Privacy Policy — How 27c77 Collects, Uses & Protects Your Data

27c77 ("the Platform", "we", "us", "our") operates the online casino and sports betting services accessible at https://27c77.io, serving players primarily based in Bangladesh. We are committed to protecting the personal information of all individuals who interact with our platform, including registered players, visitors, and prospective users.

This Privacy Policy has been prepared in accordance with general data protection principles and applies to all personal data collected, processed, stored, or transmitted by 27c77 in connection with the operation of the platform. It should be read alongside our Terms and Conditions and Responsible Gaming Policy, both of which are published on the 27c77 platform.

We review and update this Policy periodically. The effective date displayed at the top of this document reflects when the current version was last reviewed. Material changes will be communicated to registered players by notice on the platform or by email to the address held on your account.

For the purposes of this Privacy Policy, 27c77 acts as the data controller in respect of the personal data collected from players and visitors on the platform. As data controller, 27c77 determines the purposes and means by which personal data is processed.

All data protection enquiries, access requests, and formal complaints relating to how 27c77 handles your personal data should be directed to our support team using the contact details provided in Clause 14 of this Policy. We will endeavour to respond to all data-related requests within 30 calendar days of receipt.

27c77 collects personal data that is necessary for the operation of the platform, the delivery of our services, and compliance with applicable legal and regulatory obligations. The categories of data we collect include, but are not limited to, the following:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly necessary for identity verification purposes. Where identity documents containing photographs are submitted for KYC, these are used solely for age and identity verification and are not used for any other purpose.

27c77 collects personal data through the following methods:

• Direct Collection: Data you provide to us directly when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting our support team, or updating your account settings.
• Automated Technical Collection: Data collected automatically when you access or use the platform, including IP addresses, device identifiers, browser fingerprints, session logs, and gameplay event data. This data is collected via server logs, cookies, and related tracking technologies (see Clause 9 for details on cookies).
• Third-Party Sources: In certain circumstances, we may receive data from third-party identity verification partners, fraud detection services, and payment processors to supplement the information you provide directly. All such third parties are contractually required to handle data in a manner consistent with this Policy.
• Publicly Available Sources: Where relevant for fraud prevention or compliance purposes, we may supplement your data with information from publicly available sources such as sanctions lists, politically exposed persons (PEP) registers, or adverse media databases.

27c77 processes your personal data only where a valid legal basis exists for doing so. The table below sets out the primary purposes for which we process personal data and the corresponding legal basis for each purpose:

27c77 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may, however, share your personal data with the following categories of recipients where it is necessary to deliver our services or comply with our legal obligations:

• Payment Service Providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, and other payment processing partners receive the minimum necessary financial data to process your deposit and withdrawal transactions securely.
• Identity Verification Partners: Third-party KYC and age verification service providers may receive copies of your identity documents and personal details solely for the purpose of verifying your identity and age in accordance with our Terms and Conditions.
• Game Content Providers: Game studios and content providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised session and gameplay data to facilitate game delivery and resolve technical disputes. These providers do not receive your full personal profile.
• Fraud and Security Vendors: Specialist fraud prevention and cybersecurity service providers may receive technical and transactional data to help us identify and prevent fraudulent activity on the platform.
• Legal and Regulatory Authorities: We may be required by law, court order, or regulatory direction to disclose your personal data to competent authorities. In such cases, we will disclose only the data specifically required and will notify you where legally permissible to do so.
• Professional Advisers: Our legal advisers, auditors, and accountants may access personal data where strictly necessary to provide professional services to 27c77, subject to confidentiality obligations.

All third parties with whom we share personal data are required to implement appropriate technical and organisational security measures and to process your data only for the specific purpose for which it was shared.

