

• Email: [email protected]
• Subject Line: "Privacy Enquiry" or "Data Rights Request"
• Response Time: Within 5 business days for acknowledgement; within 30 days for full resolution
• Live Chat: Available 24/7 via the baggo Platform — average response time 2–5 minutes

baggo takes all privacy enquiries seriously and will work with you in good faith to resolve any concern relating to your personal data. If you are not satisfied with our response, you may seek independent advice or escalate the matter through an appropriate dispute resolution channel.