27c77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and Identity Data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping obligations and to resolve any post-closure disputes.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, unless the correspondence relates to an unresolved complaint or legal matter, in which case retention is extended until final resolution.
• Technical and Usage Logs: Retained for up to twelve (12) months from the date of collection, after which they are aggregated and anonymised for analytical purposes.
• Marketing Preferences and Consents: Retained until you withdraw consent or for three (3) years from the date of last marketing interaction, whichever comes first.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

27c77 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 27c77 platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all pages of the platform, including account registration, login, cashier, and support pages.
• Encrypted Data Storage: Sensitive personal data — including payment account details and identity verification documents — is stored in encrypted form. Encryption keys are managed separately from the data they protect.
• Access Controls: Access to personal data within 27c77's internal systems is restricted to staff and contractors who have a legitimate operational need to access that data. All staff with data access undergo data protection training and are subject to confidentiality obligations.
• Intrusion Detection and Monitoring: The platform is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous behaviour patterns. Security incidents are logged, investigated, and remediated promptly.
• Regular Security Assessments: 27c77 conducts periodic security reviews and vulnerability assessments of the platform's infrastructure and data handling systems.
• Payment Security: Payment processing on the 27c77 platform is handled via secure integrations with established payment providers. We do not store full payment account credentials on our servers beyond what is strictly necessary for transaction processing.

27c77 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your logged-in session, analyse platform usage, and support fraud prevention measures. The types of cookies we use are described below:

• Strictly Necessary Cookies: These cookies are essential for the platform to function correctly. They enable core features such as user authentication, session management, and security functions. These cookies cannot be disabled without materially affecting platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, notification settings, and responsible gaming configurations — so that you do not need to re-enter them on each visit.
• Analytics Cookies: These cookies collect anonymised data about how players use the platform, including which pages are visited most frequently and how long sessions last. This data helps us improve the platform experience. Analytics data is aggregated and is not linked to your personal identity.
• Security and Fraud Prevention Cookies: These cookies help us identify and prevent fraudulent activity, detect unusual patterns of behaviour, and protect the integrity of the platform and its users.

Most web browsers allow you to control cookie settings through the browser's preferences menu. You can choose to block certain categories of cookies; however, please note that disabling strictly necessary cookies will impair your ability to use the platform. We do not use third-party advertising or behavioural targeting cookies on the 27c77 platform.

Subject to applicable law, you hold the following rights in respect of your personal data held by 27c77. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will respond to access requests within 30 calendar days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may also update certain data directly through your account settings dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where you have objected to processing. This right is subject to our legal retention obligations — we cannot delete data we are legally required to retain.
• Right to Restriction of Processing: You may request that we restrict processing of your personal data in certain circumstances, for example while a dispute about its accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We will respond to all rights requests within 30 calendar days. Where a request is particularly complex or we receive a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

The 27c77 platform may contain references to third-party services, including game content providers and payment processors. While we take care to work only with reputable third parties, 27c77 does not control the privacy practices of these external services and is not responsible for how they collect, use, or protect personal data.

We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the 27c77 platform. This Privacy Policy applies solely to data collected and processed by 27c77 itself.

The 27c77 platform is strictly for individuals aged 21 years and above. We do not knowingly collect, use, or store personal data from individuals under the age of 21. If you are under 21, you must not use the 27c77 platform or provide us with any personal information.

If we become aware that we have inadvertently collected personal data from an individual under 21, we will take prompt steps to delete that data and close the associated account. If you are a parent or guardian and believe that a minor in your care has provided personal data to 27c77, please contact us immediately at [email protected] so that we can take appropriate action.

27c77 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When we make material changes, we will notify registered players by posting a prominent notice on the platform and, where appropriate, by sending an email notification to the address registered on your account.

The updated Policy will take effect from the date indicated at the top of the document. Your continued use of the 27c77 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

If any change to this Policy materially affects your rights or the way we process your data, and you do not agree with those changes, you should discontinue use of the platform and contact our support team to arrange account closure and any applicable balance withdrawal.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way 27c77 handles your personal data, please contact our dedicated privacy support team using the details below:

• Email: [email protected]
• Subject Line for Privacy Matters: "Privacy Request" or "Data Rights Request"
• Support Hours: 24/7, Bangladesh Standard Time (UTC+6)
• Response Language: English
• Target Response Time: Within 30 calendar days for data rights requests; within 48 hours for general privacy enquiries

All formal data rights requests and privacy complaints must be submitted in writing via email. We will acknowledge receipt of your correspondence within 48 hours. If your request cannot be resolved within 30 days, we will provide you with a written update on its progress and the estimated timeline for resolution.